CreateRemoteThread 远程线程注入的问题 window7 64位下 vs2008
#include <stdio.h>
#include <tchar.h>
#include<windows.h>
#include"tlhelp32.h"
TCHAR dll[]=TEXT("SimpleDll.dll");
bool enableDebugPriv()
{
HANDLE hToken;
LUID sedebugnameValue;
TOKEN_PRIVILEGES tkp;
if (!OpenProcessToken(GetCurrentProcess(),
TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken)) {
return false;
}
if (!LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &sedebugnameValue)) {
CloseHandle(hToken);
return false;
}
tkp.PrivilegeCount = 1;
tkp.Privileges[0].Luid = sedebugnameValue;
tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
if (!AdjustTokenPrivileges(hToken, FALSE, &tkp, sizeof(tkp), NULL, NULL)) {
CloseHandle(hToken);
return false;
}
return true;
}
int _tmain(int argc, _TCHAR* argv[])
{
enableDebugPriv();
int ret;
HANDLE hsnap;
PROCESSENTRY32 pe;
DWORD dflags,th32pid;
dflags=TH32CS_SNAPPROCESS;
th32pid=0;
hsnap=CreateToolhelp32Snapshot(dflags,th32pid);
pe.dwSize=sizeof(PROCESSENTRY32);
if(ret=Process32First(hsnap,&pe))
{
int jsq=0;
while(Process32Next(hsnap,&pe))
{
if(!lstrcmp(pe.szExeFile,TEXT("explorer.exe")))
{
HANDLE hProcess;
hProcess=OpenProcess(PROCESS_ALL_ACCESS,FALSE,pe.th32ProcessID);
if(hProcess==NULL)
printf("打开失败\n");
LPVOID pbase;
pbase=VirtualAllocEx(hProcess,0,(lstrlen(dll)+1)*sizeof(TCHAR),MEM_COMMIT,PAGE_EXECUTE_READWRITE);
if(pbase==NULL)
printf("分配内存失败\n");
printf("%d\n",sizeof(TCHAR)*lstrlen(dll));
ret=WriteProcessMemory(hProcess,pbase,dll,(1+lstrlen(dll))*sizeof(TCHAR),0);
if(ret==0)
printf("写内存失败\n");
HINSTANCE hModule;
hModule=GetModuleHandle(TEXT("Kernel32.dll"));
if(hModule==NULL)
printf("获取系统库失败\n");
FARPROC pfar;
pfar=GetProcAddress(hModule,"LoadLibraryA");
if(pfar==NULL)
printf("获取函数失败\n");
HANDLE hObject;
DWORD threadID;
hObject=CreateRemoteThread(hProcess,0,0,
(LPTHREAD_START_ROUTINE)pfar,pbase,0,&threadID);
if(hObject==NULL)
printf("创建远程线程失败\n");
DWORD i=GetLastError();
printf("错误代码:%d\n",i);
WaitForSingleObject(hObject,INFINITE);
VirtualFreeEx(hProcess,pbase,0,MEM_RELEASE);
CloseHandle(hObject);
CloseHandle(hProcess);
return 1;
}
}
}
return 0;
} 远程线程注入 createremotethread dll
------解决方案--------------------
xp下你试了没？应该是没问题的。
win7下估计是权限问题，即使你用AdjustTokenPrivileges提权了也不行，这里解决不了的话，去看雪问问吧。
[解决办法]
win7与xp情况不一样吧，win7应该有session的的限制。win7我没用过，也没注入过，但serveri2008r2下注入过，要考虑session，不同的session不能注入。
当然，想注入，也不是没有办法，可以用undocumented apis，直接跨进程注入。但是，使用那系列的api注入后，由于没有与csrss通信，有很多限制，比如跨进程注入后，在dll中甚至不能创建新线程和进程。
[解决办法]
给你些参考的，这些API都是从ntdll.dll中导出的：
// the native api address in ntdll.dll
// Reference:http://undocumented.ntinternals.net/
//Windows NT 2000 Native API Reference
