C# 实现shellcode 进程启动注入eip注入

首先说下代码原理  

1.使用CreateProcess 创建一个带 CREATE_SUSPENDED标记的进程

自然进程创建加载完DLL后会被挂起。 CREATE_SUSPENDED 标记本是为调试器准备的。

2.然后用GetThreadContext获取该进程的线程上下文，保存下来(重要)。。。。

3.用VirtualAllocEx 在进程空间申请一段 dll路径长度 + 32字节的内存(这里直接申请了1k) 用来存放shellcode 

和dll路径。 

4.把 DLL路径用 WriteProcessMemory 写入到申请的内存空间地址 

5.然后组合计算shellcode代码(这里将不解释计算，具体看代码注释)

6.把shellcode用WriteProcessMemory 写入到申请的内存空间地址

7.修改上下文状态的 Eip为刚用VirtualAllocEx 申请的内存地址

8.用 SetThreadContext 设置线程上下文状态

9.用 ResumeThread 恢复线程。

下面给出代码 两个类  一个 注入， 一个API

使用方式

 Win32.Injection.EipInject EI = new Win32.Injection.EipInject();

EI.CreateProcess(@"D:\Test.exe",@"D:\Test.dll");

using System;
using System.Runtime.InteropServices;

namespace Win32.Injection
{
    public static class WinApi
    {
        public const int CREATE_SUSPENDED = 0x00000004;
        public const UInt32 MEM_COMMIT = 0x00001000;
        public const UInt32 CONTEXT_i386 = 0x00010000;   // this assumes that i386 and
        public const UInt32 CONTEXT_CONTROL = (CONTEXT_i386 | 0x00000001); // SS:SP, CS:IP, FLAGS, BP

        [DllImport("kernel32")]
        public static extern IntPtr LoadLibrary(string lpLibFileName);
        [DllImport("kernel32")]
        public static extern IntPtr GetProcAddress(IntPtr hModule, string lpProcName);
        [DllImport("kernel32", EntryPoint = "VirtualAllocEx")]
        public static extern IntPtr VirtualAllocEx(IntPtr hProcess, IntPtr lpAddress, Int32 dwSize, UInt32 flAllocationType, PAGE_EXECUTE_ENUM flProtect);
        [DllImport("kernel32", EntryPoint = "GetThreadContext")]
        public static extern int GetThreadContext(IntPtr hThread, ref CONTEXT lpContext);
        [DllImport("kernel32")]
        public static extern Int32 WriteProcessMemory(IntPtr hProcess, IntPtr lpBassAddress, byte[] lpBuffer, Int32 nSize, IntPtr lpNumberOfBytesRead);
        [DllImport("kernel32", EntryPoint = "SetThreadContext")]
        public static extern int SetThreadContext(IntPtr hThread, ref CONTEXT lpContext);
        [DllImport("kernel32", EntryPoint = "ResumeThread")]
        public static extern int ResumeThread(IntPtr hThread);


        public enum PAGE_EXECUTE_ENUM
        {
            PAGE_EXECUTE_READ = 0x20,
            PAGE_EXECUTE_READWRITE = 0x40
        }

        public struct STARTUPINFO
        {
            public int cb;
            public string lpReserved;
            public string lpDesktop;
            public string lpTitle;
            public int dwX;
            public int dwY;
            public int dwXSize;
            public int dwYSize;
            public int dwXCountChars;
            public int dwYCountChars;
            public int dwFillAttribute;
            public int dwFlags;
            public short wShowWindow;
            public short cbReserved2;
            public int lpReserved2;
            public IntPtr hStdInput;
            public IntPtr hStdOutput;
            public IntPtr hStdError;
        }
        public struct PROCESS_INFORMATION
        {
            public IntPtr hProcess;
            public IntPtr hThread;
            public int dwProcessId;
            public int dwThreadId;
        }

