远程线程注入

来源：互联网发布：水果作曲软件中文版编辑：程序博客网时间：2024/05/22 10:44
DWORD GetProcessID(char *FileName){HANDLE myhProcess;PROCESSENTRY32 mype;mype.dwSize = sizeof(PROCESSENTRY32); BOOL mybRet;//进行进程快照myhProcess=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0); //TH32CS_SNAPPROCESS快照所有进程//开始进程查找mybRet=Process32First(myhProcess,&mype);//循环比较，得出ProcessIDwhile(mybRet){if(strcmp(FileName,mype.szExeFile)==0)return mype.th32ProcessID;elsemybRet=Process32Next(myhProcess,&mype);}return 0;}void EnableDebugPriv(const char * name)//提升权限{    HANDLE hToken;    TOKEN_PRIVILEGES tp;    LUID luid;    //打开进程令牌环    OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES|TOKEN_QUERY, &hToken);    //获得进程本地唯一ID    LookupPrivilegeValue(NULL, name, &luid) ;         tp.PrivilegeCount = 1;    tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;    tp.Privileges[0].Luid = luid;    //调整权限    AdjustTokenPrivileges(hToken, 0, &tp, sizeof(TOKEN_PRIVILEGES), NULL, NULL);}BOOL InjectDll(const char *DllFullPath, const DWORD dwRemoteProcessId){    HANDLE hRemoteProcess;    EnableDebugPriv(SE_DEBUG_NAME);    //打开远程线程    hRemoteProcess = OpenProcess( PROCESS_ALL_ACCESS, FALSE, dwRemoteProcessId );    char *pszLibFileRemote;    //使用VirtualAllocEx函数在远程进程的内存地址空间分配DLL文件名空间    pszLibFileRemote = (char *) VirtualAllocEx( hRemoteProcess, NULL, lstrlen(DllFullPath)+1, MEM_COMMIT, PAGE_READWRITE);    //使用WriteProcessMemory函数将DLL的路径名写入到远程进程的内存空间    WriteProcessMemory(hRemoteProcess, pszLibFileRemote, (void *) DllFullPath, lstrlen(DllFullPath)+1, NULL);    //##############################################################################    //计算LoadLibraryA的入口地址    PTHREAD_START_ROUTINE pfnStartAddr = (PTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandle("Kernel32"), "LoadLibraryA");    //(关于GetModuleHandle函数和GetProcAddress函数)    //启动远程线程LoadLibraryA，通过远程线程调用创建新的线程    HANDLE hRemoteThread;    if((hRemoteThread = CreateRemoteThread( hRemoteProcess, NULL, 0, pfnStartAddr, pszLibFileRemote, 0, NULL))==NULL)return FALSE;    //##############################################################################    /*    // 在//###.....//###里的语句也可以用如下的语句代替:     DWORD dwID;     LPVOID pFunc = LoadLibraryA;     HANDLE hRemoteThread = CreateRemoteThread(hRemoteProcess, NULL, 0, (LPTHREAD_START_ROUTINE)pFunc, pszLibFileRemote, 0, &dwID );     //是不是感觉简单了很多    */    CloseHandle(hRemoteProcess);    CloseHandle(hRemoteThread);    return TRUE;}
InjectDll("C:\\test.dll",GetProcessID("calc.exe"));
//注：32位编译程序只可注入32位进程，64位编译可注入64位进程
0 0