dll注入实验

朱雀 2022-10-13 05:19 181阅读 0赞

### 文章目录 ###

*  目的
 *  流程
 *  写一个dll
 *  dll注入
 *  结果
 *  参考文章

# 目的 #

让我们的dll程序加载在其他已经运行的程序中。

# 流程 #

1.提权到控制目标进程所需的权限，一般情况下管理员权限足够。

2.根据目标进程的pid使用OpenProcess函数得到进程句柄。

3.根据进程句柄在目标进程中申请内存VirtualAllocEx

4.在目标进程中刚刚申请的内存空间中写入所需参数(Dll的完整路径)WriteProcessMemory

5.加载kernal32.dll，并用GetProcAddress得到LoadLibraryW的模块加载地址，kernel32的导出函数在所有进程中的映射地址都一样，因此我们可以通过在当前进程中查询LoadLibrary函数的地址来得到所有进程中LoadLibraryW函数的地址。

6.启动远程线程CreateRemoteThread，并传入第五步获得的LoadLibrary函数地址与之前用VirtualAllocEX函数申请的地址，调用注入的dll。

# 写一个dll #

#include <Windows.h>
    
    BOOL APIENTRY DllMain( HMODULE hModule,
                           DWORD  ul_reason_for_call,
                           LPVOID lpReserved
                         )
    { 
        switch (ul_reason_for_call)
        { 
        case DLL_PROCESS_ATTACH:    
            MessageBox(NULL, TEXT("DLL_PROCESS_ATTACH"), TEXT("成功了"), NULL);
            break;
        case DLL_THREAD_ATTACH:
    		MessageBox(NULL, TEXT("DLL_THREAD_ATTACH"), TEXT("成功了"), NULL);
    		break;
        case DLL_THREAD_DETACH:
    		MessageBox(NULL, TEXT("DLL_THREAD_DETACH"), TEXT("成功了"), NULL);
    		break;
        case DLL_PROCESS_DETACH:
    		MessageBox(NULL, TEXT("DLL_PROCESS_DETACH"), TEXT("成功了"), NULL);
            break;
        }
        return TRUE;
    }

# dll注入 #

#include <Windows.h>
    #include <stdio.h>
    #include <iostream>
    using namespace std;
    
    //根据进程ID获取进程句柄
    HANDLE GetProcessHandle(DWORD deProcessID)
    { 
        HANDLE hProcess = OpenProcess(
            PROCESS_ALL_ACCESS,        //WriteProcessMemory
            FALSE,                     //此进程创建的进程不继承目标进程的句柄
            deProcessID                //进程pid
        );
    
        return hProcess;
    }
    
    int main(int argc, TCHAR* argv[])
    { 
        DWORD dwErrCode = 0;
    
    
        // 进程PID
        DWORD dwProcessID = 10228;
    
        HANDLE hDestProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwProcessID);
        if (NULL == hDestProcess)
        { 
            printf("open process error \n");
            return 0;
        }
    
    
        //获取KERNER32.DLL 模块句柄
        HMODULE hModule = GetModuleHandle(TEXT("kernel32.dll"));
        if (NULL == hModule)
        { 
            printf("kernel32.dll \n");
            return -1;
        }
    
        //线程函数，kernerl32.dll被映射到所有进程内相同的地址
        LPTHREAD_START_ROUTINE lpThreadStartRoutine =
            (LPTHREAD_START_ROUTINE)GetProcAddress(hModule, "LoadLibraryW");
    
        if (NULL == lpThreadStartRoutine)
        { 
            printf("LoadLibraryW Error \n");
    
            return -2;
        }
    
        //从目标进程内申请堆内存
        LPVOID lpMemory = VirtualAllocEx(
            hDestProcess, NULL, MAX_PATH, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);
        if (NULL == lpMemory)
        { 
            printf("VirtualAllocEx Error\n");
            return -3;
        }
    
    
        LPCTSTR lpDLLName = TEXT("dllmain.dll");
        //把DLL的路径写入到我们在目标进程内申请到内存中
        BOOL bWriteMemory = WriteProcessMemory(
            hDestProcess, lpMemory, lpDLLName, (lstrlenW(lpDLLName) + 1) * sizeof(lpDLLName[0]), NULL);
     	//BOOL bWriteMemory = WriteProcessMemory(hDestProcess, lpMemory, lpDLLName, lstrlenW(lpDLLName), NULL);
        //wprintf((LPWSTR)lpMemory);
        if (FALSE == bWriteMemory)
        { 
    
            printf("WriteProcessMemory Error \n");
            dwErrCode = GetLastError();
            VirtualFreeEx(hModule, lpMemory, 0, MEM_RELEASE | MEM_DECOMMIT);
            return -4;
        }
    
    
        //创建远程线程
        HANDLE hThread = CreateRemoteThreadEx(
            hDestProcess, //目标进程的句柄
            NULL,
            0,
            lpThreadStartRoutine, //loadlibraryW的地址,也代表新线程要执行的函数的地址
            lpMemory, // lpMemory存放dll文件的路径的地址。它作为参数传递给线程所调用的函数LoadLibraryW
            0,
            NULL,
            NULL);
        if (NULL == hThread || INVALID_HANDLE_VALUE == hThread)
        { 
            printf("CreateRomoteThread Error %d \n", GetLastError());
            VirtualFreeEx(hModule, lpMemory, 0, MEM_RELEASE | MEM_DECOMMIT);
            return -5;
        }
    
    
    
        VirtualFreeEx(hModule, lpMemory, 0, MEM_RELEASE | MEM_DECOMMIT);
    
        return 0;
    }

# 结果 #

dllmain.dll已经被注入到pid号位8784的进程中：

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxODc0OTMw_size_16_color_FFFFFF_t_70]  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxODc0OTMw_size_16_color_FFFFFF_t_70 1]

# 参考文章 #

[DLL Injection Example][]  
[Windows DLL 注入基础知识][Windows DLL]

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxODc0OTMw_size_16_color_FFFFFF_t_70]: /images/20221005/6f2273b5c6b243e392f0703852f653b8.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxODc0OTMw_size_16_color_FFFFFF_t_70 1]: /images/20221005/e35eb4c81fc34c90bee469acc49957d9.png
[DLL Injection Example]: https://payloads.online/archivers/2019-01-20/
[Windows DLL]: http://blog.opensecurityresearch.com/2013/01/windows-dll-injection-basics.html