显示所有文件

显示全部楼层 · 发表于 2009-12-13 00:06:24

支持了

显示全部楼层 · 发表于 2009-12-13 06:30:28

原创就是得支持呀～

显示全部楼层 · 发表于 2009-12-13 08:55:28

支持，希望继续发扬光大，出一个像xt的作品

显示全部楼层 · 发表于 2009-12-13 10:22:37

不错的东西，放不放源码啊？？
实用价值稍低吧，清理了病毒后啥都能干了，懒得清理病毒的时候倒是很实在
（学校怎么总是带毒做备份呢。。。）

显示全部楼层 · 发表于 2009-12-13 15:01:13

都是高人啊

显示全部楼层 · 发表于 2009-12-13 22:00:49

回复 1# olly

楼主能不能讲一下具体的原理，比如怎么注入？试着用了用发现挺好用的！可是就是想学习一下，先谢谢了!

显示全部楼层 · 发表于 2009-12-13 22:28:50

谢谢分享了

显示全部楼层 · 发表于 2009-12-14 20:58:38

恩恩很经典很实用 down

显示全部楼层 · 发表于 2009-12-14 21:31:45

回复 1# olly

支持

显示全部楼层 · 发表于 2009-12-14 21:55:18

本帖最后由 olly 于 2009-12-14 22:08 编辑

回复 26# 狮子王

代码写的很乱，所以本来不打算贴上来的（太烂了）~~~
注入的话是使用CreateRemoteThread注入的，很古老了= =
以下是注入的代码

VOID RaisePrivilege()
{
HANDLE hToken;
TOKEN_PRIVILEGES tp;
tp.PrivilegeCount = 1;
tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
if(::OpenProcessToken(::GetCurrentProcess(),TOKEN_ALL_ACCESS,&hToken))
{
if(::LookupPrivilegeValue(NULL,SE_DEBUG_NAME,&tp.Privileges[0].Luid))
{
::AdjustTokenPrivileges(hToken,FALSE,&tp,NULL,NULL,0);
}
}
if(hToken)
::CloseHandle(hToken);
}
DWORD FindTarget( LPCTSTR lpszProcess )
{
DWORD dwRet = 0;
HANDLE hSnapshot = CreateToolhelp32Snapshot( TH32CS_SNAPPROCESS, 0 );
PROCESSENTRY32 pe32;
pe32.dwSize = sizeof( PROCESSENTRY32 );
Process32First( hSnapshot, &pe32 );
do
{
if ( lstrcmpi( pe32.szExeFile, lpszProcess ) == 0 )
{
dwRet = pe32.th32ProcessID;
break;
}
} while ( Process32Next( hSnapshot, &pe32 ) );
CloseHandle( hSnapshot );
return dwRet;
}
ULONG GetModuleHandleByName(ULONG pid,char *szModuleName)
{
/*
该函数相当于GetModuleHandle()函数的增强版,可以用于查找其它进程中的模块信息
*/
HANDLE hProcess=NULL;
HMODULE hMods[1024];
char szModName[MAX_PATH];
DWORD cbNeeded=0;
ULONG i;
char *p;
ULONG ModuleBase=0;
hProcess=OpenProcess(PROCESS_QUERY_INFORMATION |PROCESS_VM_READ,FALSE,pid);
if (!hProcess)
{
return 0;
}
if( EnumProcessModules(hProcess, hMods, sizeof(hMods), &cbNeeded))
{
for ( i = 0; i < (cbNeeded / sizeof(HMODULE)); i++ )
{
if ( GetModuleFileNameEx( hProcess, hMods[i], szModName,sizeof(szModName)))
{
p=strrchr(szModName,'\\')+1;
if (!stricmp(p,szModuleName))
{
ModuleBase= (ULONG)hMods[i];
}
}
}
}
CloseHandle( hProcess );
return ModuleBase;
}
BOOL RemoteLoadLibrary( DWORD dwProcessID, LPCSTR lpszDll )
{
// 打开目标进程
HANDLE hProcess = OpenProcess( PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION | PROCESS_VM_WRITE , FALSE, dwProcessID );
// 向目标进程地址空间写入DLL名称
DWORD dwSize, dwWritten;
dwSize = lstrlenA( lpszDll ) + 1;
LPVOID lpBuf = VirtualAllocEx( hProcess, NULL, dwSize, MEM_COMMIT, PAGE_READWRITE );
if ( NULL == lpBuf )
{
CloseHandle( hProcess );
return FALSE;
}
if ( WriteProcessMemory( hProcess, lpBuf, (LPVOID)lpszDll, dwSize, &dwWritten ) )
{
// 要写入字节数与实际写入字节数不相等，仍属失败
if ( dwWritten != dwSize )
{
VirtualFreeEx( hProcess, lpBuf, dwSize, MEM_DECOMMIT );
CloseHandle( hProcess );
return FALSE;
}
}
else
{
CloseHandle( hProcess );
return FALSE;
}
// 使目标进程调用LoadLibrary，加载DLL
DWORD dwID;
LPVOID pFunc = ::GetProcAddress(::LoadLibraryA("kernel32.dll"), "LoadLibraryA");
HANDLE hThread = CreateRemoteThread( hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)pFunc, lpBuf, 0, &dwID );
// 等待LoadLibrary加载完毕
WaitForSingleObject( hThread, INFINITE );
// 释放目标进程中申请的空间
VirtualFreeEx( hProcess, lpBuf, dwSize, MEM_DECOMMIT );
CloseHandle( hThread );
CloseHandle( hProcess );
