本文为看雪论坛优秀文章
看雪论坛作者ID：0346954
using namespace std; VOID InjectToWinLogon(){ PROCESSENTRY32 entry; HANDLE snapshot = NULL, proc = NULL; entry.dwSize = sizeof(PROCESSENTRY32); snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, NULL); INT pid = -1; if (Process32First(snapshot, &entry)) { while (Process32Next(snapshot, &entry)) { if (wcscmp(entry.szExeFile, L"winlogon.exe") == 0) { pid = entry.th32ProcessID; break; } } } CloseHandle(snapshot); if (pid < 0) { //puts("[-] Could not find winlogon.exe"); return; } proc = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid); if (proc == NULL) { DWORD error = GetLastError(); puts("[-] Failed to open process."); printf("error %d\n", error); return; } TCHAR buffDll[MAX_PATH] = { 0 }; GetModuleFileName(NULL, buffDll, _countof(buffDll)); PathRemoveFileSpec(buffDll); _tcscat_s(buffDll, _countof(buffDll), L"\\DllHookExitWindowsEx.dll"); LPVOID buffer = VirtualAllocEx(proc, NULL, sizeof(buffDll), MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE); if (buffer == NULL) { printf("[-] Failed to allocate remote memory"); } if (!WriteProcessMemory(proc, buffer, buffDll, sizeof(buffDll), 0)) { puts("[-] Failed to write to remote memory"); return; } LPTHREAD_START_ROUTINE start = (LPTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandle(L"Kernel32.dll"), "LoadLibraryW"); HANDLE hthread = CreateRemoteThread(proc, 0, 0, (LPTHREAD_START_ROUTINE)start, buffer, 0, 0); DWORD error = GetLastError(); if (hthread == INVALID_HANDLE_VALUE) { puts("[-] Failed to create remote thread"); return; }} void EnableSeDebugPrivilegePrivilege(){ LUID luid; HANDLE currentProc = OpenProcess(PROCESS_ALL_ACCESS, false, GetCurrentProcessId()); if (currentProc) { HANDLE TokenHandle = NULL; BOOL hProcessToken = OpenProcessToken(currentProc, TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &TokenHandle); if (hProcessToken) { BOOL checkToken = LookupPrivilegeValue(NULL, L"SeDebugPrivilege", &luid); if (!checkToken) { //std::cout << "[+] Current process token already includes SeDebugPrivilege\n" << std::endl; } else { TOKEN_PRIVILEGES tokenPrivs; tokenPrivs.PrivilegeCount = 1; tokenPrivs.Privileges[0].Luid = luid; tokenPrivs.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED; BOOL adjustToken = AdjustTokenPrivileges(TokenHandle, FALSE, &tokenPrivs, sizeof(TOKEN_PRIVILEGES), (PTOKEN_PRIVILEGES)NULL, (PDWORD)NULL); if (adjustToken != 0) { //std::cout << "[+] Added SeDebugPrivilege to the current process token" << std::endl; } } CloseHandle(TokenHandle); } } CloseHandle(currentProc);} int _tmain(int argc, _TCHAR* argv[]){ //开启权限 使之可以注入到syetem进程 EnableSeDebugPrivilegePrivilege(); //注入dll InjectToWinLogon(); getchar(); return 0;}
