APC注入

最新推荐文章于 2022-04-28 11:08:24 发布
最新推荐文章于 2022-04-28 11:08:24 发布
阅读量704 收藏
点赞数
分类专栏： 驱动开发学习
/***********************************
desc : This code was written for inject a dll named text.dll to the target process based on APC.
time : 2013
coder: ejoywx
***********************************/
#include <ntddk.h>
#include <ntimage.h>
 
#ifndef SEC_IMAGE
#define SEC_IMAGE   0x1000000     // winnt
#endif
 
extern PUSHORT NtBuildNumber;
 
PVOID pfn_XxxDispatchAPC  = NULL;
PVOID pfn_LoadLibraryA    = NULL;
PVOID pszText_Kernel32    = NULL;
 
ULONG Offset_szText = 0;
ULONG Offset_LoadLibraryA = 0;
ULONG Offset_BaseDispatchAPC = 0;
ULONG Offset_RtlDispatchAPC = 0;
 
UNICODE_STRING gModuleName[] =
{
    RTL_CONSTANT_STRING(L"\\systemroot\\system32\\ntdll.dll"),
    RTL_CONSTANT_STRING(L"\\systemroot\\system32\\kernel32.dll"),
    RTL_CONSTANT_STRING(L"\\WINDOWS\\system32\\kernel32.dll"),
    RTL_CONSTANT_STRING(L"\\systemroot\\system\\text.dll"),
    RTL_CONSTANT_STRING(L"\\Device\\HarddiskVolume1\\WINDOWS\\system32\\notepad.exe")
};                               
 
PIMAGE_NT_HEADERS
NTAPI
RtlImageNtHeader(
    PVOID Base
    );
 
NTSYSAPI
PVOID
NTAPI
RtlImageDirectoryEntryToData(
    PVOID BaseOfImage,
    BOOLEAN MappedAsImage,
    USHORT DirectoryEntry,
    PULONG Size
    );
 
NTSTATUS (NTAPI* pfn_NtQueueApcThread)(
    __in HANDLE     ThreadHandle,
    __in PVOID      ApcRoutine,
    __in_opt PVOID  ApcArgument1,
    __in_opt PVOID  ApcArgument2,
    __in_opt PVOID  ApcArgument3
    );
 
PVOID NTAPI 
TlLoadSysPEtoMem(
    IN PUNICODE_STRING FilePath
    )
{
    OBJECT_ATTRIBUTES   ObjectAttributes = {0};
    IO_STATUS_BLOCK     IoStatusBlock    = {0};
    HANDLE              FileHandle       = NULL;
    HANDLE              SectionHandle    = NULL;
    PVOID               ViewBase         = NULL;
    PVOID               MemBase          = NULL;
    SIZE_T              ViewSize         = 0;
    NTSTATUS            Status           = STATUS_INVALID_PARAMETER;
 
    InitializeObjectAttributes( &ObjectAttributes,
                                FilePath,
                                OBJ_KERNEL_HANDLE|OBJ_CASE_INSENSITIVE,
                                NULL,
                                NULL );
 
    Status = ZwOpenFile (  &FileHandle,
                            FILE_GENERIC_READ,
                            &ObjectAttributes,
                            &IoStatusBlock,
                            FILE_SHARE_READ|FILE_SHARE_WRITE,
                            FILE_NON_DIRECTORY_FILE );
    if ( NT_SUCCESS( Status ) )
    {
        InitializeObjectAttributes( &ObjectAttributes,
                                    NULL,
                                    OBJ_KERNEL_HANDLE,
                                    NULL,
                                    NULL );
        Status = ZwCreateSection(   &SectionHandle,
                                    SECTION_MAP_READ,
                                    &ObjectAttributes,
                                    (PLARGE_INTEGER)NULL,
                                    PAGE_READONLY,
                                    SEC_IMAGE,
                                    FileHandle);
        if ( NT_SUCCESS( Status ) )
        {
            Status = ZwMapViewOfSection(SectionHandle,
                                        ZwCurrentProcess(),
                                        &ViewBase,
                                        0L,
                                        PAGE_SIZE,
                                        NULL,
                                        &ViewSize,
                                        ViewUnmap,
                                        MEM_TOP_DOWN,
                                        PAGE_READWRITE);
                                         
            if( NT_SUCCESS( Status ) )
            {
                MemBase = ExAllocatePoolWithTag( NonPagedPool, ViewSize, ' dmC');
                if( MemBase )
                {
                    RtlMoveMemory( MemBase, ViewBase, ViewSize );
                }
                 
