Repository navigation
Expand file tree
/
Copy pathShellcoders18-vtinject-cpp.txt
More file actions
128 lines (89 loc) · 3.19 KB
/
Copy pathShellcoders18-vtinject-cpp.txt
File metadata and controls
128 lines (89 loc) · 3.19 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
/*
The Shellcoder's Handbook: Discovering and Exploiting Security Holes
Jack Koziol, David Litchfield, Dave Aitel, Chris Anley,
Sinan Eren, Neel Mehta, Riley Hassell
Publisher: John Wiley & Sons
ISBN: 0764544683
Chapter 18: Tracing for Vulnerabilities
VTInject.cpp
Please send comments/feedback to jack@infosecinstitute.com or visit http://www.infosecinstitute.com
*/
/***********************************************************************************\
VTInject.cpp
VTInject will adjust the privilege of the current process so we can access processes operating as LOCALSYSTEM. Once the privileges are adjusted VTInject will open a handle to the target process id (PID) and load our VulnTrace.DLL into the process.
\***********************************************************************************/
#include <stdio.h>
#include <windows.h>
#include "detours.h"
#define DLLNAME "\\VulnTrace.dll"
int CDECL inject_dll(DWORD nProcessId, char *szDllPath)
{
HANDLE token;
TOKEN_PRIVILEGES tkp;
HANDLE hProc;
if(OpenProcessToken( GetCurrentProcess(),
TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY,
&token) == FALSE)
{
fprintf(stderr, "OpenProcessToken Failed: 0x%X\n", GetLastEr-ror());
return(-1);
}
if(LookupPrivilegeValue( NULL,
"SeDebugPrivilege",
&tkp.Privileges[0].Luid) == FALSE)
{
fprintf(stderr, "LookupPrivilegeValue failed: 0x%X\n", GetLas-tError());
return(-1);
}
tkp.PrivilegeCount = 1;
tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
if(AdjustTokenPrivileges( token, FALSE, &tkp, 0, NULL, NULL) == FALSE)
{
fprintf(stderr,
“AdjustTokenPrivileges Failed: 0x%X\n",
GetLastError());
return(-1);
}
CloseHandle(token);
hProc = OpenProcess(PROCESS_ALL_ACCESS, FALSE, nProcessId);
if (hProc == NULL)
{
fprintf(stderr,
"[VTInject]: OpenProcess(%d) failed: %d\n",
nProcessId, GetLastError());
return(-1);
}
fprintf(stderr,
"[VTInject]: Loading %s into %d.\n",
szDllPath, nProcessId);
fflush(stdout);
if (!DetourContinueProcessWithDllA(hProc, szDllPath))
{
fprintf(stderr,
"DetourContinueProcessWithDll(%s) failed: %d",
szDllPath, GetLastError());
return(-1);
}
return(0);
}
int main(int argc, char **argv)
{
char path[1024];
int plen;
if(argc!= 2)
{
fprintf(stderr,
"\n-= VulnTrace =-\n\n"
"\tUsage: %s <process_id>\n\n"
,argv[0]);
return(-1);
}
plen = GetCurrentDirectory(sizeof(path)-1, path);
strncat(path, DLLNAME, (sizeof(path)-plen)-1);
if(inject_dll(atoi(argv[1]), path))
{
fprintf(stderr, "Injection Failed\n");
return(-1);
}
return(0);
};