extern ULONG (WINAPI *RtlNtStatusToDosError)(__in NTSTATUS Status);
extern NTSTATUS (NTAPI *NtOpenProcess)(OUT PHANDLE ProcessHandle,
IN ACCESS_MASK AccessMask,
IN POBJECT_ATTRIBUTES ObjectAttributes,
IN PCLIENT_ID ClientId);
extern NTSTATUS (NTAPI *RtlCreateUserThread)(INHANDLE ProcessHandle,
INPSECURITY_DESCRIPTOR SecurityDescriptor OPTIONAL,
INBOOLEAN CreateSuspended,
INULONG StackZeroBits,
IN OUT PULONG StackReserved,
IN OUT PULONG StackCommit,
INPVOID StartAddress,
INPVOID StartParameter OPTIONAL,
OUTPHANDLE ThreadHandle,
OUTPCLIENT_ID ClientID);
extern NTSTATUS (NTAPI *NtQueueApcThread)(IN HANDLE ThreadHandle,
IN PIO_APC_ROUTINE ApcRoutine,
IN PVOID ApcRoutineContext OPTIONAL,
IN PIO_STATUS_BLOCK ApcStatusBlock OPTIONAL,
IN ULONG ApcReserved OPTIONAL );
extern NTSTATUS (NTAPI *NtTerminateThread)(IN HANDLE ThreadHandle, IN NTSTATUS ExitStatus);
extern NTSTATUS (NTAPI *NtClose)(IN HANDLE ObjectHandle );
extern NTSTATUS (NTAPI *NtWaitForSingleObject)(IN HANDLE ObjectHandle, IN BOOLEAN Alertable, IN PLARGE_INTEGER TimeOut OPTIONAL);
extern PVOID (NTAPI *RtlAllocateHeap)(IN PVOID HeapHandle, IN ULONG Flags, IN ULONG Size);
extern BOOLEAN (NTAPI *RtlFreeHeap)(IN PVOID HeapHandle,
IN ULONG Flags OPTIONAL,
IN PVOID MemoryPointer);
extern NTSTATUS (NTAPI *NtQuerySystemInformation)(IN SYSTEM_INFORMATION_CLASS SystemInformationClass,
OUT PVOID SystemInformation,
IN ULONG SystemInformationLength,
OUT PULONG ReturnLength OPTIONAL);
extern NTSTATUS (NTAPI *NtAllocateVirtualMemory)(IN HANDLE ProcessHandle,
IN OUT PVOID *BaseAddress,
IN ULONG ZeroBits,
IN OUT PULONG RegionSize,
IN ULONG AllocationType,
INULONG Protect);
extern NTSTATUS (NTAPI *NtFreeVirtualMemory)(INHANDLE ProcessHandle,
INPVOID *BaseAddress,
IN OUT PULONG RegionSize,
INULONG FreeType);
extern NTSTATUS (NTAPI *NtWriteVirtualMemory)(IN HANDLE ProcessHandle,
IN PVOID BaseAddress,
IN PVOID Buffer,
IN ULONG NumberOfBytesToWrite,
OUT PULONG NumberOfBytesWritten OPTIONAL);
extern NTSTATUS (NTAPI *NtFlushInstructionCache)(IN HANDLE ProcessHandle,
IN PVOID BaseAddress,
IN ULONG NumberOfBytesToFlush );
extern NTSTATUS (NTAPI *CsrClientCallServer)(PCSR_API_MESSAGE ApiMessage,
PCSR_CAPTURE_BUFFER CaptureBuffer OPTIONAL,
CSR_API_NUMBER ApiNumber,
ULONG RequestLength);
extern NTSTATUS (NTAPI *CsrNewThread)(VOID);
[解决办法]
这个应该是运行程序的用户权限问题
---------------------------------------
我在主机上win7 32位系统 32位应用程序
管理员用户运行没问题
非管理员用户运行会先输出13，后面线程注入的代码就卡住一直运行不下去
非管理员用户右键应用程序使用管理员运行后返回错误5
---------------------------------------
---------------------------------------
在虚拟机win7 64位系统 使用的是64位应用程序
管理员用户运行没问题
非管理员用户运行会返回一堆错误
非管理员用户右键应用程序使用管理员运行后返回错误8
---------------------------------------