                ZwUnmapViewOfSection( ZwCurrentProcess(), ViewBase );
            }
 
            ZwClose( SectionHandle );
        }
         
        ZwClose( FileHandle );
    }
 
    return MemBase;
}
 
PVOID NTAPI 
TlMapKnownDlltoMem(
    IN PUNICODE_STRING FilePath
    )
{
    OBJECT_ATTRIBUTES   ObjectAttributes = {0};
    HANDLE              SectionHandle    = NULL;
    PVOID               ViewBase         = NULL;
    PVOID               MemBase          = NULL;
    SIZE_T              ViewSize         = 0;
    NTSTATUS            Status           = STATUS_INVALID_PARAMETER;
 
    InitializeObjectAttributes( &ObjectAttributes,
                                FilePath,
                                OBJ_KERNEL_HANDLE|OBJ_CASE_INSENSITIVE,
                                NULL,
                                NULL );
    Status = ZwOpenSection( &SectionHandle,
                    SECTION_MAP_READ,
                    &ObjectAttributes
                    );
    if ( NT_SUCCESS( Status ) )
    {
        Status = ZwMapViewOfSection(SectionHandle,
                            ZwCurrentProcess(),
                            &ViewBase,
                            0L,
                            PAGE_SIZE,
                            NULL,
                            &ViewSize,
                            ViewUnmap,
                            MEM_TOP_DOWN,
                            PAGE_READWRITE );
         
        if( NT_SUCCESS( Status ) )
        {
            MemBase = ExAllocatePoolWithTag( NonPagedPool, ViewSize, ' dmC');
            if( MemBase )
            {
                RtlMoveMemory( MemBase, ViewBase, ViewSize );
            }
             
            ZwUnmapViewOfSection( ZwCurrentProcess(), ViewBase );
        }
 
        ZwClose( SectionHandle );
    }
 
    return MemBase;
}
 
PVOID NTAPI 
TlGetProcAddress(
    IN PVOID ImageBase,
    IN PUCHAR ApiName
    )
{
    PIMAGE_EXPORT_DIRECTORY ExpDir  = NULL;
    PULONG          AddressOfNames  = NULL;
    PULONG      AddressOfFunctions  = NULL;
    PUSHORT  AddressOfNameOrdinals  = NULL;
    PVOID              FuncAddress  = NULL;
    ULONG               ExpDirSize  = 0;
    ULONG            NumberOfNames  = 0; 
 
    LONG                    Idx     = 0;
    LONG                    ret     = 0;
    LONG                    low     = 0;
    LONG                    mid     = 0;
    LONG                    high    = 0;
    PCHAR                   pName   = NULL;
     
    if( !ImageBase )return NULL;
     
    ExpDir = (PIMAGE_EXPORT_DIRECTORY)RtlImageDirectoryEntryToData(ImageBase,TRUE,IMAGE_DIRECTORY_ENTRY_EXPORT,&ExpDirSize );
    if ( ExpDir  )
    {
        AddressOfNames          = (PULONG)( (ULONG)ImageBase + ExpDir->AddressOfNames );
        AddressOfFunctions      = (PULONG)( (ULONG)ImageBase + ExpDir->AddressOfFunctions );
        AddressOfNameOrdinals   = (PUSHORT)( (ULONG)ImageBase + ExpDir->AddressOfNameOrdinals );
        NumberOfNames           = ExpDir->NumberOfNames;
         
        if( (ULONG)ApiName & 0xFFFF0000 )
        {
            high = NumberOfNames-1;
            while(low <= high)//二分查找，快速定位
            {
                mid   = (high+low)>>1;
                pName = (PCHAR)ImageBase+AddressOfNames[mid] ;
 
                Idx = 0;
                while( pName[Idx] && pName[Idx] == ApiName[Idx] )
                {
                    ++Idx;
                }
 
                ret = pName[Idx] - ApiName[Idx];
                if ( ret==0 )
                {
                    (PUCHAR)FuncAddress=(PUCHAR)ImageBase + AddressOfFunctions[ AddressOfNameOrdinals[ mid ] ];
 
                    break;
                }
                else if( ret > 0 )
                {
                    high=mid-1;
                }
                else
                {
                    low=mid+1;
                }
            }
        }
        else
        {
            (PUCHAR)FuncAddress=(PUCHAR)ImageBase + AddressOfFunctions[ (ULONG)ApiName & 0x0FFFF ];
        }       
    }   
 