LPVOID _copyNtShutdownSystem = NULL;LPVOID _ExitWindowsExAddTwoByte = NULL;HMODULE _gloDllModule = NULL; /*__declspec(naked)*/ void MyExitWindowsEx(){ /*__asm { call testMsgBox; jmp _ExitWindowsExAddTwoByte }*/} typedef BOOL(WINAPI* FuncExitWindowsEx)(_In_ UINT uFlags, _In_ DWORD dwReason);FuncExitWindowsEx _OldExitWindowsEx = NULL; HANDLE gloCreateProcessHandle = NULL; BOOL WINAPI IATHookExitWindowsEx(_In_ UINT uFlags, _In_ DWORD dwReason){ BOOL bRet = FALSE; static BOOL bNeedWarning = FALSE; //__asm int 3 //DebugBreak(); /*if (uFlags & 0x200000)//win7 x86可以通过这句来判断是否是第二次调用 通过调试获得的 需要测试 { }*/ if (bNeedWarning) { TCHAR wszProcessName[MAX_PATH] = { 0 }; GetModuleFileName(_gloDllModule, wszProcessName, _countof(wszProcessName)); PathRemoveFileSpec(wszProcessName); _tcscat_s(wszProcessName, _countof(wszProcessName), L"\\LogOffWillRun.exe"); useTokenCreateProcess(gloCreateProcessHandle, wszProcessName); } bRet = _OldExitWindowsEx(uFlags, dwReason); if (bRet) { bNeedWarning = TRUE; } return bRet; } //这是 win7 x86上的 Iniline Hookvoid hook_ExitWindowsEx(){ HMODULE hUser32 = GetModuleHandle(L"user32.dll"); char* pOldExitWindowsEx = (char*)GetProcAddress(hUser32, "ExitWindowsEx"); char* pOldAddr = pOldExitWindowsEx; //00540000 8bff mov edi, edi int iLengthCopy = 7; if (NULL != pOldAddr) { _copyNtShutdownSystem = VirtualAlloc(0, 1024, MEM_COMMIT, PAGE_EXECUTE_READWRITE); char* pNewAddr = (char*)_copyNtShutdownSystem; char* pnop = pOldAddr - 5; //有5个字节的NOP char aa = *pOldAddr; char bb = *(pOldAddr+1); if ((char)0x8b == *pOldAddr && (char)0xff == *(pOldAddr+1)) { DWORD oldshutdownProtect = 0; if (VirtualProtect(pOldAddr-5, iLengthCopy, PAGE_EXECUTE_READWRITE, &oldshutdownProtect)) { //*pOldNtShutdownSyetem = (char)0xe9;//jmp *pOldExitWindowsEx = (char)0xeB;//jmp 短跳转 *(UCHAR*)(pOldExitWindowsEx + 1) = (USHORT)(-0x7); //addr *pnop = (char)0xe9;//jmp *(int*)(pnop + 1) = (int)MyExitWindowsEx-(int)(pnop + 5); //addr _ExitWindowsExAddTwoByte = pOldExitWindowsEx + 2; VirtualProtect(pOldAddr-5, iLengthCopy, oldshutdownProtect, NULL); } } } return;} BYTE* getNtHdrs(BYTE* pe_buffer){ if (pe_buffer == NULL) return NULL; IMAGE_DOS_HEADER* idh = (IMAGE_DOS_HEADER*)pe_buffer; if (idh->e_magic != IMAGE_DOS_SIGNATURE) { return NULL; } const LONG kMaxOffset = 1024; LONG pe_offset = idh->e_lfanew; if (pe_offset > kMaxOffset) return NULL; IMAGE_NT_HEADERS32* inh = (IMAGE_NT_HEADERS32*)((BYTE*)pe_buffer + pe_offset); if (inh->Signature != IMAGE_NT_SIGNATURE) return NULL; return (BYTE*)inh;} IMAGE_DATA_DIRECTORY* getPeDir(PVOID pe_buffer, size_t dir_id){ if (dir_id >= IMAGE_NUMBEROF_DIRECTORY_ENTRIES) return NULL; BYTE* nt_headers = getNtHdrs((BYTE*)pe_buffer); if (nt_headers == NULL) return NULL; IMAGE_DATA_DIRECTORY* peDir = NULL; IMAGE_NT_HEADERS* nt_header = (IMAGE_NT_HEADERS*)nt_headers; peDir = &(nt_header->OptionalHeader.DataDirectory[dir_id]); if (peDir->VirtualAddress == NULL) { return NULL; } return peDir; } bool FixDelayIATHook(PVOID modulePtr){ IMAGE_DATA_DIRECTORY* importsDir = getPeDir(modulePtr, IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT); if (importsDir == NULL) return false; size_t maxSize = importsDir->Size; size_t impAddr = importsDir->VirtualAddress; IMAGE_DELAYLOAD_DESCRIPTOR* lib_desc = NULL; size_t parsedSize = 0; bool bFound = TRUE; size_t addrExitWindowsEx = (size_t)GetProcAddress(GetModuleHandle(L"User32"), "ExitWindowsEx"); for (; parsedSize < maxSize; parsedSize += sizeof(IMAGE_DELAYLOAD_DESCRIPTOR)) { lib_desc = (IMAGE_DELAYLOAD_DESCRIPTOR*)(impAddr + parsedSize + (ULONG_PTR)modulePtr); if (lib_desc->ImportAddressTableRVA == NULL && lib_desc->ImportNameTableRVA == NULL) break; LPSTR lib_name = (LPSTR)((ULONGLONG)modulePtr + lib_desc->DllNameRVA); size_t call_via = lib_desc->ImportAddressTableRVA; size_t thunk_addr = lib_desc->ImportNameTableRVA; if (thunk_addr == NULL) thunk_addr = lib_desc->ImportAddressTableRVA; size_t offsetField = 0; size_t offsetThunk = 0; for (;; offsetField += sizeof(IMAGE_THUNK_DATA), offsetThunk += sizeof(IMAGE_THUNK_DATA)) { IMAGE_THUNK_DATA* fieldThunk = (IMAGE_THUNK_DATA*)(size_t(modulePtr) + offsetField + call_via); IMAGE_THUNK_DATA* orginThunk = (IMAGE_THUNK_DATA*)(size_t(modulePtr) + offsetThunk + thunk_addr); if (0 == fieldThunk->u1.Function && 0 == orginThunk->u1.Function) { break; } PIMAGE_IMPORT_BY_NAME by_name = NULL; LPSTR func_name = NULL; size_t addrOld = NULL; if (orginThunk->u1.Ordinal & IMAGE_ORDINAL_FLAG32 || orginThunk->u1.Ordinal & IMAGE_ORDINAL_FLAG64) // check if using ordinal (both x86 && x64) { addrOld = (size_t)GetProcAddress(LoadLibraryA(lib_name), (char*)(orginThunk->u1.Ordinal & 0xFFFF));//通过序号也可以获取到 获取低两个字节 也可以获取到函数地址 //printf(" [V] API %x at %x\n", orginThunk->u1.Ordinal, addr); //fieldThunk->u1.Function = addr; continue; } else { by_name = (PIMAGE_IMPORT_BY_NAME)(size_t(modulePtr) + orginThunk->u1.AddressOfData); func_name = (LPSTR)by_name->Name; addrOld = (size_t)GetProcAddress(LoadLibraryA(lib_name), func_name); } //printf(" [V] API %s at %x\n", func_name, addr); OutputDebugStringA("\r\n"); OutputDebugStringA(func_name); //HOOK if (strcmpi(func_name, "ExitWindowsEx") == 0) { //DebugBreak(); DWORD dOldProtect = 0; size_t* pFuncAddr = (size_t*)&fieldThunk->u1.Function; if (VirtualProtect(pFuncAddr, sizeof(size_t), PAGE_EXECUTE_READWRITE, &dOldProtect)) { fieldThunk->u1.Function = (size_t)IATHookExitWindowsEx; VirtualProtect(pFuncAddr, sizeof(size_t), dOldProtect, &dOldProtect); _OldExitWindowsEx = (FuncExitWindowsEx)addrExitWindowsEx; bFound = true; return bFound; } break; } } } return true;} bool