Dll Injection Using CreateRemoteThread()

Publicado por luchin On viernes, 28 de enero de 2011 0 comentarios

Description // Info




Source Code

  1. #define PROCESS_NAME \"target.exe\"
  2. #define DLL_NAME \"injected.dll\"
  3.  
  4.  
  5. //I could just use PROCESS_ALL_ACCESS but it\'s always best to use the absolute bare minimum of
  6. //priveleges, so that your code works in as
  7. //many circumstances as possible.
  8. #define CREATE_THREAD_ACCESS (PROCESS_CREATE_THREAD |
  9.                               PROCESS_QUERY_INFORMATION |
  10.                               PROCESS_VM_OPERATION |
  11.                               PROCESS_VM_WRITE |
  12.                               PROCESS_VM_READ
  13.                              )
  14.  
  15. BOOL WriteProcessBYTES(HANDLE hProcess,LPVOID lpBaseAddress,LPCVOID lpBuffer,SIZE_T nSize);
  16.  
  17. BOOL LoadDll(char *procName, char *dllName);
  18. BOOL InjectDLL(DWORD ProcessID, char *dllName);
  19. unsigned long GetTargetProcessIdFromProcname(char *procName);
  20.  
  21. bool IsWindowsNT()
  22. {
  23.    // check current version of Windows
  24.    DWORD version = GetVersion();
  25.    // parse return
  26.    DWORD majorVersion = (DWORD)(LOBYTE(LOWORD(version)));
  27.    DWORD minorVersion = (DWORD)(HIBYTE(LOWORD(version)));
  28.    return (version < 0x80000000);
  29. }
  30.  
  31. int WINAPI WinMain(HINSTANCE hInstance,HINSTANCE hPrevInstance,LPSTR lpCmdLine,int nCmdShow)
  32. {
  33.     if(IsWindowsNT())
  34.        LoadDll(PROCESS_NAME, DLL_NAME);
  35.     else
  36.    MessageBox(0, \"Your system does not support this method\", \"Error!\", 0);
  37.  
  38.     return 0;
  39. }
  40.  
  41.  
  42. BOOL LoadDll(char *procName, char *dllName)
  43. {
  44.    DWORD ProcID = 0;
  45.  
  46.    ProcID = GetProcID(procName);
  47.  
  48.    if(!(InjectDLL(ProcID, dllName)))
  49.       MessageBox(NULL, \"Process located, but injection failed\", \"Loader\", NULL);
  50.    
  51.    return true;
  52. }
  53.  
  54. BOOL InjectDLL(DWORD ProcessID, char *dllName)
  55. {
  56.    HANDLE Proc;
  57.    char buf[50]={0};
  58.    LPVOID RemoteString, LoadLibAddy;
  59.  
  60.    if(!ProcessID)
  61.       return false;
  62.    Proc = OpenProcess(CREATE_THREAD_ACCESS, FALSE, ProcessID);
  63.    if(!Proc)
  64.    {
  65.       sprintf(buf, \"OpenProcess() failed: %d\", GetLastError());
  66.       MessageBox(NULL, buf, \"Loader\", NULL);
  67.       return false;
  68.    }
  69.    LoadLibAddy = (LPVOID)GetProcAddress(GetModuleHandle(\"kernel32.dll\"), \"LoadLibraryA\");
  70.  
  71.  
  72.    RemoteString = (LPVOID)VirtualAllocEx(Proc,
  73.                                          NULL,
  74.                                          strlen(DLL_NAME),
  75.                                          MEM_RESERVE|MEM_COMMIT,
  76.                                          PAGE_READWRITE
  77.                                         );
  78.    WriteProcessMemory(Proc, (LPVOID)RemoteString, DLL_NAME,strlen(DLL_NAME), NULL);
  79.    CreateRemoteThread(Proc,
  80.                       NULL,
  81.                       NULL,
  82.                       (LPTHREAD_START_ROUTINE)LoadLibAddy,
  83.                       (LPVOID)RemoteString,
  84.                       NULL,
  85.                       NULL
  86.                      );    
  87.    CloseHandle(Proc);
  88.    return true;
  89. }
  90.  
  91. unsigned long GetTargetProcessIdFromProcname(char *procName)
  92. {
  93.    PROCESSENTRY32 pe;
  94.    HANDLE thSnapshot;
  95.    BOOL retval, ProcFound = false;
  96.    thSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
  97.    if(thSnapshot == INVALID_HANDLE_VALUE)
  98.    {
  99.       MessageBox(NULL, \"Error: unable to create toolhelp snapshot\", \"Loader\", NULL);
  100.       return false;
  101.    }
  102.    pe.dwSize = sizeof(PROCESSENTRY32);
  103.    retval = Process32First(thSnapshot, &pe);
  104.    while(retval)
  105.    {
  106.       if(StrStrI(pe.szExeFile, procName) )
  107.       {
  108.          ProcFound = true;
  109.          break;
  110.       }
  111.       retval    = Process32Next(thSnapshot,&pe);
  112.       pe.dwSize = sizeof(PROCESSENTRY32);
  113.    }
  114.    return pe.th32ProcessID;
  115. }

Publicado por luchin en 12:08

0 comentarios:

Publicar un comentario

Suscribirse a: Enviar comentarios (Atom)
Twitter Delicious Facebook Digg Stumbleupon Favorites More