目标我正在尝试一个简单的 shellcode 练习——使用 CreateRemoteThread 在远程进程上调用“OutputDebugStringA”来激活一个 shellcode——这个练习没有 dll 注入!
问题我不知道远程进程中“OutputDebugStringA”的地址,只知道本地进程。
到目前为止我一直在尝试什么
int main() {
char ShellCode[] = "\x48\x8d\x0c\x25\x10\x9c\x8c\x4c\xff\x14\x25\x00\x01\x8d\x4c";
/*
* Get process handle passing in the process ID.
*/
int32_t nProcID = 21440;
const HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, nProcID);
if (NULL == hProcess) {
printf("Error: the specified process couldn't be found.\n");
}
const LPVOID arg = (LPVOID)VirtualAllocEx(hProcess, NULL, sizeof(ShellCode), MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);
if (NULL == arg) {
int32_t nLastErrorCode = GetLastError();
printf("Error: the memory could not be allocated inside the chosen process. Error code - %d.\n", nLastErrorCode);
}
const int32_t nBytesWritten = WriteProcessMemory(hProcess, arg, ShellCode, sizeof(ShellCode), NULL);
if (0 == nBytesWritten) {
int32_t nLastErrorCode = GetLastError();
printf("Error: there was no bytes written to the process's address space. Error code - %d.\n", nLastErrorCode);
}
const HANDLE hThreadID = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)arg , NULL, NULL, NULL);
if (NULL == hThreadID) {
int32_t nLastErrorCode = GetLastError();
printf("Error: the remote thread could not be created. Error code - %d.\n", nLastErrorCode);
}
else {
printf("Success: the remote thread was successfully created.\n");
}
/*
* Close the handle to the process, because we've already injected the DLL.
*/
CloseHandle(hProcess);
getchar();
return 0;
}
我试过的Dissemble OutputDebugStringA picture1然后将其在线转换为 shellcode,然后使用新的 shellcode 调用我的代码。但是远程进程对这些地址并不熟悉。
如果您只想知道 , 的地址OutputDebugStringA
(假设您的 shellcode 确实有效),则它与当前进程相同。所以你可以通过这样LPVOID function_addr = reinterpret_cast<LPVOID>(GetProcAddress(GetModuleHandleA("kernel32.dll"), "OutputDebugStringA"));
做得到它然后你可以function_addr
随心所欲地使用。
因为kernel32.dll
在每个进程中都有相同的基地址,所以相对虚拟地址是相同的,因此地址也相同。
本文收集自互联网,转载请注明来源。
如有侵权,请联系 [email protected] 删除。
我来说两句