FixIATHook(PVOID modulePtr){ IMAGE_DATA_DIRECTORY* importsDir = getPeDir(modulePtr, IMAGE_DIRECTORY_ENTRY_IMPORT); if (importsDir == NULL) return false; size_t maxSize = importsDir->Size; size_t impAddr = importsDir->VirtualAddress; IMAGE_IMPORT_DESCRIPTOR* lib_desc = NULL; size_t parsedSize = 0; bool bFound = TRUE; size_t addrExitWindowsEx = (size_t)GetProcAddress(GetModuleHandle(L"User32"), "ExitWindowsEx"); for (; parsedSize < maxSize; parsedSize += sizeof(IMAGE_IMPORT_DESCRIPTOR)) { lib_desc = (IMAGE_IMPORT_DESCRIPTOR*)(impAddr + parsedSize + (ULONG_PTR)modulePtr); if (lib_desc->OriginalFirstThunk == NULL && lib_desc->FirstThunk == NULL) break; LPSTR lib_name = (LPSTR)((size_t)modulePtr + lib_desc->Name); size_t call_via = lib_desc->FirstThunk; size_t thunk_addr = lib_desc->OriginalFirstThunk; if (thunk_addr == NULL) thunk_addr = lib_desc->FirstThunk; size_t offsetField = 0; size_t offsetThunk = 0; for (;; offsetField += sizeof(IMAGE_THUNK_DATA), offsetThunk += sizeof(IMAGE_THUNK_DATA)) { IMAGE_THUNK_DATA* fieldThunk = (IMAGE_THUNK_DATA*)(size_t(modulePtr) + offsetField + call_via); IMAGE_THUNK_DATA* orginThunk = (IMAGE_THUNK_DATA*)(size_t(modulePtr) + offsetThunk + thunk_addr); if (0 == fieldThunk->u1.Function && 0 == orginThunk->u1.Function) { break; } PIMAGE_IMPORT_BY_NAME by_name = NULL; LPSTR func_name = NULL; size_t addrOld = NULL; if (orginThunk->u1.Ordinal & IMAGE_ORDINAL_FLAG32 || orginThunk->u1.Ordinal & IMAGE_ORDINAL_FLAG64) // check if using ordinal (both x86 && x64) { addrOld = (size_t)GetProcAddress(LoadLibraryA(lib_name), (char*)(orginThunk->u1.Ordinal & 0xFFFF));//通过序号? //printf(" [V] API %x at %x\n", orginThunk->u1.Ordinal, addr); //fieldThunk->u1.Function = addr; //DebugBreak(); continue; } else { by_name = (PIMAGE_IMPORT_BY_NAME)(size_t(modulePtr) + orginThunk->u1.AddressOfData); func_name = (LPSTR)by_name->Name; addrOld = (size_t)GetProcAddress(LoadLibraryA(lib_name), func_name); } //printf(" [V] API %s at %x\n", func_name, addr); OutputDebugStringA("\r\n"); OutputDebugStringA(func_name); //HOOK if (strcmpi(func_name, "ExitWindowsEx") == 0) { //DebugBreak(); DWORD dOldProtect = 0; size_t* pFuncAddr = (size_t*)&fieldThunk->u1.Function; if (VirtualProtect(pFuncAddr, sizeof(size_t), PAGE_EXECUTE_READWRITE, &dOldProtect)) { fieldThunk->u1.Function = (size_t)IATHookExitWindowsEx; VirtualProtect(pFuncAddr, sizeof(size_t), dOldProtect, &dOldProtect); _OldExitWindowsEx = (FuncExitWindowsEx)addrExitWindowsEx; bFound = true; return bFound; } } } } return true; } BOOL APIENTRY DllMain( HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved ){ switch (ul_reason_for_call) { case DLL_PROCESS_ATTACH: { //DebugBreak(); _gloDllModule = hModule; gloCreateProcessHandle = getMediumProcessToken(); HMODULE exeModule = GetModuleHandle(NULL); FixIATHook(exeModule); FixDelayIATHook(exeModule); break; } case DLL_THREAD_ATTACH: case DLL_THREAD_DETACH: case DLL_PROCESS_DETACH: { if (gloCreateProcessHandle != NULL) { CloseHandle(gloCreateProcessHandle); gloCreateProcessHandle = NULL; } } break; } return TRUE;}