return TRUE;
}
BOOL RemoteFreeLibrary( DWORD dwProcessID, LPCSTR lpszDll )
{
// 打开目标进程
HANDLE hProcess = OpenProcess( PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION | PROCESS_VM_WRITE, FALSE, dwProcessID );
// 向目标进程地址空间写入DLL名称
DWORD dwSize, dwWritten;
dwSize = lstrlenA( lpszDll ) + 1;
LPVOID lpBuf = VirtualAllocEx( hProcess, NULL, dwSize, MEM_COMMIT, PAGE_READWRITE );
if ( NULL == lpBuf )
{
CloseHandle( hProcess );
return FALSE;
}
if ( WriteProcessMemory( hProcess, lpBuf, (LPVOID)lpszDll, dwSize, &dwWritten ) )
{
// 要写入字节数与实际写入字节数不相等，仍属失败
if ( dwWritten != dwSize )
{
VirtualFreeEx( hProcess, lpBuf, dwSize, MEM_DECOMMIT );
CloseHandle( hProcess );
return FALSE;
}
}
else
{
CloseHandle( hProcess );
return FALSE;
}
// 使目标进程调用GetModuleHandle，获得DLL在目标进程中的句柄
DWORD dwHandle, dwID;
dwHandle = GetModuleHandleByName(dwProcessID, "show.dll");
// 使目标进程调用FreeLibrary，卸载DLL
LPVOID pFunc = ::GetProcAddress(::LoadLibraryA("kernel32.dll"), "FreeLibrary");
HANDLE hThread = CreateRemoteThread( hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)pFunc, (LPVOID)dwHandle, 0, &dwID );
// 等待FreeLibrary卸载完毕
WaitForSingleObject( hThread, INFINITE );
CloseHandle( hThread );
CloseHandle( hProcess );
return TRUE;
}
int CALLBACK MainDlgProc( HWND hDlg, UINT uMsg, WPARAM wParam, LPARAM lParam )
{
static DWORD dwProcessID;
switch ( uMsg )
{
case WM_INITDIALOG:
{
dwProcessID = 0;
SendDlgItemMessage( hDlg, IDC_EDT_TARGET, EM_LIMITTEXT, MAX_PATH, 0 );
}
break;
case WM_COMMAND:
{
switch ( LOWORD( wParam ) )
{
case IDC_BTN_EXIT:
{
EndDialog( hDlg, 0 );
}
break;
case IDC_BTN_INSERT:
{
//TCHAR szTarget[MAX_PATH];
//GetDlgItemText( hDlg, IDC_EDT_TARGET, szTarget, MAX_PATH );
dwProcessID = FindTarget( _T("explorer.exe"));
if ( 0 == dwProcessID )
{
MessageBox( hDlg, _T("找不到目标进程。"), _T("错误"), MB_ICONINFORMATION );
break;
}
if (GetModuleHandleByName(dwProcessID, "show.dll")) {
MessageBox( hDlg, _T("目标dll已加载。"), _T("错误"), MB_ICONINFORMATION );
break;
}
CHAR szDllPath[MAX_PATH];
::GetCurrentDirectoryA(MAX_PATH, szDllPath);
lstrcatA(szDllPath, "\\show.dll");
if (!PathFileExistsA(szDllPath)) {
MessageBox( hDlg, _T("Dll不存在，请确定show.dll存在于本程序目录。"), _T("错误"), MB_ICONINFORMATION );
break;
}
if ( !RemoteLoadLibrary( dwProcessID, szDllPath ) ) {
MessageBox( hDlg, _T("远程DLL加载失败。"), _T("错误"), MB_ICONINFORMATION );
}
if (GetModuleHandleByName(dwProcessID, "show.dll")) {
MessageBox( hDlg, _T("执行完毕"), _T("提示"), MB_ICONINFORMATION );
} else {
MessageBox( hDlg, _T("执行失败"), _T("提示"), MB_ICONINFORMATION );
}
}
break;
case IDC_BTN_DETACH:
{
dwProcessID = FindTarget( _T("explorer.exe"));
if ( 0 == dwProcessID )
{
MessageBox( hDlg, _T("找不到目标进程。"), _T("错误"), MB_ICONINFORMATION );
break;
}
if (!GetModuleHandleByName(dwProcessID, "show.dll")) {
MessageBox( hDlg, _T("目标dll未加载。"), _T("错误"), MB_ICONINFORMATION );
break;
}
if ( !RemoteFreeLibrary( dwProcessID, "show.dll" ) )
{
MessageBox( hDlg, _T("远程DLL卸载失败。"), _T("错误"), MB_ICONINFORMATION );
}
MessageBox( hDlg, _T("执行完毕"), _T("提示"), MB_ICONINFORMATION );
}
break;
}
}
break;
case WM_CLOSE:
{
EndDialog( hDlg, 0 );
}
break;
}
return 0;
}
int WINAPI _tWinMain( HINSTANCE hInstance, HINSTANCE hPrevInstance, LPTSTR lpCmdLine, int nShowCmd )
{
RaisePrivilege();
return DialogBox( hInstance, MAKEINTRESOURCE( IDD_MAIN_DLG ), NULL, MainDlgProc );
}

复制代码

[原创工具] 显示所有文件