        [DllImport("kernel32", EntryPoint = "CreateProcess")]
        public static extern int CreateProcess(
            string lpApplicationName,
            string lpCommandLine,
            IntPtr lpProcessAttributes,
            IntPtr lpThreadAttributes,
            bool bInheritHandles,
            int dwCreationFlags,
            IntPtr lpEnvironment,
            String lpCurrentDriectory,
            ref STARTUPINFO lpStartupInfo,
            ref PROCESS_INFORMATION lpProcessInformation);

        public struct FLOATING_SAVE_AREA
        {
            public UInt32 ControlWord;
            public UInt32 StatusWord;
            public UInt32 TagWord;
            public UInt32 ErrorOffset;
            public UInt32 ErrorSelector;
            public UInt32 DataOffset;
            public UInt32 DataSelector;
            [MarshalAs(UnmanagedType.ByValArray, SizeConst = 80)]
            public Byte[] RegisterArea;
            public UInt32 Spare0;
        }
        /// <summary>
        /// 寄存器上下文
        /// </summary>
        public struct CONTEXT
        {
            public UInt32 ContextFlags;
            //
            // This section is specified/returned if CONTEXT_DEBUG_REGISTERS is
            // set in ContextFlags.  Note that CONTEXT_DEBUG_REGISTERS is NOT
            // included in CONTEXT_FULL.
            //
            public UInt32 Dr0;
            public UInt32 Dr1;
            public UInt32 Dr2;
            public UInt32 Dr3;
            public UInt32 Dr6;
            public UInt32 Dr7;

            //
            // This section is specified/returned if the
            // ContextFlags word contians the flag CONTEXT_FLOATING_POINT.
            //

            public FLOATING_SAVE_AREA FloatSave;

            //
            // This section is specified/returned if the
            // ContextFlags word contians the flag CONTEXT_SEGMENTS.
            //

            public UInt32 SegGs;
            public UInt32 SegFs;
            public UInt32 SegEs;
            public UInt32 SegDs;

            //
            // This section is specified/returned if the
            // ContextFlags word contians the flag CONTEXT_INTEGER.
            //

            public UInt32 Edi;
            public UInt32 Esi;
            public UInt32 Ebx;
            public UInt32 Edx;
            public UInt32 Ecx;
            public UInt32 Eax;

            //
            // This section is specified/returned if the
            // ContextFlags word contians the flag CONTEXT_CONTROL.
            //

            public UInt32 Ebp;
            public UInt32 Eip;
            public UInt32 SegCs;              // MUST BE SANITIZED
            public UInt32 EFlags;             // MUST BE SANITIZED
            public UInt32 Esp;
            public UInt32 SegSs;

            //
            // This section is specified/returned if the ContextFlags word
            // contains the flag CONTEXT_EXTENDED_REGISTERS.
            // The format and contexts are processor specific
            //

            //BYTE ExtendedRegisters[MAXIMUM_SUPPORTED_EXTENSION];

            [MarshalAs(UnmanagedType.ByValArray, SizeConst = 512)]
            public Byte[] ExtendedRegisters;
        }



    }
}

using System;
using System.Text;

namespace Win32.Injection
{
    public class EipInject
    {

        public EipInject()
        {
            // pushad  
            ShellCode[0] = 0x60;
            // pushfd  
            ShellCode[1] = 0x9c;
            // push  
            ShellCode[2] = 0x68;
            //call  
            ShellCode[7] = 0xE8;
            // popfd 
            ShellCode[12] = 0x9d;
            // popad
            ShellCode[13] = 0x61;
            // jmp 
            ShellCode[14] = 0xE9;
            hModule = WinApi.LoadLibrary("Kernel32.dll");
            //获取MessageBoxA地址
            LoadLibrary_addr = WinApi.GetProcAddress(hModule, "LoadLibraryA");
        }

        /// <summary>
        /// 创建指定进程并加载DLL
        /// </summary>
        /// <param name="AppPath"></param>
        /// <param name="DllPath"></param>
        /// <returns></returns>
        public bool CreateProcess(String AppPath, String DllPath)
        {

