windows父进程欺骗

Windows 父进程欺骗技术,其实就是创建一个进程,指定其他进程为这个新创建进程的父进程。

#include <windows.h>
#include <TlHelp32.h>
#include <iostream>

DWORD getParentProcessID() { //返回explorer.exe的pid
    HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    PROCESSENTRY32 process = { 0 };
    process.dwSize = sizeof(process);

    if (Process32First(snapshot, &process)) {
        do {
            //If you want to another process as parent change here
            if (!wcscmp(process.szExeFile, L"explorer.exe"))
                break;
        } while (Process32Next(snapshot, &process));
    }

    CloseHandle(snapshot);
    return process.th32ProcessID;
}

int main() {
    STARTUPINFOEXA sInfoEX;
    PROCESS_INFORMATION pInfo;
    SIZE_T sizeT;

    HANDLE expHandle = OpenProcess(PROCESS_ALL_ACCESS, false, getParentProcessID()); //打开explorer进程获取当前进程所有权限

    ZeroMemory(&sInfoEX, sizeof(STARTUPINFOEXA)); //用0填充数组
    InitializeProcThreadAttributeList(NULL, 1, 0, &sizeT); //初始化指定的属性列表以创建进程和线程
    sInfoEX.lpAttributeList = (LPPROC_THREAD_ATTRIBUTE_LIST)HeapAlloc(GetProcessHeap(), 0, sizeT); //设置进程属性并从堆中分配内存
    InitializeProcThreadAttributeList(sInfoEX.lpAttributeList, 1, 0, &sizeT);
    UpdateProcThreadAttribute(sInfoEX.lpAttributeList, 0, PROC_THREAD_ATTRIBUTE_PARENT_PROCESS, &expHandle, sizeof(HANDLE), NULL, NULL); //更新用于进程和线程创建的属性列表中的指定属性。
    sInfoEX.StartupInfo.cb = sizeof(STARTUPINFOEXA);

    //CreateProcessA("C:\\Program Files\\internet explorer\\iexplore.exe", NULL, NULL, NULL, TRUE, CREATE_SUSPENDED | CREATE_NO_WINDOW | EXTENDED_STARTUPINFO_PRESENT, NULL, NULL, reinterpret_cast<LPSTARTUPINFOA>(&sInfoEX), &pInfo);
    CreateProcessA("notepad.exe", NULL, NULL, NULL, TRUE, CREATE_SUSPENDED | CREATE_NO_WINDOW | EXTENDED_STARTUPINFO_PRESENT, NULL, NULL, reinterpret_cast<LPSTARTUPINFOA>(&sInfoEX), &pInfo);

    ResumeThread(pInfo.hThread); //启动线程
    CloseHandle(pInfo.hThread); //关闭线程
    STARTUPINFOEXA si;
    PROCESS_INFORMATION pi;

    ZeroMemory(&si, sizeof(si));
    //si.cb = sizeof(si);
    ZeroMemory(&pi, sizeof(pi));

   

    // Start the child process. 
    if (!CreateProcessA(NULL,   // No module name (use command line)
        (LPSTR)"notepad1.exe",        // Command line
        NULL,           // Process handle not inheritable
        NULL,           // Thread handle not inheritable
        FALSE,          // Set handle inheritance to FALSE
        0,              // No creation flags
        NULL,           // Use parent's environment block
        NULL,           // Use parent's starting directory 
        reinterpret_cast<LPSTARTUPINFOA>(&si),            // Pointer to STARTUPINFO structure
        &pi)           // Pointer to PROCESS_INFORMATION structure
        )
    {
        printf("CreateProcess failed (%d).\n", GetLastError());
        return 0 ;
    }

    while (1);
    return 0;
}

 

 

  • 0
    点赞
  • 2
    收藏
    觉得还不错? 一键收藏
  • 0
    评论
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值