当前位置:首页 > 开发 > 编程语言 > 多线程 > 正文

使用C++中CreateRemoteThread进行线程注入

发表于: 2015-05-29   作者:冤大头_718   来源:转载   浏览:
摘要: #include <windows.h> #include <tchar.h> #include <stdio.h> #include <Tlhelp32.h> HANDLE CreateRemoteThreadProc(char* ProcessName); DWORD WINAPI WatchThread(LPVOID lp
#include <windows.h>
#include <tchar.h>
#include <stdio.h>
#include <Tlhelp32.h>  

HANDLE	CreateRemoteThreadProc(char* ProcessName);
DWORD	WINAPI WatchThread(LPVOID lparam);
DWORD	WINAPI remote(LPVOID pvparam);
DWORD	processtopid(char *processname);
BOOL	EnablePriv();
HANDLE MyCreateRemoteThread(HANDLE hProcess, LPTHREAD_START_ROUTINE pThreadProc, LPVOID pRemoteBuf);
BOOL IsVistaOrLater();
//先打开notepad,在运行本程序

	typedef struct _remoteparameter
	{
		DWORD		rpWaitForSingleObject;
		DWORD		rpOpenProcess;
		DWORD       rpWinExec;
		DWORD	    rpProcessPID;           
		HANDLE		rpProcessHandle;
		char	    path[MAX_PATH];
	}REMOTEPARAM;

typedef DWORD (WINAPI *PFNTCREATETHREADEX)
	( 
	PHANDLE                 ThreadHandle,	
	ACCESS_MASK             DesiredAccess,	
	LPVOID                  ObjectAttributes,	
	HANDLE                  ProcessHandle,	
	LPTHREAD_START_ROUTINE  lpStartAddress,	
	LPVOID                  lpParameter,	
	BOOL	                CreateSuspended,	
	DWORD                   dwStackSize,	
	DWORD                   dw1, 
	DWORD                   dw2, 
	LPVOID                  Unknown 
	); 

int main(int argc, char* argv[])
{
	HANDLE RemoteThreadHandle;
	HANDLE LocateThreadHandle;
	EnablePriv();
	RemoteThreadHandle=CreateRemoteThreadProc("notepad.exe");
	//本地线程循环注入notepad
	LocateThreadHandle=CreateThread(NULL,NULL,WatchThread,(LPVOID)RemoteThreadHandle,NULL,NULL);
	WaitForSingleObject(LocateThreadHandle,INFINITE);
	WaitForSingleObject(RemoteThreadHandle,INFINITE);//线程等待,循环等待notepad的远程线程执行完毕。即 notepad关闭本程序才关闭
	return 0;
}
//创建远程线程,线程注入
HANDLE CreateRemoteThreadProc(char* ProcessName)
{
	HANDLE	ThreadHandle;
	char	FilePath[MAX_PATH];

	GetModuleFileName(NULL,FilePath,MAX_PATH);//得到文件所在路径
	printf("%s\n",FilePath);
	//根据进程名获取进程ID
	int procID=processtopid(ProcessName);
	printf("The process pid is %d\n",procID);
	HINSTANCE         hkernel32;
	HANDLE            rphandle;
	char             *remotethr;
	char             *remotepar;
	int               cb;
	//根据ID打开notepad的进程空间
	rphandle=OpenProcess(PROCESS_ALL_ACCESS, FALSE,procID);
	if(rphandle==NULL)
	{
		printf("Open Remote Process  is Error\n");
	}
	else
	{
		printf("open process is ok\n");
	}

	/*****************************************************************/
	/*将远程线程函数代码拷入目标进程*/
	/*****************************************************************/
	cb=sizeof(TCHAR)*4*1024;
	//在notepad进程中分配空间,存储函数remote
	remotethr=(PTSTR)VirtualAllocEx(rphandle,NULL,cb,MEM_COMMIT,PAGE_EXECUTE_READWRITE); 
	if(remotethr==NULL)
	{
		printf("VirtualAllocEx for Thread Error\n");
		CloseHandle(rphandle);       
	}
	else
		printf("VirtualAllocEx is ok\n");
	//往notepad空间中写入数据指针remote指向的数据,大小为cb
	if(WriteProcessMemory(rphandle,remotethr,(LPVOID)remote,cb,NULL)==FALSE)
	{
		printf("WriteProcessMemory for Thread Error\n");
		CloseHandle(rphandle);
	}
	else
		printf("WriteProcessMemory is ok\n");