    return FuncAddress;
}
 
ULONG NTAPI //just for winxp/win2003
GetOffsetForXxxDispatchApc(
    IN PVOID pfn_QueueUserApc,
    IN PVOID ImageBase
    )
{
    ULONG   Offset = 0;
    PUCHAR  pMem   = (PUCHAR)pfn_QueueUserApc;
    PUCHAR  pLim   = (PUCHAR)pfn_QueueUserApc + 0x100;
     
    while( pMem < pLim && *(PULONG)pMem != 0x90000CC2 ) pMem++;
     
    if( *(PULONG)pMem == 0x90000CC2 )
    {
        pLim   = (PUCHAR)pfn_QueueUserApc;
        while( (--pMem) > pLim )
        {
            if( *(PUSHORT)pMem == 0x75FF && *(PUSHORT)(pMem+3) == 0x15FF  && *(pMem-5) == 0x68 )
            {
                Offset  = *(PULONG)(pMem-4) - (ULONG)ImageBase;               
                break;
            }
        }
    }
     
    return Offset;
}
 
ULONG NTAPI
GetOffsetForSpecialText(
    IN PVOID ImageBase,
    IN PCSTR szText
    )
{
    ULONG   Offset = 0;
    PUCHAR  pMem   = (PUCHAR)ImageBase;
    PUCHAR  pLim   = (PUCHAR)ImageBase + 0x400;
     
    while( pMem < pLim )
    {
        if( _stricmp( szText, pMem) == 0 )
        {
            Offset = (ULONG)(pMem-(PUCHAR)ImageBase);
            break;
        }
         
        pMem++;
    }   
     
    return Offset;
}
 
PVOID NTAPI
TlBuildNtFunc(
    IN ULONG ServiceId
    )
{
    PVOID   NtFunc = NULL;
    PVOID   pfn_KiSystemService;
    PVOID   pfn_ZwQueryKey;       
    UNICODE_STRING RoutineName;
         
    RtlInitUnicodeString( &RoutineName, L"ZwQueryKey" );       
    pfn_ZwQueryKey = MmGetSystemRoutineAddress( &RoutineName );
     
    if( pfn_ZwQueryKey )
    {
        NtFunc = ExAllocatePoolWithTag( NonPagedPool, 32, ' dmC');        
        if( NtFunc )
        {
            (PUCHAR)pfn_KiSystemService = (PUCHAR)pfn_ZwQueryKey + 12 + 5 + *(PULONG)((PUCHAR)pfn_ZwQueryKey + 12 + 1);
             
            RtlFillMemory( NtFunc, 32, 0xCC );       
            RtlMoveMemory( NtFunc, pfn_ZwQueryKey, 20 );
 
            *(PULONG)((PUCHAR)NtFunc + 12 + 1 ) = (ULONG)((PUCHAR)pfn_KiSystemService - ((PUCHAR)NtFunc + 12 + 5));
            *(PULONG)((PUCHAR)NtFunc + 1 ) = ServiceId;
        }    
    }
     
    return NtFunc;
}
 
BOOLEAN NTAPI
TlCheckFileExist(
    IN PUNICODE_STRING FileName
)
{
    OBJECT_ATTRIBUTES   ObjectAttributes = {0};
    IO_STATUS_BLOCK     IoStatusBlock    = {0};
    HANDLE              FileHandle       = NULL;
    NTSTATUS            Status           = STATUS_INVALID_PARAMETER;
 
    InitializeObjectAttributes( &ObjectAttributes,
                                FileName,
                                OBJ_KERNEL_HANDLE|OBJ_CASE_INSENSITIVE,
                                NULL,
                                NULL );
 
    Status = ZwOpenFile (  &FileHandle,
                            FILE_GENERIC_READ,
                            &ObjectAttributes,
                            &IoStatusBlock,
                            FILE_SHARE_READ|FILE_SHARE_WRITE,
                            FILE_NON_DIRECTORY_FILE );
                     
    if ( NT_SUCCESS( Status ) )
    {     
        ZwClose( FileHandle );
    }
     
    return NT_SUCCESS( Status );
}
 
VOID
LoadImageNotifyRoutine(
    IN PUNICODE_STRING  FullImageName,
    IN HANDLE           ProcessId,
    IN PIMAGE_INFO      ImageInfo
    )
{      
    if( !pfn_XxxDispatchAPC || !pfn_LoadLibraryA || !pszText_Kernel32 )
    {       
        if( !pfn_LoadLibraryA || !pszText_Kernel32 )
        {
            if( RtlCompareUnicodeString( FullImageName, &gModuleName[2], TRUE ) == 0 )
            {
                (PUCHAR)pfn_LoadLibraryA  = (PUCHAR)ImageInfo->ImageBase + Offset_LoadLibraryA;
                (PUCHAR)pszText_Kernel32  = (PUCHAR)ImageInfo->ImageBase + Offset_szText;
                 
