Создание удаленного потока

#include "windows.h"
#include "stdio.h"
 
#define LOG_ERR(Func,...) printf("[ERROR]\t" __VA_ARGS__); printf("\r\n" __FUNCTION__ "\t" #Func "  Last error = 0x%.8lx.\r\n", GetLastError())
 
int main(int argc, char *argv[]) 
{
    char* buffer = "h:\\_AVZ\\Наши разработки\\ClearLNK 2.0(2)\\1\\GetAppID.dll";
 
    system("tasklist.exe /nh | sort /r");
 
    printf("\r\nEnter PID: ");
 
    // Get process handle passing in the process ID.
 
    int procID;
    scanf_s("%i", &procID);
 
    HANDLE hProc = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ | PROCESS_VM_WRITE | PROCESS_VM_OPERATION | PROCESS_CREATE_THREAD, FALSE, procID);
    if (hProc == NULL) {
        LOG_ERR(OpenProcess, "The specified process couldn't be found.");
        goto ErrorExit;
    }
 
    // Get address of the LoadLibrary function.
    
    LPVOID addr = (LPVOID)GetProcAddress(GetModuleHandle(L"kernel32.dll"), "LoadLibraryA");
    if (addr == NULL) {
        LOG_ERR(GetProcAddress, "The LoadLibraryA function was not found inside kernel32.dll library.");
        goto ErrorExit;
    }
        
    // Allocate new memory region inside the process's address space.
    
    LPVOID arg = (LPVOID)VirtualAllocEx(hProc, NULL, strlen(buffer), MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);
    if (arg == NULL) {
        LOG_ERR(VirtualAllocEx, "The memory could not be allocated inside the chosen process.");
        goto ErrorExit;
    }
    
    // Write the argument to LoadLibraryA to the process's newly allocated memory region.
    
    int n = WriteProcessMemory(hProc, arg, buffer, strlen(buffer), NULL);
    if (n == 0) {
        LOG_ERR(WriteProcessMemory, "Error: there was no bytes written to the process's address space.");
        goto ErrorExit;
    }
 
    // Inject our DLL into the process's address space.
    
    HANDLE threadID = CreateRemoteThread(hProc, NULL, 0, (LPTHREAD_START_ROUTINE)addr, arg, NULL, NULL);
    if (threadID == NULL) {
        LOG_ERR(CreateRemoteThread, "The remote thread could not be created");
    } else {
        printf("Success: the remote thread was successfully created.\r\n");
    }
    
    // Close the handle to the process, becuase we've already injected the DLL.
    
    CloseHandle(hProc);
    getchar();
    getchar();
 
    return EXIT_SUCCESS;
 
ErrorExit:
 
    if (hProc) CloseHandle(hProc);
    getchar();
    getchar();
 
    return EXIT_FAILURE;
}

#include "stdafx.h"
#include "windows.h"
#include "stdio.h"
#include "Shobjidl.h"
 
BOOL APIENTRY DllMain( HMODULE hModule,
                       DWORD  ul_reason_for_call,
                       LPVOID lpReserved
                     )
{
    PWSTR AppID;
    HRESULT hRes;
    FILE *file;
    fopen_s(&file, "h:\\_AVZ\\Наши разработки\\ClearLNK 2.0(2)\\1\\my.log", "a+");
 
    switch (ul_reason_for_call)
    {
    case DLL_PROCESS_ATTACH:
        fprintf(file, "DLL process attach function called.\n");
        
        hRes = GetCurrentProcessExplicitAppUserModelID(&AppID);
 
        if (S_OK == hRes) {
            fprintf(file, "\r\n%ls\r\n", AppID);
        } else {
            fprintf(file, "Cannot obtain Current process' AppUserModelID. HRESULT code = 0x%.8lx\r\n", hRes);
        }
        break;
    case DLL_THREAD_ATTACH:
        fprintf(file, "DLL thread attach function called.\n");
        break;
    case DLL_THREAD_DETACH:
        fprintf(file, "DLL thread detach function called.\n");
        break;
    case DLL_PROCESS_DETACH:
        fprintf(file, "DLL process detach function called.\n");
        break;
    }
    
    fclose(file);
 
    return TRUE;
}

include "windows.h"
#include "stdio.h"
#include "Shobjidl.h"
 
