1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
|
#include <stdio.h>
#include <windows.h>
#define CREATE_THREAD_ACCESS (PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION | PROCESS_SUSPEND_RESUME | PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_VM_READ)
typedef HMODULE (*_load_library)(const char *);
int main(int argc, char *argv[])
{
char buf[MAX_PATH];
STARTUPINFO si;
PROCESS_INFORMATION pi;
HMODULE kernel32;
HANDLE process;
HANDLE thread;
_load_library load_library;
LPVOID remote_string;
DWORD length;
DWORD exit_code; /* actually the base address of the mapped DLL */
if (argc < 2)
{
printf ("Usage: %s file\n\n", argv[0]);
return -1;
}
length = GetFullPathName("valgrind.dll", MAX_PATH, buf, NULL);
if (!length)
{
printf ("can't get full path name\n");
return -1;
}
printf (" * filename : %s\n", buf);
ZeroMemory(&pi, sizeof(PROCESS_INFORMATION));
ZeroMemory(&si, sizeof(STARTUPINFO));
si.cb = sizeof(STARTUPINFO);
if (!CreateProcess(NULL, argv[1], NULL, NULL, TRUE,
CREATE_SUSPENDED, NULL, NULL, &si, &pi))
{
printf ("can't spawn child process\n");
return -1;
}
printf (" * child process launched\n");
/* Check if CreateRemoteThread() is available. */
/* MSDN suggests to check the availability of a */
/* function instead of checking the Windows version. */
kernel32 = LoadLibrary("kernel32.dll");
if (!kernel32)
{
printf("no kernel32.dll found\n");
goto close_handles;
}
printf (" * kernel32.dll loaded\n");
if (!GetProcAddress(kernel32, "CreateRemoteThread"))
{
printf("no CreateRemoteThread found\n");
goto free_kernel32;
}
printf (" * CreateRemoteThread found\n");
process = OpenProcess(CREATE_THREAD_ACCESS, FALSE, pi.dwProcessId);
if (!process)
{
printf("no process for valgrind_test.exe\n");
goto free_kernel32;
}
printf (" * process opened\n");
load_library = (_load_library)GetProcAddress(kernel32, "LoadLibraryA");
if (!load_library)
{
printf("no address for LoadLibrary\n");
goto close_process;
}
printf (" * LoadLibrary found\n");
remote_string = VirtualAllocEx(process, NULL, length + 1, MEM_COMMIT, PAGE_READWRITE);
if (!remote_string)
{
printf("no remote string\n");
goto close_process;
}
printf (" * remote string allocated\n");
if (!WriteProcessMemory(process, remote_string, buf, length + 1, NULL))
{
printf("no virtual memory\n");
goto virtual_free;
}
printf (" * remote string written\n");
thread = CreateRemoteThread(process, NULL, 0, (LPTHREAD_START_ROUTINE)load_library, remote_string, 0, NULL);
if (!thread)
{
printf("no remote thread\n");
goto virtual_free;
}
printf (" * thread launched\n");
WaitForSingleObject(thread, INFINITE);
if (!GetExitCodeThread(thread, &exit_code))
{
printf("no exit code\n");
goto close_thread;
}
printf (" * exit code got\n");
CloseHandle(thread);
VirtualFreeEx(process, remote_string, length + 1, MEM_RELEASE);
printf(" * fin injection\n");
ResumeThread(pi.hThread);
Sleep(2000);
printf(" * fin process\n");
thread = CreateRemoteThread(process, NULL, 0,
(LPTHREAD_START_ROUTINE)GetProcAddress(kernel32,
"FreeLibrary" ),
(void*)exit_code, 0, NULL );
WaitForSingleObject(thread, INFINITE );
CloseHandle(thread );
CloseHandle(process);
FreeLibrary(kernel32);
CloseHandle(pi.hThread);
CloseHandle(pi.hProcess);
printf(" * ressources freed\n");
return 0;
close_thread:
CloseHandle(thread);
virtual_free:
VirtualFreeEx(process, remote_string, length + 1, MEM_RELEASE);
close_process:
CloseHandle(process);
free_kernel32:
FreeLibrary(kernel32);
close_handles:
CloseHandle(pi.hThread);
CloseHandle(pi.hProcess);
return -1;
} |
injection de DLL et surcharge de fonctions
Répondre avec citation
Envoyé par d'Oursse
Partager