	/*****************************************************************/
	/*将远程线程函数参数拷入目标进程*/
	/*这里需要重定位远程线程需要的API*/
	/*****************************************************************/
	REMOTEPARAM rp;
	memset((char*)&rp,0,sizeof(rp));

	hkernel32=GetModuleHandle("kernel32.dll");

	if(hkernel32==NULL)
	{
		printf("hKernel32 is Error\n");
	}
	//通过让目标进程执行OpenProcess,WinExec,WaitForSingleObject,函数重新打开本程序

	rp.rpProcessPID			=GetCurrentProcessId();
	rp.rpOpenProcess		=(DWORD)GetProcAddress(hkernel32,"OpenProcess");
	rp.rpWinExec			=(DWORD)GetProcAddress(hkernel32,"WinExec");
	rp.rpWaitForSingleObject=(DWORD)GetProcAddress(hkernel32,"WaitForSingleObject");
	strcpy_s(rp.path,FilePath);	
	cb=sizeof(char)*sizeof(rp);
	//rphandle指向notepad进程,分配空间,存储参数
	remotepar=(PTSTR)VirtualAllocEx(rphandle,NULL,cb,MEM_COMMIT,PAGE_READWRITE);
	if(remotepar==NULL)
	{
		printf("VirtualAllocEx for Parameter Error\n");
		CloseHandle(rphandle);
	}
	//往notepad进程写入传给remote的参数
	if(WriteProcessMemory(rphandle,remotepar,(LPVOID)&rp,cb,NULL)==FALSE)
	{
		printf("WriteProcessMemory for Parameter Error\n");
		CloseHandle(rphandle);
	}

	/*****************************************************************/
	/*将远程线程注入目标进程*/
	/*****************************************************************/
	//在noetpad进程中创建新线程执行remote函数,参数为remotepar,返回线程句柄
	ThreadHandle=MyCreateRemoteThread(rphandle,(LPTHREAD_START_ROUTINE)remotethr,(LPVOID)remotepar);

	if(ThreadHandle==NULL)
	{
		printf("CreateRemotThreadHandle Error\n");
		CloseHandle(rphandle);
	}
	else
		printf("CreateRemotThreadHandle is ok\n");

	return ThreadHandle;
}
//获取进程ID
DWORD processtopid(char *processname)
{
	// 变量及初始化
	STARTUPINFO st;
	PROCESS_INFORMATION pi;
	PROCESSENTRY32 ps;
	HANDLE hSnapshot;
	DWORD procID;
	memset(&st,0,sizeof(st));
	memset(&pi,0,sizeof(pi));
	st.cb = sizeof(STARTUPINFO);
	memset(&ps,0,sizeof(ps));
	ps.dwSize = sizeof(PROCESSENTRY32);
	// 遍历进程
	hSnapshot = CreateToolhelp32Snapshot( TH32CS_SNAPPROCESS, 0);
	if(hSnapshot == INVALID_HANDLE_VALUE)
	{
		return FALSE;
	}

	if(!Process32First(hSnapshot,&ps))
	{
		return FALSE;
	}
	do
	{
		// 比较进程名
		if(lstrcmpi(ps.szExeFile,processname)==0)
		{
			// 找到了
			 procID=ps.th32ProcessID;
			CloseHandle(hSnapshot);
			return procID;
		}
	}
	while(Process32Next(hSnapshot,&ps));
	// 没有找到
	CloseHandle(hSnapshot);
	return 0;
}
//提升进程权限
BOOL EnablePriv()
{
	HANDLE hToken;
	if ( OpenProcessToken(GetCurrentProcess(),TOKEN_ADJUST_PRIVILEGES,&hToken) )
	{
		TOKEN_PRIVILEGES tkp;

		LookupPrivilegeValue( NULL,SE_DEBUG_NAME,&tkp.Privileges[0].Luid );	//修改进程权限
		tkp.PrivilegeCount=1;
		tkp.Privileges[0].Attributes=SE_PRIVILEGE_ENABLED;
		AdjustTokenPrivileges( hToken,FALSE,&tkp,sizeof tkp,NULL,NULL );	//通知系统修改进程权限
	}
	return 0;
}
//远程线程要执行的函数
DWORD WINAPI remote(LPVOID pvparam)
{
	REMOTEPARAM *rp=(REMOTEPARAM*)pvparam;

	typedef UINT			(WINAPI *EWinExec)				(LPCSTR, UINT);
	typedef HANDLE			(WINAPI *EOpenProcess)			(DWORD, BOOL, DWORD);
	typedef DWORD			(WINAPI *EWaitForSingleObject)	(HANDLE, DWORD);


	EWinExec				tWinExec;
	EOpenProcess			tOpenProcess;
	EWaitForSingleObject	tWaitForSingleObject;


	tOpenProcess			=(EOpenProcess)rp->rpOpenProcess;
	tWaitForSingleObject	=(EWaitForSingleObject)rp->rpWaitForSingleObject;
	tWinExec				=(EWinExec)rp->rpWinExec;

