mirror of
https://github.com/ayoubfaouzi/al-khaser
synced 2026-06-06 15:14:33 +00:00
Lord Noteworthy
101 lines
2.9 KiB
C++
101 lines
2.9 KiB
C++
#include "QueueUserAPC.h"
|
|
|
|
|
|
BOOL QueueUserAPC_Injection()
|
|
{
|
|
// Some vars
|
|
TCHAR lpDllName[] = _T("InjectedDLL.dll");
|
|
TCHAR lpDllPath[MAX_PATH];
|
|
HMODULE hKernel32;
|
|
HANDLE hProcess = NULL;
|
|
HANDLE hThread = NULL;
|
|
DWORD dwProcessId, dwThreadId;
|
|
FARPROC LoadLibraryAddress;
|
|
LPVOID lpBaseAddress;
|
|
BOOL bStatus;
|
|
DWORD dResult;
|
|
|
|
/* Get Process ID from Process name */
|
|
dwProcessId = GetProcessIdFromName(_T("notepad.exe"));
|
|
if (dwProcessId == NULL)
|
|
return FALSE;
|
|
_tprintf(_T("\t[+] Getting proc id: %d\n"), dwProcessId);
|
|
|
|
/* Obtain a handle the process */
|
|
hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwProcessId);
|
|
if (hProcess == NULL) {
|
|
print_last_error(_T("OpenProcess"));
|
|
return FALSE;
|
|
}
|
|
|
|
/* Get thread id from process id */
|
|
dwThreadId = GetMainThreadId(dwProcessId);
|
|
if (hThread == NULL)
|
|
return FALSE;
|
|
_tprintf(_T("\t[+] Getting main thread id of proc id: %d\n"), dwThreadId);
|
|
|
|
/* Getting thread hanlle from thread id */
|
|
hThread = OpenThread(THREAD_ALL_ACCESS, FALSE, dwThreadId);
|
|
|
|
/* Obtain a handle to kernel32 */
|
|
hKernel32 = GetModuleHandle(_T("kernel32.dll"));
|
|
if (hKernel32 == NULL) {
|
|
print_last_error(_T("GetModuleHandle"));
|
|
return FALSE;
|
|
}
|
|
/* Get LoadLibrary address */
|
|
_tprintf(_T("\t[+] Looking for LoadLibrary in kernel32\n"));
|
|
LoadLibraryAddress = GetProcAddress(hKernel32, "LoadLibraryW");
|
|
if (LoadLibraryAddress == NULL) {
|
|
print_last_error(_T("GetProcAddress"));
|
|
return FALSE;
|
|
}
|
|
_tprintf(_T("\t[+] Found at 0x%08x\n"), (UINT)LoadLibraryAddress);
|
|
|
|
/* Get the full path of the dll */
|
|
GetFullPathName(lpDllName, MAX_PATH, lpDllPath, NULL);
|
|
_tprintf(_T("\t[+] Full DLL Path: %s\n"), lpDllPath);
|
|
|
|
// The low-order DWORD of the maximum size of the file mapping object.
|
|
DWORD dwSize = _tcslen(lpDllPath) * sizeof(TCHAR);
|
|
|
|
/* Allocate memory into the remote process */
|
|
_tprintf(_T("\t[+] Allocating space for the path of the DLL\n"));
|
|
lpBaseAddress = VirtualAllocEx(hProcess, NULL, dwSize, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
|
|
if (lpBaseAddress == NULL) {
|
|
print_last_error(_T("VirtualAllocEx"));
|
|
return FALSE;
|
|
}
|
|
|
|
/* Write to the remote process */
|
|
printf("\t[+] Writing into the current process space at 0x%08x\n", (UINT)lpBaseAddress);
|
|
bStatus = WriteProcessMemory(hProcess, lpBaseAddress, lpDllPath, dwSize, NULL);
|
|
if (bStatus == NULL) {
|
|
print_last_error(_T("WriteProcessMemory"));
|
|
return FALSE;
|
|
}
|
|
|
|
/* Injection Happen here */
|
|
dResult = QueueUserAPC((PAPCFUNC)LoadLibraryAddress, hThread, (ULONG_PTR)lpBaseAddress);
|
|
if (dResult == NULL) {
|
|
print_last_error(_T("QueueUserAPC"));
|
|
return FALSE;
|
|
}
|
|
|
|
else {
|
|
_tprintf(_T("Remote thread has been created successfully ...\n"));
|
|
WaitForSingleObject(hThread, INFINITE);
|
|
|
|
// Clean up
|
|
CloseHandle(hProcess);
|
|
CloseHandle(hThread);
|
|
VirtualFreeEx(hProcess, lpBaseAddress, dwSize, MEM_RELEASE);
|
|
return TRUE;
|
|
}
|
|
}
|
|
|
|
|
|
|
|
|
|
|