Einfachen Injector erstellen
Dieser Thread hat mir eine Menge Zeit und viel Aufwand gekostet.
Aber ich hoffe ich konnte euer Wissen erweitern und euch weiterhelfen
Hier die GANZEN schritte.
#include <windows.h>
#include <tlhelp32.h>
//define functions
BOOL IsAdministrator(VOID);
BOOL InjectToProcess(LPSTR lpTargetName);
DWORD GetProcId(LPSTR ProcName);
#pragma comment (linker,"/entry:WinMain filealign:0x200")
int APIENTRY WinMain(HINSTANCE hInstance,HINSTANCE hPrevInstance,LPSTR lpCmdLine,int nCmdShow)
{
// TODO: Place code here.
if(IsAdministrator()==FALSE){
MessageBox(NULL,"You do not have admin rights!",0,0);
}
InjectToProcess("Target.exe");
ExitProcess(0);
return 0;
}
//administrative priviligesm are necesary for opening remote process
BOOL IsAdministrator(VOID)
{
SID_IDENTIFIER_AUTHORITY NtAuthority = SECURITY_NT_AUTHORITY;
PSID AdministratorsGroup;
// Initialize SID.
if( !AllocateAndInitializeSid(&NtAuthority,2,SECURITY_ BUILTIN_DOMAIN_RID,
DOMAIN_ALIAS_RID_ADMINS,0, 0, 0, 0, 0, 0,&AdministratorsGroup))
{
return FALSE;
}
// Check whether the token is present in admin group.
BOOL IsInAdminGroup = FALSE;
if(!CheckTokenMembership(NULL,AdministratorsGroup, &IsInAdminGroup))
{// Error occurred.
IsInAdminGroup = FALSE;
}
// Free SID and return.
FreeSid(AdministratorsGroup);
return IsInAdminGroup;
}
//lets use tlhelp api to get our target proc Id by name, remember it is case sensitive
DWORD GetProcId(LPSTR ProcName)
{
PROCESSENTRY32 pe32;
HANDLE hProcessSnap = INVALID_HANDLE_VALUE;
//create snapshot of all processes running
hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);
if( hProcessSnap == INVALID_HANDLE_VALUE )return (0);
pe32.dwSize = sizeof(PROCESSENTRY32);
if( Process32First(hProcessSnap, &pe32) == 0 ) {
CloseHandle( hProcessSnap );
return (0);
}
do {//lets loop thru all processes and compare its names with ours
if(lstrcmp(ProcName,pe32.szExeFile)== 0)
return pe32.th32ProcessID;
}while(Process32Next(hProcessSnap,&pe32) );
CloseHandle( hProcessSnap );
SetLastError(0);
return (0);
}
BOOL InjectToProcess(LPSTR lpTargetName)
{
HINSTANCE hKernel;
HANDLE hProcess, hThread;
DWORD pLoadLibraryA;
DWORD dwAllocAddress = 0, dwTargetProcId = 0,
dwBuflen = 0, dwNewThreadId = 0, dwWritten = 0;
//allocate string buffer
LPSTR lpModulePath = (LPSTR)GlobalAlloc(GPTR,MAX_PATH);
//get library full path
GetModuleFileNameA(NULL,lpModulePath,MAX_PATH);
lpModulePath[lstrlen(lpModulePath) - 4] = 0;
lstrcat(lpModulePath,".dll");
//lets check if the library exist
WIN32_FIND_DATA WFD;
if(FindFirstFileA(lpModulePath,&WFD) == INVALID_HANDLE_VALUE) {
MessageBox(NULL,"... Dll Not Found!",0,0);
return (1);
}
hKernel = GetModuleHandle("kernel32.dll");
if(hKernel == NULL)
hKernel = LoadLibrary("kernel32.dll");
if(hKernel == NULL) {
MessageBox(NULL,"It seems you dont have kernel lol",0,0);
return (1);
}
pLoadLibraryA = (DWORD)GetProcAddress(hKernel,"LoadLibraryA");
do {
dwTargetProcId = GetProcId(lpTargetName);
Sleep(20);
}while(!dwTargetProcId);
hProcess = OpenProcess(PROCESS_ALL_ACCESS,FALSE,dwTargetProcI d);
if( GetLastError() != NO_ERROR ) {
MessageBox(NULL,"Failed To Open Process!",0,0);
return 1;
}
MessageBox(NULL,"Process Opened Succefully",0,0);
dwAllocAddress = (DWORD)VirtualAllocEx(hProcess,0,lstrlen(lpModuleP ath),MEM_COMMIT,PAGE_READWRITE);
if( GetLastError()!= NO_ERROR ) {
CloseHandle(hProcess);
MessageBox(NULL,"Unable To Allocate Memory",0,0);
return 1;
}
MessageBox(NULL,"Memory Allocated Succefully",0,0);
WriteProcessMemory(hProcess,(LPVOID)dwAllocAddress ,lpModulePath,lstrlen(lpModulePath),&dwWritten);
if( GetLastError() != NO_ERROR ) {
CloseHandle(hProcess);
MessageBox(NULL,"...Unable To Write Memory",0,0);
return 1;
}
hThread = CreateRemoteThread(hProcess,0,0,(LPTHREAD_START_RO UTINE)
pLoadLibraryA,(LPVOID)dwAllocAddress,0,&dwNewThrea dId);
if( GetLastError() != NO_ERROR ) {
CloseHandle(hProcess);
MessageBox(NULL,"...Failed To Create Thread, Try Again",0,0);
return 1;
}
CloseHandle(hThread);
CloseHandle(hProcess);
GlobalFree(lpModulePath);
MessageBox(NULL,"...Thread Created Succefully",0,0);
return (0);
}
So das war's nun habt ihr euren Injector.
PLS PRESS THX
Lg gänseblümchen
injector injeziert eine dll in eine exe
außerdem ist das kein tutorial sondern nur ein code den man kopieren und einfügen muss (nichts erklärt usw.)