                if( Offset_BaseDispatchAPC )
                {
                    (PUCHAR)pfn_XxxDispatchAPC= (PUCHAR)ImageInfo->ImageBase + Offset_BaseDispatchAPC;
                }
            }
        }
         
        if( Offset_RtlDispatchAPC && !pfn_XxxDispatchAPC )
        {
            if( RtlCompareUnicodeString( FullImageName, &gModuleName[0], TRUE ) == 0 )
            {
                (PUCHAR)pfn_XxxDispatchAPC= (PUCHAR)ImageInfo->ImageBase + Offset_RtlDispatchAPC;
            }
        }
    }
    else if( pfn_NtQueueApcThread )
    {
        if( RtlCompareUnicodeString( FullImageName, &gModuleName[4], TRUE ) == 0 )
        {
            pfn_NtQueueApcThread(
                    ZwCurrentThread(),
                    pfn_XxxDispatchAPC,
                    pfn_LoadLibraryA,
                    pszText_Kernel32,
                    NULL );
        }
    }
}
 
VOID DriverUnload(IN PDRIVER_OBJECT DriverObject)
{
    PsRemoveLoadImageNotifyRoutine( LoadImageNotifyRoutine );
     
    ExFreePool( pfn_NtQueueApcThread );
}
 
NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject,IN PUNICODE_STRING RegistryPath)
{   
    NTSTATUS Status = 0; 
    ULONG ServiceId = -1;    
    PVOID ImageBase_Ntdll ;
    PVOID ImageBase_Kernel;   
    PVOID pfn;
     
    ImageBase_Ntdll = TlLoadSysPEtoMem( &gModuleName[0] );
    if( ImageBase_Ntdll )
    {
        pfn = TlGetProcAddress( ImageBase_Ntdll, "NtQueueApcThread" );
        if( pfn )
        {
            ServiceId = *(PULONG)((PUCHAR)pfn + 1 );
        }
         
        if( *NtBuildNumber == 7601 )
        {
            pfn = TlGetProcAddress( ImageBase_Ntdll, (PUCHAR)7 );
            if( pfn )
            {
                Offset_RtlDispatchAPC = (ULONG)pfn - (ULONG)ImageBase_Ntdll;
            } 
        }     
         
        ExFreePool( ImageBase_Ntdll );
    }
     
    ImageBase_Kernel = TlLoadSysPEtoMem( &gModuleName[1] );
    if( ImageBase_Kernel )
    {
        PIMAGE_NT_HEADERS NtHdrs = RtlImageNtHeader( ImageBase_Kernel );
         
        if( *NtBuildNumber == 2600 )
        {
            pfn = TlGetProcAddress( ImageBase_Kernel, "QueueUserAPC" );
            if( pfn )
            {
                Offset_BaseDispatchAPC = GetOffsetForXxxDispatchApc( pfn, (PVOID)NtHdrs->OptionalHeader.ImageBase);
            }
        }
         
        pfn = TlGetProcAddress( ImageBase_Kernel, "LoadLibraryA" );
        if( pfn )
        {
            Offset_LoadLibraryA = (ULONG)pfn - (ULONG)ImageBase_Kernel;
        }       
         
        Offset_szText = GetOffsetForSpecialText( (PUCHAR)ImageBase_Kernel, "text" );
          
        ExFreePool( ImageBase_Kernel );
    }
     
    Status = STATUS_NOT_SUPPORTED;
    if( Offset_LoadLibraryA && Offset_szText && (Offset_BaseDispatchAPC || Offset_RtlDispatchAPC) && ServiceId != -1 )
    {
        Status = STATUS_NO_SUCH_FILE;
        //确保文件"systemroot\system\text.dll"存在
        if( TlCheckFileExist( &gModuleName[3] ) )
        {
            pfn_NtQueueApcThread = TlBuildNtFunc( ServiceId ); 
        }     
    }
     
    if( pfn_NtQueueApcThread )
    {
        Status = PsSetLoadImageNotifyRoutine( LoadImageNotifyRoutine );;
    }
     
    if( !NT_SUCCESS(Status) && pfn_NtQueueApcThread )
    {
        ExFreePool( pfn_NtQueueApcThread );
    }
     