#define LOG_ERR(Func,...) printf("[ERROR]\t" __VA_ARGS__); printf("\r\n" __FUNCTION__ "\t" #Func "  Last error = 0x%.8lx.\r\n", GetLastError())
 
int setPrivilege(LPCWSTR);
 
 
int main(int argc, char *argv[]) 
{
    // Lib to inject
    char* strLib = "h:\\_AVZ\\Наши разработки\\ClearLNK 2.0(2)\\1\\InjectDll\\Release\\InjectDll.dll";
    //char* strLib = "c:\\users\\alex\\desktop\\InjectDll.dll";
 
    // Process & PID list
 
    system("tasklist.exe /nh | sort /r");
 
    // Prepare low integrity level folder
 
    system("md c:\\temp");
    system("icacls c:\\temp /setintegritylevel (OI)(CI)L");  // Object & container inherit, Low IL
 
    // Obtain Debug privileges
 
    if (0 == setPrivilege(SE_DEBUG_NAME))
        printf("Success with obtain SE_DEBUG privilege.\r\n");
 
    // Test working with UMID
 
    if (S_OK == SetCurrentProcessExplicitAppUserModelID(L"Alex.Dragokas.Injection.Test"))
        printf("Success with setting of AppUserModelID.\r\n");
    
    PWSTR AppID = NULL;
    HRESULT hRes = GetCurrentProcessExplicitAppUserModelID(&AppID);
 
    if (S_OK == hRes) {
        printf("\r\nAppUMID: %ls\r\n", AppID);
    } else {
        printf("Cannot obtain Current process' AppUserModelID. HRESULT code = 0x%.8lx", hRes);
    }
    
    printf("\r\nEnter PID: ");
 
    int procID;
    scanf_s("%i", &procID);
 
    // Get process handle passing in the process ID.
 
    HANDLE hProc = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ | PROCESS_VM_WRITE | PROCESS_VM_OPERATION | PROCESS_CREATE_THREAD, FALSE, procID);
    if (hProc == NULL) {
        LOG_ERR(OpenProcess, "The specified process couldn't be found.");
        goto ErrorExit;
    }
 
    // Get address of the LoadLibrary function.
    
    LPVOID addrLib = (LPVOID)GetProcAddress(GetModuleHandle(L"kernel32.dll"), "LoadLibraryA");
    if (addrLib == NULL) {
        LOG_ERR(GetProcAddress, "The LoadLibraryA function was not found inside kernel32.dll library.");
        goto ErrorExit;
    }
        
    // Allocate new memory region inside the process' address space.
    
    LPVOID lpMem = (LPVOID)VirtualAllocEx(hProc, NULL, strlen(strLib), MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);
    if (lpMem == NULL) {
        LOG_ERR(VirtualAllocEx, "The memory could not be allocated inside the chosen process.");
        goto ErrorExit;
    }
    
    // Write the argument to LoadLibraryA to the process's newly allocated memory region.
    
    if (0 == WriteProcessMemory(hProc, lpMem, strLib, strlen(strLib), NULL)) 
    {
        LOG_ERR(WriteProcessMemory, "Error: there was no bytes written to the process's address space.");
        goto ErrorExit;
    }
 
    // Inject our DLL into process' address space.
    
