ANTICHAT — форум по информационной безопасности, OSINT и технологиям

#include "stdafx.h"
#include <stdio.h>
#include <windows.h>
#include <tlhelp32.h>

#define LOGFILE "C:\\injection.log"
#define PROCESSNAME L"explorer.exe"

DWORD getProcessID();
int addLogMessage(char* str, int code);
BOOL setPrivilege(HANDLE hToken, LPCTSTR szPrivName, BOOL fEnable);

typedef FARPROC (WINAPI *LPMessageBox)(HWND, LPCWSTR, LPCWSTR, UINT);

typedef struct _InjectData {
	char				title[50];
	char				msg[50];	
	LPMessageBox		MessageB;
} InjectData, *PInjectData;

InjectData injectData = { 
	"Test",
	"Привет",
	NULL
};

static DWORD WINAPI InjectionMain(LPVOID lpParams) {
	
	PInjectData info = (PInjectData)lpParams;
	
	info->MessageB(NULL, (LPCWSTR)info->msg, (LPCWSTR)info->title, MB_OK);
	return 0;
}

static void __declspec( naked ) end_proc() {
}


int _tmain(int argc, _TCHAR* argv[]) {

	char		buffer [50];
	HANDLE		hToken;
	HANDLE		processHandel;
	HINSTANCE	userHinstance;
	
	DWORD processID = getProcessID();
	
	HANDLE hCurrentProc = GetCurrentProcess();

	if(!OpenProcessToken(hCurrentProc, TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES, &hToken)) { 
        addLogMessage("OpenProcessToken Error", GetLastError());
		return 0;
	} else { 
		if (!setPrivilege(hToken, SE_DEBUG_NAME, TRUE)) {
			addLogMessage("SetPrivlegesSE_DEBUG_NAME Error", GetLastError());
			return 0;
		} 
	} 

	if(processID == 0) {
		MessageBox(NULL, _T("Process not found!"), _T("Error"), MB_OK | MB_ICONERROR);
		return 0;
	}

	processHandel = OpenProcess(PROCESS_ALL_ACCESS, false, processID);
	if(processHandel == NULL) {
		addLogMessage("Open process error", GetLastError());
		return 0;
	}
	
	userHinstance = LoadLibrary(_T("user32.dll"));
	injectData.MessageB = (LPMessageBox) GetProcAddress(userHinstance, "MessageBoxA");

	DWORD ProcSize = (DWORD)end_proc - (DWORD)InjectionMain;
	sprintf_s(buffer, "Process size: %u", ProcSize);
	addLogMessage(buffer, 0);
	
	LPVOID lpProc	= VirtualAllocEx(processHandel, NULL, ProcSize, MEM_COMMIT, PAGE_EXECUTE_READWRITE );
	LPVOID lpParams = VirtualAllocEx(processHandel, NULL, 1024, MEM_COMMIT, PAGE_READWRITE );
	
	if (!lpProc || !lpParams) {
		addLogMessage("Error allocating memory ", 1000);
		return 0;
	}

	sprintf_s(buffer, "Memory allocated at 0x%X and 0x%X", lpProc, lpParams );
	addLogMessage(buffer, 0);

	DWORD dwWritten;
	if(WriteProcessMemory(processHandel, lpProc, InjectionMain, ProcSize, &dwWritten ) == 0) {
		addLogMessage("WriteProcessMemory error", GetLastError());
		return 0;
	}

	if(WriteProcessMemory( processHandel, lpParams, &injectData, sizeof(injectData), &dwWritten ) == 0) {
		addLogMessage("WriteProcessMemory error", GetLastError());
		return 0;
	}

	sprintf_s(buffer, "Memory written", lpProc, lpParams );
	addLogMessage(buffer, 0);
	
	DWORD ThreadID;
	HANDLE hThread = CreateRemoteThread(processHandel, NULL, 0, (LPTHREAD_START_ROUTINE)lpProc, lpParams, 0, &ThreadID);

	if (hThread == NULL) {
		sprintf_s(buffer, "Error creating thread");
		addLogMessage(buffer, GetLastError());
		return 0;
	} else {
		WaitForSingleObject( hThread, INFINITE );
	}

    FreeLibrary(userHinstance);
	
	VirtualFreeEx(processHandel, lpProc, ProcSize, MEM_DECOMMIT );
	VirtualFreeEx(processHandel, lpParams, 1024, MEM_DECOMMIT );
    CloseHandle(processHandel);
	
	addLogMessage("Success injecting!", 0);

	return 0;
}

DWORD getProcessID() {
	DWORD processID = 0;
	HANDLE snapHandle;
	PROCESSENTRY32 processEntry = {0};

	if( (snapHandle = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0)) == INVALID_HANDLE_VALUE ) {
        return 0;
	}

	processEntry.dwSize = sizeof(PROCESSENTRY32);
    Process32First(snapHandle, &processEntry);
	do {
		if ( wcscmp(processEntry.szExeFile, PROCESSNAME) == 0 ) {
			return processEntry.th32ProcessID;
		}
	} while (Process32Next(snapHandle,&processEntry));

	if ( snapHandle != INVALID_HANDLE_VALUE ) {
		CloseHandle(snapHandle);
	}

	return 0;
}

BOOL setPrivilege(HANDLE hToken, LPCTSTR szPrivName, BOOL fEnable) {
    TOKEN_PRIVILEGES tp;
    tp.PrivilegeCount = 1;
    LookupPrivilegeValue(NULL, szPrivName, &tp.Privileges[0].Luid);
    tp.Privileges[0].Attributes = fEnable ? SE_PRIVILEGE_ENABLED : 0;
    AdjustTokenPrivileges(hToken, FALSE, &tp, sizeof(tp), NULL, NULL);
    return((GetLastError() == ERROR_SUCCESS));
}

int addLogMessage(char* str, int code) {
	errno_t err;
	FILE* log;

	if((err = fopen_s(&log, LOGFILE, "a+")) != 0) {
		return -1;
	}
		
	fprintf(log, "[code: %u] %s\n", code, str);
	fclose(log);
	return 0;
}