15,471
社区成员
发帖
与我相关
我的任务
分享
#include <stdio.h>
#include <stdlib.h>
#include <Windows.h>
#include<TlHelp32.h>
//通过令牌提升权限
BOOL opendebug()
{
//令牌
HANDLE htoken;
//是否提升权限成功
BOOL fok = FALSE;
//打开进程令牌,提升调试权限,
if (OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES, &htoken))
{
//权限
TOKEN_PRIVILEGES tp;
//设置默认权限
tp.PrivilegeCount = 1;
//遍历权限
if (!LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &tp.Privileges[0].Luid))
{
}
//开启
tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
//判断令牌是否生效
if (!AdjustTokenPrivileges(htoken, FALSE, &tp, sizeof(tp), NULL, NULL))
{
}
else
{
fok = TRUE;
}
CloseHandle(htoken);//关闭令牌
}
return fok;
}
//发现进程
DWORD findprocessid(char *name)
{
//使用快照,开启准备
HANDLE hsnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
PROCESSENTRY32 pe32;
pe32.dwSize = sizeof(PROCESSENTRY32);
Process32First(hsnap, &pe32);//查找
do
{
if (_strcmpi(pe32.szExeFile, name) == 0)
{
puts("find it");
return pe32.th32ProcessID;//找到
}
} while (Process32Next(hsnap, &pe32));
CloseHandle(hsnap);//关闭
return 0;
}
//dll注入
int dllinject(HANDLE process, const char *dllname, const char *funname)
{
void(*pfun)() = NULL;//函数指针
//创建远程线程
HANDLE hthread = NULL;
//获取字符串长度
int dllnamelength = strlen(dllname) + 1;
//在别人的进程分配内存
LPVOID paddr = VirtualAllocEx(process, NULL, dllnamelength, MEM_COMMIT, PAGE_READWRITE);
//判断内存是否分配成功
if (paddr == NULL)
{
printf("进程内存分配失败");
}
else
{
//写入进程
WriteProcessMemory(process, paddr, (void*)dllname, dllnamelength, 0);
printf("\n进程内存分配成功并且拷贝成功");
//开启内核
HMODULE hmode = GetModuleHandleA("Kernel32.dll");
//获取内核地址
LPTHREAD_START_ROUTINE funstart = (LPTHREAD_START_ROUTINE)GetProcAddress(hmode, "LoadLibraryA");
//开启远程线程
hthread = CreateRemoteThread(process, NULL, 0, funstart, paddr, 0, 0);
//只能调用开始的那个函数
if (hthread == NULL)
{
puts("\n开启线程失败");
}
//等待线程开启
WaitForSingleObject(hthread, INFINITE);
printf("\n远程线程结束");
}
return 0;
}
// 进程名 模块名 模块的函数名
int insertdll(char *exename, const char *dllname, const char *funname)
{
//开启权限
opendebug();
//寻找线程id
DWORD processid = findprocessid(exename);
if (processid != 0)
{
//打开
HANDLE process = OpenProcess(PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION | PROCESS_VM_WRITE, FALSE, processid);
if (process != NULL)
{
//注入
dllinject(process, dllname, funname);
}
CloseHandle(process);
}
else
{
printf("进程查找失败");
}
return 0;
}
//主函数
void main()
{
char *dllname = "C:\\Users\\Administrator\\Documents\\visual studio 2015\\Projects\\注入工具实现\\dll.dll";
insertdll("notepad.exe", dllname, "go");
system("pause");
}