#include <windows.h>
#include <tlhelp32.h>
#include <stdio.h>
#pragma comment(lib, "Advapi32.lib")
BOOL SetPrivilege(HANDLE hToken,LPCTSTR lpszPrivilege,BOOL bEnablePrivilege)//improve a privilege
{
TOKEN_PRIVILEGES tp;
LUID luid;
if(!LookupPrivilegeValue(NULL,lpszPrivilege,&luid))
{
printf("\nLookupPrivilegeValue error:%d", GetLastError() );
return FALSE;
}
tp.PrivilegeCount = 1;
tp.Privileges[0].Luid = luid;
if (bEnablePrivilege)
tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
else
tp.Privileges[0].Attributes = 0;
// Enable the privilege or disable all privileges.
AdjustTokenPrivileges(
hToken,
FALSE,
&tp,
sizeof(TOKEN_PRIVILEGES),
(PTOKEN_PRIVILEGES) NULL,
(PDWORD) NULL);
// Call GetLastError to determine whether the function succeeded.
if (GetLastError() != ERROR_SUCCESS)
{
//printf("AdjustTokenPrivileges failed: %u\n", GetLastError() );
return FALSE;
}
return TRUE;
}
int main(int argc,char **argv)
{
HANDLE hToken;
char lpszDll[MAX_PATH];
char szTargetExe[MAX_PATH];
DWORD dwPID;
HANDLE hProcess;
DWORD dwSize, dwWritten;
LPVOID lpBuf;
DWORD dwID;
LPVOID pFunc;
HANDLE hThread;
PROCESS_INFORMATION piProcInfo;
STARTUPINFO siStartInfo;
int ret = 1;
if(argc!=3)
{
printf("Usage:%s ProcessName DllName",argv[0]);
return 1;
}
strcpy(szTargetExe,argv[1]);
strcpy(lpszDll,argv[2]);
ZeroMemory( &piProcInfo, sizeof(PROCESS_INFORMATION) );
ZeroMemory( &siStartInfo, sizeof(STARTUPINFO) );
siStartInfo.cb = sizeof(STARTUPINFO);
if(!CreateProcessA(NULL,
szTargetExe, // command line
NULL, // process security attributes
NULL, // primary thread security attributes
TRUE, // handles are inherited
CREATE_SUSPENDED,// creation flags
NULL, // use parent's environment
NULL, // use parent's current directory
&siStartInfo, // STARTUPINFO pointer
&piProcInfo)) // receives PROCESS_INFORMATION
{
printf("CreateProcessA failed!!!\n");
goto fail1;
}
dwPID = piProcInfo.dwProcessId;
if(OpenProcessToken(GetCurrentProcess(),TOKEN_ALL_ACCESS,&hToken))
SetPrivilege(hToken,SE_DEBUG_NAME,TRUE);
else
{
printf("OpenProcessToken failed!!!\n");
goto fail1;
}
hProcess = OpenProcess(
PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION | PROCESS_VM_WRITE,
FALSE, dwPID );
if(hProcess ==NULL)
{
printf("OpenProcess failed\n");
goto fail1;
}
dwSize = lstrlenA( lpszDll ) + 1;
lpBuf = VirtualAllocEx( hProcess, NULL, dwSize, MEM_COMMIT, PAGE_READWRITE );
if ( NULL == lpBuf )
{
printf("VirtualAllocEx failed!\n");
goto fail2;
}
if ( !WriteProcessMemory( hProcess, lpBuf, (LPVOID)lpszDll, dwSize, &dwWritten )
|| dwWritten != dwSize)
{
printf("WriteProcessMemory failed!\n");
goto fail3;
}
// 使目标进程调用LoadLibrary,加载DLL
pFunc = LoadLibraryA;
hThread = CreateRemoteThread( hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)pFunc, lpBuf, 0, &dwID );
if(hThread == NULL)
{
printf("CreateRemoteThread failed!\n");
goto fail3;
}
ResumeThread(piProcInfo.hThread);
CloseHandle(piProcInfo.hThread);
WaitForSingleObject(hThread, INFINITE);
CloseHandle(hThread);
ret = 0;
fail3:
VirtualFreeEx( hProcess, lpBuf, dwSize, MEM_DECOMMIT );
fail2:
CloseHandle( hProcess );
fail1:
if(ret == 1)
{
printf("Dll Injected Failed!!!\n");
printf("GetLastError : %d\n", GetLastError());
}
else
printf("Dll Injected Successfully!!!\n");
return ret;
}
自己用了很久的线程注入的代码
最新推荐文章于 2023-01-25 11:00:29 发布