远线程注入代码

 1 #include <windows.h>
 2 #include <iostream>
 3 using namespace std;
 4 
 5 DWORD threadInject(WCHAR* dllpath, DWORD pid)
 6 {
 7     int t = sizeof(dllpath);
 8     //先激活权限
 9     HANDLE hToken;
10     LUID newLuid;
11     TOKEN_PRIVILEGES tr;
12     tr.PrivilegeCount = 1;
13     tr.Privileges->Attributes = SE_PRIVILEGE_ENABLED;
14     OpenProcessToken(GetCurrentProcess(), TOKEN_ALL_ACCESS, &hToken);
15     LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &newLuid);
16     tr.Privileges->Luid = newLuid;
17     AdjustTokenPrivileges(hToken, FALSE, &tr, sizeof(tr), 0, 0);
18     HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, NULL, pid);
19     //获取进程句柄
20     if (hProcess == 0 || hProcess == INVALID_HANDLE_VALUE)
21     {
22         printf("创建远线程失败
");
23         CloseHandle(hToken);
24         return 0;
25     }
26     //申请内存存放参数
27     LPVOID p = VirtualAllocEx(hProcess, 0, 0x1000, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
28     if (!p)
29     {
30         printf("创建远线程失败
");
31         CloseHandle(hProcess);
32         CloseHandle(hToken);
33         return 0;
34     }
35     //写参数
36     if (!WriteProcessMemory(hProcess, p, (LPVOID)(dllpath), sizeof(WCHAR)* (wcslen(dllpath)+1), NULL))
37     {
38         printf("创建远线程失败
");
39         VirtualFreeEx(hProcess, p, 0x1000, MEM_FREE);
40         CloseHandle(hProcess);
41         CloseHandle(hToken);
42         return 0;
43     }
44     //创建远程线程并执行LoadLibraryW加载dll
45     HANDLE cThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)(GetProcAddress(GetModuleHandleW(L"kernel32.dll"), "LoadLibraryW")), p, 0, 0);
46     if (cThread == 0 || cThread == INVALID_HANDLE_VALUE)
47     {
48         printf("创建远线程失败
");
49         VirtualFreeEx(hProcess, p, 0x1000, MEM_FREE);
50         CloseHandle(hProcess);
51         CloseHandle(hToken);
52         return 0;
53     }
54     //5.等待线程结束返回,释放资源
55     WaitForSingleObject(cThread, -1);
56     CloseHandle(cThread);
57     CloseHandle(hProcess);
58     CloseHandle(hToken);
59     printf("创建远线程成功
");
60 
61     return 0;
62 }
63 
64 int main() {
65     DWORD pid;
66     wstring str = L"C:\Users\97905\source\repos\RemoteInjectDll\Debug\RemoteInjectDll.dll";
67     cout << "输入pid" << endl;
68     cin >> pid;
69     //RemoteThreadInject(pid);    
70     threadInject((WCHAR*)str.c_str(), pid);
71 
72     return 0;
73 }