    DriverObject->DriverUnload = DriverUnload;
    return Status;
}
APC注入(QueueUserAPC)--Ring3
KOOKNUT的博客
05-19 1370
APC英文全称(Asynchronous Procedure Call)，我们一般译为异步过程调用。它是一种Windows的软中断机制，一般分为两种： 内核APC：由系统产生的APC。 用户APC：由应用层程序产生的APC。 当一个线程从等待状态(线程调用SleepEx、SignalObjectAndWait、WaitForSingleObjectEx、WaitForMultipleObjectsEx等函数是会进入可唤醒状态)中苏醒时，线程会检查有没有APC需要去执行，如果有APC，则去执行这些异步过程
潜伏回调：APC注入在红队演练中的多样化实现
最新发布
仇辉攻防的博客
05-21 681
本文深入探讨基于 Windows 异步回调机制的 APC 注入技术，结合自身线程、合法线程、EarlyBird 及自建线程四种方式，逐一分析其在安全演练中对抗检测、提升隐蔽性的策略与效果。
DLL注入-APC注入
天使也掉毛
11-25 5803
DLL注入-APC注入
易语言移植的APC注入源码
06-06
易语言移植的APC注入源码是一个涉及到Windows操作系统编程、进程通信和恶意代码技术的知识点。APC（Asynchronous Procedure Call）是Windows API提供的一种异步处理机制，常用于线程间的通信。在易语言中实现APC注入...
C++ APC注入.zip
08-06
C++ APC注入是一种高级的进程通信技术，常用于在Windows操作系统中实现远程线程注入。在本案例中，APC（Asynchronous Procedure Call）注入被用作替代方法，因为直接的DLL注入可能导致某些系统，如Win7，在特定情况...
易语言移植的APC注入
07-22
在这个场景中，"易语言移植的APC注入"指的是将APC注入技术应用到易语言的环境中，使得开发者能够利用易语言编写相关的注入程序。 APC注入的基本原理是通过系统调用，将一个函数（通常是一个DLL中的函数）添加到另一...
易语言移植的APC注入源码-易语言
06-13
"易语言移植的APC注入源码"是一个针对易语言的高级教程，主要涉及到Windows系统编程中的异步过程调用（Asynchronous Procedure Calls, APC）技术。 APC是Windows操作系统内核中的一种机制，它允许在用户模式下的...
APC注入测试源码C++
12-19
一个对APC注入进行学习测试的例子，可以在用户态下执行。但是对系统进程仍无法进行注入，不清楚是权限问题还是其他的问题。 工程在vs2012下编译测试成功。 共有三个工程 1、ApcInject 实现Apc注入功能 2、InjectTest...
APC注入实现代码
07-30
纯Ring0 + Ring3 交互
第五章 进程注入之APC注入（附源码）
test\\的博客
12-01 2564
目录前言函数介绍QueueUserAPC函数语法参数返回值示例程序代码DLL代码测试原理学习 前言 APC注入可以让一个线程在它正常的执行路径运行之前执行一些其他的代码，每一个线程都有一个附加的APC队列，他们在线程处于可警告的时候才被处理；如果程序在线程可警告等待状态时候排入一个APC队列，那么线程将开始执行APC函数，恶意代码则可以设置APC函数抢占可警告等待状态的线程。 函数介绍 QueueUserAPC函数 把一个APC对象加入到指定线程的APC队列中。
内核中通过给线程插apc注入dll
sgzwiz的专栏
03-03 7950
void ApcLoadDll(PVOID NormalContext, PVOID SystemArgument1, PVOID SystemArgument2); void ApcLoadDllEnd(); PMDL pMdl = NULL; void ApcKernelRoutine( IN struct _KAPC *Apc, IN OUT PKNORMAL_ROUTINE
进程注入系列一之APC注入
weixin_46539164的博客
04-28 3935
什么是APC APC 是一个简称，全称为Asynchronous Procedure Call，叫异步过程调用，是指函数在特定线程中被异步执行，在操作系统中，APC是一种并发机制。 MSDN解释为： 相关函数 QueueUserApc：函数作用,添加制定的异步函数调用(回调函数)到执行的线程的APC队列中 APCproc：函数作用: 回调函数的写法. 核心函数 QueueUserAPC DWORD QueueUserAPC( PAPCFUNCpfnAPC, // APC function HANDLEhT
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值