            WinApi.CONTEXT context = new WinApi.CONTEXT();
            Byte[] DllPathData = Encoding.Default.GetBytes(DllPath);
            if (!_CreateProcess(AppPath))
            {
                return false;
            }
            //获取线程上下文
            context.ContextFlags = WinApi.CONTEXT_CONTROL;
            if (WinApi.GetThreadContext(hThread, ref context) != 0)
            {
                Int32 dwSize = 1024;
                //申请内存
                IntPtr pProcessMem = AllocMemory(dwSize);
                if (pProcessMem == IntPtr.Zero)
                {
                    return false;
                }
                //DLL路径地址   pProcessMem + 0x100
                BuilderValue(ShellCode, 3, pProcessMem + 0x100);
                //LoadLibrary地址   地址等于   CALL绝对地址 - 下条指令地址
                BuilderValue(ShellCode, 8, LoadLibrary_addr - (pProcessMem.ToInt32() + 12));
                // 跳回 旧的 eip 地址   ct.Eip - (pProcessMem + 19);  （绝对地址-下条指令地址）
                BuilderValue(ShellCode, 15, (int)context.Eip - (pProcessMem.ToInt32() + 19));
                //先把 ShellCode 写进地址
                WinApi.WriteProcessMemory(hProcess, pProcessMem, ShellCode, ShellCode.Length, IntPtr.Zero);
                //把DLL路径写到内存里，从0x100(256)开始 
                WinApi.WriteProcessMemory(hProcess, (pProcessMem + 0x100), DllPathData, DllPathData.Length, IntPtr.Zero);
                //改写EIP
                context.Eip = (UInt32)pProcessMem;
                //把线程上下文写回去
                WinApi.SetThreadContext(hThread, ref context);
                //恢复挂起线程
                WinApi.ResumeThread(hThread);
                return true;
            }
            else
            {
                return false;
            }
        }

        /// <summary>
        /// 负责创建一个被挂起的进程
        /// </summary>
        /// <param name="AppPath"></param>
        /// <returns></returns>
        private bool _CreateProcess(String AppPath)
        {
            WinApi.STARTUPINFO si = new WinApi.STARTUPINFO();
            WinApi.PROCESS_INFORMATION PI = new WinApi.PROCESS_INFORMATION();
            int HResult = WinApi.CreateProcess(
                null,
                //   程序路径       命令行
                AppPath,
                IntPtr.Zero,
                IntPtr.Zero,
                false,
                //   挂起进程            只调试这个进程
                WinApi.CREATE_SUSPENDED,
                IntPtr.Zero,
                //工作目录
                System.IO.Path.GetDirectoryName(AppPath),
                ref si,
                ref PI);
            if (HResult == 0)
                return false;
            hProcess = PI.hProcess;
            hThread = PI.hThread;
            return true;
        }
        /// <summary>
        /// 负责申请一段内存
        /// </summary>
        /// <param name="Size"></param>
        /// <returns></returns>
        private IntPtr AllocMemory(Int32 Size)
        {
            return WinApi.VirtualAllocEx(hProcess, IntPtr.Zero, Size, WinApi.MEM_COMMIT, WinApi.PAGE_EXECUTE_ENUM.PAGE_EXECUTE_READWRITE);
        }

        /// <summary>
        /// 负责把四字节整数写进shellcode
        /// </summary>
        /// <param name="ShellCode"></param>
        /// <param name="Index"></param>
        /// <param name="Value"></param>
        private void BuilderValue(Byte[] ShellCode, Int32 Index, IntPtr Value)
        {
            Byte[] DATA = BitConverter.GetBytes(Value.ToInt32());
            Array.Copy(DATA, 0, ShellCode, Index, 4);
        }

        /// <summary>
        /// 负责把四字节整数写进shellcode
        /// </summary>
        /// <param name="ShellCode"></param>
        /// <param name="Index"></param>
        /// <param name="Value"></param>
        private void BuilderValue(Byte[] ShellCode, Int32 Index, Int32 Value)
        {
            Byte[] DATA = BitConverter.GetBytes(Value);
            Array.Copy(DATA, 0, ShellCode, Index, 4);
        }



        /// <summary>
        /// 创建进程句柄
        /// </summary>
        public IntPtr hProcess = IntPtr.Zero;
        /// <summary>
        /// 创建进程线程句柄
        /// </summary>
        public IntPtr hThread = IntPtr.Zero;
        private IntPtr hModule = IntPtr.Zero;
        private IntPtr LoadLibrary_addr = IntPtr.Zero;
        private Byte[] ShellCode = new byte[32];

    }
}