能力值：
![]()
(RANK：650 )
|
-
-
33 楼
//source of YeZhu.exe
#include <windows.h>
#include <tlhelp32.h>
#pragma comment (linker, "/subsystem:windows")
#pragma comment (linker, "/entry:gogo")
unsigned char data1[26] = {
0xE8, 0x00, 0x00, 0x00, 0x00, 0x5D, 0x83, 0xED, 0x05, 0x8D, 0x45, 0x30, 0x50, 0xFF, 0x95, 0x30,
0x01, 0x00, 0x00, 0x05, 0x00, 0x10, 0x00, 0x00, 0xFF, 0xE0
};
unsigned char data2[36] = {
0xE8, 0x00, 0x00, 0x00, 0x00, 0x5D, 0x83, 0xED, 0x05, 0x8D, 0x45, 0x30, 0x50, 0xFF, 0x95, 0x34,
0x01, 0x00, 0x00, 0x50, 0x50, 0xFF, 0x95, 0x38, 0x01, 0x00, 0x00, 0xFF, 0x95, 0x38, 0x01, 0x00,
0x00, 0xC2, 0x04, 0x00
};
void AdjustPrivilege(int pid, BOOL bEnable)
{
HANDLE hProcess;
HANDLE hToken=0;
TOKEN_PRIVILEGES tkp;
tkp.PrivilegeCount = 1;
tkp.Privileges[0].Attributes = 0;
if (bEnable)
tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
if (LookupPrivilegeValue(NULL, "SeDebugPrivilege", &tkp.Privileges[0].Luid))
{
if (hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid))
{
if (OpenProcessToken(hProcess, TOKEN_ADJUST_PRIVILEGES|TOKEN_QUERY, &hToken))
{
if (AdjustTokenPrivileges(hToken, FALSE, &tkp, 0, NULL, NULL))
{
CloseHandle(hToken);
}
}
CloseHandle(hProcess);
}
}
}
DWORD FindExplorer()
{
HANDLE hC;
DWORD i;
BOOL Next;
char szName[MAX_PATH];
PROCESSENTRY32 p32 = {sizeof(p32)};
hC = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,NULL);
Next = Process32First(hC, &p32);
i = 0;
while (Next)
{
wsprintf(szName, "%s", p32.szExeFile);
_strupr(szName);
if (memcmp(szName, "EXPLORER.EXE", 12) == 0)
return p32.th32ProcessID ;
Next = Process32Next(hC, &p32);
i++;
}
CloseHandle(hC);
return 0;
}
void MakeData1(LPBYTE Address)
{
char szFileName[MAX_PATH];
GetCurrentDirectory(MAX_PATH, szFileName);
strcat(szFileName, "\\ollydbg.exe");
strcpy((char *)Address+0x30, szFileName);
*(LPDWORD)(Address+0x130) = (DWORD)GetProcAddress(GetModuleHandle("kernel32"), "LoadLibraryA");
*(LPDWORD)(Address+0x134) = (DWORD)GetProcAddress(GetModuleHandle("kernel32"), "GetModuleHandleA");
*(LPDWORD)(Address+0x138) = (DWORD)GetProcAddress(GetModuleHandle("kernel32"), "FreeLibrary");
memcpy(Address, data1, sizeof(data1));
}
void MakeData2(LPBYTE Address)
{
memcpy(Address, data2, sizeof(data2));
}
void gogo()
{
DWORD PID;
HANDLE hProcess;
HANDLE hThread;
LPBYTE LocalAddress;
LPBYTE RemoteAddress;
DWORD temp;
AdjustPrivilege(GetCurrentProcessId(), TRUE);
PID = FindExplorer();
if (PID == 0)
return ;
hProcess = OpenProcess(PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION | PROCESS_VM_WRITE, FALSE, PID);
if (hProcess == 0)
return ;
LocalAddress = (LPBYTE)VirtualAlloc(NULL, 0x1000, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
RemoteAddress = (LPBYTE)VirtualAllocEx(hProcess, NULL, 0x1000, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
MakeData1(LocalAddress);
WriteProcessMemory(hProcess, RemoteAddress, LocalAddress, 0x1000, &temp);
hThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)RemoteAddress, NULL, 0, &temp);
WaitForSingleObject(hThread, INFINITE);
CloseHandle(hThread);
MakeData2(LocalAddress);
WriteProcessMemory(hProcess, RemoteAddress, LocalAddress, 0x1000, &temp);
hThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)RemoteAddress, NULL, 0, &temp);
WaitForSingleObject(hThread, INFINITE);
VirtualFree(LocalAddress, 0, MEM_RELEASE);
VirtualFreeEx(hProcess, RemoteAddress, 0, MEM_RELEASE);
}
|
