Dll Injection Using Code Caves

Publicado por luchin On viernes, 28 de enero de 2011 0 comentarios

Description // Info




Source Code

  1. #define PROC_NAME \"target.exe\"
  2. #define DLL_NAME \"injected.dll\"
  3.  
  4. unsigned long GetTargetProcessIdFromProcname(char *procName);
  5. unsigned long GetTargetThreadIdFromProcname(char *procName);
  6.  
  7. __declspec(naked) loadDll(void)
  8. {
  9.    _asm{
  10.       //   Placeholder for the return address
  11.       push 0xDEADBEEF
  12.  
  13.       //   Save the flags and registers
  14.       pushfd
  15.       pushad
  16.  
  17.       //   Placeholder for the string address and LoadLibrary
  18.       push 0xDEADBEEF
  19.       mov eax, 0xDEADBEEF
  20.  
  21.       //   Call LoadLibrary with the string parameter
  22.       call eax
  23.  
  24.       //   Restore the registers and flags
  25.       popad
  26.       popfd
  27.        
  28.       //   Return control to the hijacked thread
  29.       ret
  30.    }
  31. }
  32.  
  33. __declspec(naked) loadDll_end(void)
  34. {
  35. }
  36.  
  37. int WINAPI WinMain(HINSTANCE hInstance,HINSTANCE hPrevInstance,LPSTR lpCmdLine,int nCmdShow)
  38. {
  39.    void *dllString;
  40.    void *stub;
  41.    unsigned long wowID, threadID, stubLen, oldIP, oldprot, loadLibAddy;
  42.     HANDLE hProcess, hThread;
  43.    CONTEXT ctx;
  44.    
  45.    stubLen = (unsigned long)loadDll_end - (unsigned long)loadDll;
  46.    
  47.    loadLibAddy = (unsigned long)GetProcAddress(GetModuleHandle(\"kernel32.dll\"), \"LoadLibraryA\");
  48.  
  49.    wowID    = GetTargetProcessIdFromProcname(PROC_NAME);
  50.    hProcess = OpenProcess((PROCESS_VM_WRITE | PROCESS_VM_OPERATION), false, wowID);
  51.  
  52. dllString = VirtualAllocEx(hProcess,
  53.                            NULL,
  54.                            (strlen(DLL_NAME) + 1),
  55.                            MEM_COMMIT,
  56.                            PAGE_READWRITE
  57.                           );
  58. stub      = VirtualAllocEx(hProcess,
  59.                            NULL,
  60.                            stubLen,
  61.                            MEM_COMMIT,
  62.                            PAGE_EXECUTE_READWRITE
  63.                           );
  64.    WriteProcessMemory(hProcess, dllString, DLL_NAME, strlen(DLL_NAME), NULL);
  65.    
  66.    threadID = GetTargetThreadIdFromProcname(PROC_NAME);
  67.    hThread   = OpenThread((THREAD_GET_CONTEXT | THREAD_SET_CONTEXT | THREAD_SUSPEND_RESUME),
  68.                         false,
  69.                         threadID
  70.                        );
  71.    SuspendThread(hThread);
  72.  
  73.    ctx.ContextFlags = CONTEXT_CONTROL;
  74.    GetThreadContext(hThread, &ctx);
  75.    oldIP   = ctx.Eip;
  76.    ctx.Eip = (DWORD)stub;
  77.    ctx.ContextFlags = CONTEXT_CONTROL;
  78.  
  79.    VirtualProtect(loadDll, stubLen, PAGE_EXECUTE_READWRITE, &oldprot);
  80.    memcpy((void *)((unsigned long)loadDll + 1), &oldIP, 4);
  81.    memcpy((void *)((unsigned long)loadDll + 8), &dllString, 4);
  82.    memcpy((void *)((unsigned long)loadDll + 13), &loadLibAddy, 4);
  83.  
  84.     WriteProcessMemory(hProcess, stub, loadDll, stubLen, NULL);
  85.    SetThreadContext(hThread, &ctx);
  86.  
  87.    ResumeThread(hThread);
  88.  
  89.    Sleep(8000);
  90.  
  91.    VirtualFreeEx(hProcess, dllString, strlen(DLL_NAME), MEM_DECOMMIT);
  92.    VirtualFreeEx(hProcess, stub, stubLen, MEM_DECOMMIT);
  93.    CloseHandle(hProcess);
  94.    CloseHandle(hThread);
  95.  
  96.     return 0;
  97. }
  98.  
  99.  
  100. unsigned long GetTargetProcessIdFromProcname(char *procName)
  101. {
  102.    PROCESSENTRY32 pe;
  103.    HANDLE thSnapshot;
  104.    BOOL retval, ProcFound = false;
  105.  
  106.    thSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
  107.  
  108.    if(thSnapshot == INVALID_HANDLE_VALUE)
  109.    {
  110.       MessageBox(NULL,
  111.                  \"Error: unable to create toolhelp snapshot\",
  112.                  \"Loader\",
  113.                  NULL
  114.                 );
  115.       return false;
  116.    }
  117.  
  118.    pe.dwSize = sizeof(PROCESSENTRY32);
  119.  
  120.     retval = Process32First(thSnapshot, &pe);
  121.  
  122.    while(retval)
  123.    {
  124.       if(StrStrI(pe.szExeFile, procName) )
  125.       {
  126.          ProcFound = true;
  127.          break;
  128.       }
  129.  
  130.       retval    = Process32Next(thSnapshot,&pe);
  131.       pe.dwSize = sizeof(PROCESSENTRY32);
  132.    }
  133.  
  134.    CloseHandle(thSnapshot);
  135.    return pe.th32ProcessID;
  136. }
  137.  
  138. unsigned long GetTargetThreadIdFromProcname(char *procName)
  139. {
  140.    PROCESSENTRY32 pe;
  141.    HANDLE thSnapshot, hProcess;
  142.    BOOL retval, ProcFound = false;
  143.    unsigned long pTID, threadID;
  144.  
  145.    thSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
  146.  
  147.    if(thSnapshot == INVALID_HANDLE_VALUE)
  148.    {
  149.       MessageBox(NULL,
  150.                  \"Error: unable to create toolhelp snapshot\",
  151.                  \"Loader\",
  152.                  NULL
  153.                 );
  154.       return false;
  155.    }
  156.  
  157.    pe.dwSize = sizeof(PROCESSENTRY32);
  158.  
  159.     retval = Process32First(thSnapshot, &pe);
  160.  
  161.    while(retval)
  162.    {
  163.       if(StrStrI(pe.szExeFile, procName) )
  164.       {
  165.          ProcFound = true;
  166.          break;
  167.       }
  168.  
  169.       retval    = Process32Next(thSnapshot,&pe);
  170.       pe.dwSize = sizeof(PROCESSENTRY32);
  171.    }
  172.  
  173.    CloseHandle(thSnapshot);
  174.    
  175.    _asm {
  176.       mov eax, fs:[0x18]
  177.       add eax, 36
  178.       mov [pTID], eax
  179.    }
  180.  
  181.    hProcess = OpenProcess(PROCESS_VM_READ, false, pe.th32ProcessID);
  182.    ReadProcessMemory(hProcess, (const void *)pTID, &threadID, 4, NULL);
  183.    CloseHandle(hProcess);
  184.  
  185.    return threadID;
  186. }

Publicado por luchin en 12:08

0 comentarios:

Publicar un comentario

Suscribirse a: Enviar comentarios (Atom)
Twitter Delicious Facebook Digg Stumbleupon Favorites More