-
-
[讨论]在win11下使用CreateRemoteThread注入时出现拒绝访问
-
-
[讨论]在win11下使用CreateRemoteThread注入时出现拒绝访问
我在win11下使用CreateRemoteThread函数注入时，GetLastError返回5（拒绝访问），注入程序和目标程序都是生成的32位release版本，在运行注入程序时使用了管理员权限，但还是不行。我将这两个文件放到win10的虚拟机中进行测试，结果发现是能够注入成功的。有没有大佬知道怎么解决win11中出现的拒绝访问问题。代码如下：
// 注入程序
#include <Windows.h>
#include <assert.h>
#include <iostream>
using namespace std;
BOOL SetProcessPrivilege(const char* lpName, BOOL opt)
{
HANDLE hToken;
TOKEN_PRIVILEGES tpNewState;
if (OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken))
{
LookupPrivilegeValueA(NULL, lpName, &tpNewState.Privileges[0].Luid);
tpNewState.PrivilegeCount = 1;
tpNewState.Privileges[0].Attributes = opt != 0 ? 2 : 0;
cout << GetLastError() << endl;
BOOL atp = AdjustTokenPrivileges(hToken, FALSE, &tpNewState, sizeof(tpNewState), NULL, NULL);
cout << GetLastError() << endl;
CloseHandle(hToken);
return TRUE;
}
else
{
return FALSE;
}
}
void RemoteCall00()
{
cout << "RemoteCall00..." << endl;
DWORD pid, tid;
ULONG addrCall;
cin >> pid >> hex >> addrCall; // 方便调试，手动输入进程ID
HANDLE hProcess = OpenProcess(PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION
| PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_VM_READ, 0, pid);
assert(hProcess != NULL);
cout << "pid = " << pid << endl;
cout << GetLastError() << endl; // 输出 0
CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)addrCall, NULL, 0, 0);
cout << GetLastError() << endl; // 输出 5
}
int main()
{
SetProcessPrivilege("SeDebugPrivilege", 1);
RemoteCall00();
system("pause");
}// 目标程序
#include <iostream>
using namespace std;
void Call00()
{
cout << hex << Call00 << "，Call00: 无参数，行号：" << dec << __LINE__ << endl;
}
void Call01(int i)
{
cout << hex << Call01 << "，Call00: 1参数，行号：" << dec << __LINE__ << endl;
}
void Call02(int a, int b)
{
cout << hex << Call02 << "，Call00: 2参数，行号：" << dec << __LINE__ << endl;
}
void Call03(int a, int b, int c)
{
cout << hex << Call03 << "，Call00: 3参数，行号：" << dec << __LINE__ << endl;
}
int main()
{
Call00();
Call01(1);
Call02(1, 2);
Call03(1, 2, 3);
while (1) getchar();
return 0;
}
[培训]Windows内核深度攻防：从Hook技术到Rootkit实战！
