第2种
.386
.model flat, stdcall
option casemap:none
include windows.inc
include user32.inc
includelib user32.lib
include kernel32.inc
includelib kernel32.lib
include advapi32.inc
includelib advapi32.lib
CTEXT MACRO y:VARARG
LOCAL sym
CONST segment
IFIDNI <y>,<>
sym db 0
ELSE
sym db y,0
ENDIF
CONST ends
EXITM <OFFSET sym>
ENDM
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
; 将参数列表的顺序翻转
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
reverseArgs macro arglist:VARARG
local txt,count
txt TEXTEQU <>
count = 0
for i,<arglist>
count = count + 1
txt TEXTEQU @CatStr(i,<!,>,<%txt>)
endm
if count GT 0
txt SUBSTR txt,1,@SizeStr(%txt)-1
endif
exitm txt
endm
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
; 建立一个类似于 invoke 的 Macro
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
_invoke macro _Proc,args:VARARG
local count
count = 0
% for i,< reverseArgs( args ) >
count = count + 1
push i
endm
call dword ptr _Proc
endm
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
.data
hWinlogon dd ?
hProcess dd ?
lpRemoteCode dd ?
hRemoteThread dd ?
lpLoadLibrary dd ?
lpGetProcAddress dd ?
lpGetModuleHandle dd ?
lpFreeLibrary dd ?
szText db "winlogon.exe",0
.code
;////////////////////////////////////////////////////////////
REMOTE_CODE_START equ this byte
_lpLoadLibrary dd ? ;导入函数地址表
_lpGetProcAddress dd ?
_lpGetModuleHandle dd ?
_lpFreeLibrary dd ?
_szDllUser db 'qopop.dll',0
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
_RemoteThread proc uses ebx edi esi lParam
local @hModule
call @F
@@:
pop ebx
sub ebx,offset @B
;********************************************************************
lea eax,[ebx + offset _szDllUser]
_invoke [ebx + _lpGetModuleHandle],eax
.if eax!=0
_invoke [ebx + _lpFreeLibrary],eax
.endif
ret
_RemoteThread endp
REMOTE_CODE_END equ this byte
REMOTE_CODE_LENGTH equ offset REMOTE_CODE_END - offset REMOTE_CODE_START
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
_GetProcessList proc
local @stProcess:PROCESSENTRY32
local @hSnapShot,@dwszlen
invoke lstrlen, addr szText
mov @dwszlen, eax
invoke RtlZeroMemory,addr @stProcess,sizeof @stProcess
mov @stProcess.dwSize,sizeof @stProcess
invoke CreateToolhelp32Snapshot,TH32CS_SNAPPROCESS,0
mov @hSnapShot,eax
invoke Process32First,@hSnapShot,addr @stProcess
.while eax
mov edi, offset szText
lea esi, @stProcess.szExeFile
mov ecx, @dwszlen
REPE CMPS BYTE PTR ES:[EDI],BYTE PTR [ESI]
JE getid
invoke Process32Next,@hSnapShot,addr @stProcess
.endw
invoke CloseHandle,@hSnapShot
ret
getid:
mov eax, @stProcess.th32ProcessID
mov hWinlogon, eax
invoke CloseHandle,@hSnapShot
ret
_GetProcessList endp
start:
invoke _GetProcessList
.if hWinlogon == 0
invoke MessageBox, NULL, CTEXT("没得到winlogon进程id"), CTEXT("失败"), MB_OK
invoke ExitProcess,NULL
.endif
invoke GetModuleHandle, CTEXT("Kernel32.dll")
mov ebx,eax
invoke GetProcAddress, ebx, CTEXT("LoadLibrary")
mov lpLoadLibrary,eax
invoke GetProcAddress, ebx, CTEXT("GetProcAddress")
mov lpGetProcAddress,eax
invoke GetProcAddress, ebx, CTEXT("GetModuleHandle")
mov lpGetModuleHandle,eax
invoke GetProcAddress, ebx, CTEXT("FreeLibrary")
mov lpFreeLibrary,eax
CALL l22222
test eax, eax
JE over
invoke OpenProcess, 42Ah, 0, hWinlogon
test eax, eax
JE over
mov hProcess,eax
invoke VirtualAllocEx, hProcess, 0, REMOTE_CODE_LENGTH, 1000h, 4
test eax, eax
JE over
mov lpRemoteCode,eax
invoke WriteProcessMemory,hProcess,lpRemoteCode, offset REMOTE_CODE_START,REMOTE_CODE_LENGTH,NULL
invoke WriteProcessMemory,hProcess,lpRemoteCode, offset lpLoadLibrary,sizeof dword * 4,NULL
mov eax,lpRemoteCode
add eax,offset _RemoteThread - offset REMOTE_CODE_START
invoke CreateRemoteThread,hProcess,NULL,0,eax,0,0,NULL
test eax, eax
JE VirFre
mov hRemoteThread,eax
PUSH -1
PUSH hRemoteThread
CALL WaitForSingleObject
VirFre:
invoke VirtualFreeEx, hProcess, lpRemoteCode, 0, 8000h
over:
.if hRemoteThread != 0
invoke CloseHandle, hRemoteThread
.endif
.if hProcess != 0
invoke CloseHandle,hProcess
.endif
invoke MessageBox, NULL, CTEXT("成功注入了dll"), CTEXT("成功"), MB_OK
invoke ExitProcess,NULL
;提升权限
l22222:
PUSH EBP
MOV EBP,ESP
SUB ESP,14h
LEA EAX,[EBP-4]
PUSH EAX
PUSH 28h
CALL GetCurrentProcess
PUSH EAX
CALL OpenProcessToken
TEST EAX,EAX
JE L039
PUSH ESI
LEA EAX,[EBP-10h]
PUSH EAX
;PUSH 10069200
PUSH CTEXT("SeDebugPrivilege")
XOR ESI,ESI
PUSH ESI
CALL LookupPrivilegeValueA
TEST EAX,EAX
JE L033
PUSH ESI
PUSH ESI
PUSH ESI
LEA EAX,[EBP-14h]
PUSH EAX
PUSH ESI
PUSH DWORD PTR [EBP-4]
MOV DWORD PTR [EBP-14h],1
MOV DWORD PTR [EBP-8],2
CALL AdjustTokenPrivileges
TEST EAX,EAX
JE L033
INC ESI
L033:
PUSH DWORD PTR [EBP-4]
CALL CloseHandle
MOV EAX,ESI
POP ESI
LEAVE
RETN
L039:
XOR EAX,EAX
LEAVE
RETN
end start