HANDLE getMediumProcessToken();void useTokenCreateProcess(HANDLE hToken, TCHAR* szProcessName);
HANDLE getMediumProcessToken(){ WCHAR* wszIntegritySid = L"S-1-16-8192"; //CreateIntegritySidProcess(L"S-1-16-4096");//low权限进程 //CreateIntegritySidProcess(L"S-1-16-8192");//medium权限进程 //CreateIntegritySidProcess(L"S-1-16-12288");//high权限进程 //CreateIntegritySidProcess(L"S-1-16-16384");//system权限进程 HANDLE mediumToken = NULL; HANDLE hToken = NULL; HANDLE hNewToken = NULL; PSID pIntegritySid = NULL; TOKEN_MANDATORY_LABEL TIL = { 0 }; __try { if (FALSE == OpenProcessToken(GetCurrentProcess(), MAXIMUM_ALLOWED, &hToken)) { __leave; } if (FALSE == DuplicateTokenEx(hToken, MAXIMUM_ALLOWED, NULL, SecurityImpersonation, TokenPrimary, &hNewToken)) { __leave; } if (FALSE == ConvertStringSidToSid(wszIntegritySid, &pIntegritySid)) { __leave; } TIL.Label.Attributes = SE_GROUP_INTEGRITY; TIL.Label.Sid = pIntegritySid; // Set the process integrity level if (FALSE == SetTokenInformation(hNewToken, TokenIntegrityLevel, &TIL, sizeof(TOKEN_MANDATORY_LABEL)+GetLengthSid(pIntegritySid))) { __leave; } mediumToken = hNewToken; } __finally { if (NULL != pIntegritySid) { LocalFree(pIntegritySid); pIntegritySid = NULL; } if (NULL != hToken) { CloseHandle(hToken); hToken = NULL; } } return mediumToken;} void useTokenCreateProcess(HANDLE hToken, TCHAR* szProcessName){ //LogOffWillRun //WCHAR wszProcessName[MAX_PATH] = L"C:\\Windows\\System32\\CMD.exe"; PROCESS_INFORMATION ProcInfo = { 0 }; STARTUPINFO StartupInfo = { 0 }; StartupInfo.cb = sizeof(STARTUPINFO); //si.dwXSize = 120; //StartupInfo.lpDesktop = L"WinSta0\\Default"; StartupInfo.lpDesktop = L"WinSta0\\winlogon"; StartupInfo.dwFlags = STARTF_USESHOWWINDOW; StartupInfo.wShowWindow = SW_SHOWNORMAL; BOOL bRet = CreateProcessAsUser(hToken, NULL, szProcessName, NULL, NULL, FALSE, 0, NULL, NULL, &StartupInfo, &ProcInfo); if (bRet) { WaitForSingleObject(ProcInfo.hProcess, INFINITE); } if (ProcInfo.hProcess) { CloseHandle(ProcInfo.hProcess); ProcInfo.hProcess = NULL; } if (ProcInfo.hThread) { CloseHandle(ProcInfo.hThread); ProcInfo.hThread = NULL; }}
int _tmain(int argc, _TCHAR* argv[]){ MessageBox(GetConsoleWindow(), _TEXT("调用了ExitWindowsEx进行关机或者注销"), _TEXT("提示"), MB_OK); return 0;}
if (bNeedWarning){ MessageBox(NULL, _TEXT("弹框提示"), _TEXT("提示"), MB_OK);}
如果是通过启动一个新进程的方式，优点是更加灵活，自己编写新进程，不需要修改DLL。
看雪ID：0346954
https://bbs.pediy.com/user-home-762319.htm
# 往期推荐
球分享
球点赞
球在看
点击“阅读原文”，了解更多！
