无模块注入示例

#include <Windows.h>
typedef struct _REMOTE_PARAMETERS
{
HWND hwnd;
LPSTR lpszText;
LPSTR lpszCaption;
int nType;
}REMOTE_PARAMETERS,*PREMOTE_PARAMETERS;

//提升权限
BOOL GetdebugPrivilege()
{
BOOL bResult = FALSE;
HANDLE hToken;
TOKEN_PRIVILEGES TokenPrivileges;

if (OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES, &hToken))
{
TokenPrivileges.PrivilegeCount = 1;
LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &TokenPrivileges.Privileges[0].Luid);

TokenPrivileges.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
bResult = AdjustTokenPrivileges(hToken, FALSE, &TokenPrivileges, sizeof(TOKEN_PRIVILEGES), NULL, NULL);
CloseHandle(hToken);
}

return bResult;
}
int _tmain(int argc, _TCHAR* argv[])
{
DWORD dwoffset = 0;
DWORD dwsize = 0;
_asm jmp LOOP2
_asm
{
LOOP1:
mov eax,[esp+4]			//取地址，即指向PREMOTE_PARAMETERS的指针
mov ebx,[eax + 0xC]
push ebx
mov ebx,[eax+8]
push ebx
mov ebx,[eax+4]
push ebx
mov ebx,dword ptr[eax]
push ebx
mov eax, 0X75c4ea71	//硬编码 MessageBoxA函数地址
push 0X77490571			//硬编码 ExitThread函数地址
push eax
ret
// 最后两个PUSH的意思是汇编的一些技巧
// 先PUSH ExitThread的地址，再PUSH MessageBoxA的地址
// ret 是让调用者进行堆栈平衡，所以ret后，堆栈只POP最上面一个地址（即MessageBoxA）
// 也就是跳转到MessageBoxA，此时堆栈中的数据和正常调用MessageBoxA是一致的
// 最上面的返回地址是ExitThread
// MessageBoxA调用结束，跳转到ExitThread中。
LOOP2:
lea eax, LOOP1
mov dwoffset, eax
lea eax, LOOP2
sub eax, offset LOOP1
mov dwsize, eax
}

//GetdebugPrivilege();
DWORD dwThreadId;
DWORD dwNumberOfBytesWritten;
PREMOTE_PARAMETERS lpParamaters = new REMOTE_PARAMETERS;
// initialize lpParamaters
memset(lpParamaters,0,sizeof(REMOTE_PARAMETERS));
// get handle of target process
HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS,FALSE,16420);			//进程ID
// 在目标进程中分配300字节的空间
LPVOID lpszDes = VirtualAllocEx(hProcess,
0,
300,
MEM_COMMIT,
PAGE_EXECUTE_READWRITE);
printf("lpszDes: 0x%X\n", lpszDes);
// 向目标进程中写入汇编指令，起始地址为lpszDes，大小为100
WriteProcessMemory(hProcess,
lpszDes,
(char*)dwoffset,
100,
&dwNumberOfBytesWritten);	//写入代码
// 向目标进程中写入字符串数据，起始地址为lpszDes + 100，大小为100
WriteProcessMemory(hProcess,
((char*)lpszDes + 100),
"Hello QQ\r\n",
100,
&dwNumberOfBytesWritten);	//写入弹出字符串
lpParamaters->hwnd = 0;
lpParamaters->lpszText = (LPSTR)((char*)lpszDes + 100);
lpParamaters->lpszCaption = (LPSTR)((char*)lpszDes + 100);
lpParamaters->nType = MB_OKCANCEL|MB_ICONQUESTION;
// 向目标进程中写入MessageBox的参数，起始地址为lpszDes + 200，大小为结构体大小
WriteProcessMemory(hProcess,
((char*)lpszDes + 200),
lpParamaters,
sizeof(REMOTE_PARAMETERS),
&dwNumberOfBytesWritten);	//写入参数
// 在目标进程中执行刚刚注入的代码
HANDLE hRemoteThread = CreateRemoteThread(hProcess,
NULL,
0,
(LPTHREAD_START_ROUTINE)(lpszDes),
((char*)lpszDes + 200),
NULL,
&dwThreadId);
WaitForSingleObject(hRemoteThread,INFINITE);
VirtualFreeEx(hProcess, lpszDes, 0, MEM_RELEASE);
system("pause");
return 0;
}