    HANDLE hThread = CreateRemoteThread(hProc, NULL, 0, (LPTHREAD_START_ROUTINE)addrLib, lpMem, NULL, NULL);
    if (hThread == NULL) {
        LOG_ERR(CreateRemoteThread, "The remote thread could not be created");
    } else {
        LOG_ERR(CreateRemoteThread, "Success: the remote thread was successfully created.\r\n");
        CloseHandle(hThread);
    }
    
    CloseHandle(hProc);
    getchar();
    getchar();
 
    return EXIT_SUCCESS;
 
ErrorExit:
 
    if (hProc) CloseHandle(hProc);
    getchar();
    getchar();
 
    return EXIT_FAILURE;
}
 
int setPrivilege(LPCWSTR privilege_name) {
    LUID    luid;
    HANDLE  hToken;
    DWORD   dwSize = sizeof (TOKEN_PRIVILEGES);
    TOKEN_PRIVILEGES tp;
    TOKEN_PRIVILEGES oldtp;
 
    if (!OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES, &hToken)) {
        LOG_ERR(OpenProcessToken);
        return 1;
    }
 
    if (!LookupPrivilegeValue(NULL, privilege_name, &luid)) {
        LOG_ERR(LookupPrivilege);
        CloseHandle(hToken);
        return 1;
    }
 
    ZeroMemory(&tp, sizeof (tp));
    tp.PrivilegeCount = 1;
    tp.Privileges[0].Luid = luid;
    tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
 
    if (!AdjustTokenPrivileges(hToken, FALSE, &tp, sizeof(TOKEN_PRIVILEGES), &oldtp, &dwSize)) {
        LOG_ERR(AdjustTokenPrivileges);
        CloseHandle(hToken);
        return 1;
    }
    CloseHandle(hToken);
    return 0;
}

#include <windows.h>
#include <process.h>
#include <stdio.h>
#include <Shobjidl.h>
 
unsigned __stdcall Thread(void *ArgList) {
    PWSTR AppID;
    FILE *file;
 
    // Mark for everyone that this library execution is alive
 
    CreateEventW(NULL, TRUE, TRUE, L"Browser.InjectDll.Event.Thread.Alive");
    CreateMutexW(NULL, TRUE, L"Browser.InjectDll.Mutex.Thread.Alive");
 
    SetEnvironmentVariable(L"A_MyEnvVariable", L"Value");
 
    // Obtain UMID of process
 
    HRESULT hRes = GetCurrentProcessExplicitAppUserModelID(&AppID);
 
    // Window to be receive our message
 
    wchar_t* WindowTitle = L"Get_WM_COPYDATA";
 
    // Send data via WM_COPYDATA
 
    HWND hwnd = FindWindowW(NULL, WindowTitle);
 
    if (0 != hwnd)
    {
        COPYDATASTRUCT cds;
        cds.dwData = 1;
        cds.cbData = sizeof(PWSTR) * (wcslen(AppID) + 1);
        cds.lpData = AppID;
        SendMessage(hwnd, WM_COPYDATA, (WPARAM)hwnd, (LPARAM)(LPVOID)&cds);
        CloseHandle(hwnd);
    }
 
    // Send data via file
 
    HANDLE hFile = CreateFileW(L"c:\\users\\alex\\AppData\\LocalLow\\AppID.log", GENERIC_WRITE, FILE_SHARE_READ, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
    if (hFile) 
        CloseHandle(hFile);
 
    fopen_s(&file, "c:\\temp\\AppID.log", "a+");
 
    if (S_OK == hRes) {
        fprintf(file, "\r\n%ls\r\n", AppID);
    } else {
        fprintf(file, "Cannot obtain Current process' AppUserModel.ID. HRESULT code = 0x%.8lx\r\n", hRes);
    }
    fclose(file);
 
    return 0;
}
 
BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) {
    unsigned ThreadId;
    HANDLE hThread;
    
    if (DLL_PROCESS_ATTACH == ul_reason_for_call) {
        hThread = (HANDLE)_beginthreadex(NULL, 0, Thread, 0, 0, &ThreadId);
    }
    return TRUE;
}