	//	重新打开本进程ID,使本进程可以访问
	rp->rpProcessHandle=tOpenProcess(PROCESS_ALL_ACCESS,FALSE,rp->rpProcessPID);

	tWaitForSingleObject(rp->rpProcessHandle,INFINITE);
	//打开本程序
	tWinExec(rp->path, SW_SHOW);
	return 0;
}
//守护进程
DWORD	WINAPI WatchThread(LPVOID lparam)
{
	HANDLE	RemoteThreadHandle=(HANDLE)lparam;
	DWORD	ExitCode;

	GetExitCodeThread(RemoteThreadHandle,&ExitCode);

	while(true)
	{
		if(ExitCode!=STILL_ACTIVE)//如果远程线程不激活,就重新激活
		{
			printf("RemoteThreadHandle is over\n");
			RemoteThreadHandle=CreateRemoteThreadProc("notepad.exe");
		}
		Sleep(3000);	
	}
	return 0;
}

HANDLE MyCreateRemoteThread(HANDLE hProcess, LPTHREAD_START_ROUTINE pThreadProc, LPVOID pRemoteBuf)
{
	HANDLE      hThread = NULL;
	FARPROC     pFunc = NULL;
	if( IsVistaOrLater() )    // Vista, 7, Server2008
	{
		pFunc = GetProcAddress(GetModuleHandle("ntdll.dll"), "NtCreateThreadEx");
		if( pFunc == NULL )
		{
			printf("MyCreateRemoteThread() : GetProcAddress(\"NtCreateThreadEx\") 调用失败!错误代码: [%d]/n",
				GetLastError());
			return FALSE;
		}
		((PFNTCREATETHREADEX)pFunc)(&hThread,
			0x1FFFFF,
			NULL,
			hProcess,
			pThreadProc,
			pRemoteBuf,
			FALSE,
			NULL,
			NULL,
			NULL,
			NULL);
		if( hThread == NULL )
		{
			printf("MyCreateRemoteThread() : NtCreateThreadEx() 调用失败!错误代码: [%d]/n", GetLastError());
			return FALSE;
		}
	}
	else                    // 2000, XP, Server2003
	{
		hThread = CreateRemoteThread(hProcess, 
			NULL, 
			0, 
			pThreadProc, 
			pRemoteBuf, 
			0, 
			NULL);
		if( hThread == NULL )
		{
			printf("MyCreateRemoteThread() : CreateRemoteThread() 调用失败!错误代码: [%d]/n", GetLastError());
			return FALSE;
		}
	}
	if( WAIT_FAILED == WaitForSingleObject(hThread, INFINITE) )
	{
		printf("MyCreateRemoteThread() : WaitForSingleObject() 调用失败!错误代码: [%d]/n", GetLastError());
		return FALSE;
	}
	return hThread;

}

BOOL IsVistaOrLater()
{
	OSVERSIONINFO osvi;  
	ZeroMemory(&osvi, sizeof(OSVERSIONINFO));  
	osvi.dwOSVersionInfoSize = sizeof(OSVERSIONINFO);  
	GetVersionEx(&osvi);  
	if( osvi.dwMajorVersion >= 6 )  
		return TRUE;  
	return FALSE;  

}

上面代码要编译为Release版本才能运行,如果编译为Debug版本在远程方法注入会出现内存读取错误,导致目标进程崩溃.

使用C++中CreateRemoteThread进行线程注入

  • 0

    开心

    开心

  • 0

    板砖

    板砖

  • 0

    感动

    感动

  • 0

    有用

    有用

  • 0

    疑问

    疑问

  • 0

    难过

    难过

  • 0

    无聊

    无聊

  • 0

    震惊

    震惊

编辑推荐
在 mvc 4 中使用 unity 进行依赖注入 关于依赖注入的概念,这里就不再叙述了,我们用 mvc 4 结合 un
需要本文代码请直接跳到文章最底部下载 注入进程的方法有很多,本文主要介绍通过远程线程来注入进程
错误注入测试是指有意向待测试的应用程序中注入错误,然后运行该应用程序以检验其错误处理情况的过
最近写了个Matlab程序,好慢呐……所以开始学习Matlab与C/C++混合编程。下面写了个测试代码,显示一
近段时间做一个关于水面的动画。由于我用c++实现水面动画的,然而使用c++我自己的渲染系统渲染结果
QCA是C++ GUI Qt中的一个第三方插件,为Qt提供了一个针对安全性方面编程的框架。从QCA的名称不难发
之前二篇文章介绍了QCA框架的安装和配置,在这篇文章中我将开始编写一个基于数字证书的加密例程,用
上一篇中我们完成了QCA框架的安装,接下去我们开始安装一个加密算法库的提供者,以便我们可以开发实
最近写了个Matlab程序,好慢呐……所以开始学习Matlab与C/C++混合编程。下面写了个测试代码,显示一
我们使用Spring 一般式在xml配置文件中进行注入.但是这种方式使得配置过于臃肿。试想一个应用中,有
版权所有 IT知识库 CopyRight © 2009-2015 IT知识库 IT610.com , All Rights Reserved. 京ICP备09083238号