Nachtwacht #1

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74

#include <iostream>
#include <windows.h>
#include <tlhelp32.h>
#include <Win32Error.h>
#define MAXWAIT 10000

void EnableDebugPriv(void){
    HANDLE hToken;
    LUID sedebugnameValue;
    TOKEN_PRIVILEGES tkp;
    if(!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken)){
        printf("OPT() failed, gle = %d\n", GetLastError());
        return;
    }
    if(!LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &sedebugnameValue)){
        printf("LPV() failed, gle = %d\n", GetLastError());
        CloseHandle(hToken);
        return;
    }
    tkp.PrivilegeCount = 1;
    tkp.Privileges[0].Luid = sedebugnameValue;
    tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
    if(!AdjustTokenPrivileges(hToken, FALSE, &tkp, sizeof(tkp), NULL, NULL)){
        printf("ATP() failed, gle = %d\n", GetLastError());
    }
    CloseHandle(hToken);
}

int main(){
    SetConsoleTitle("DLL Injection");
    std::string dll = "DLL.dll";
    HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    PROCESSENTRY32 entry;
    ZeroMemory(&entry, sizeof(entry));
    entry.dwSize = sizeof(entry);
    if(Process32First(snapshot, &entry) == TRUE){
        while(Process32Next(snapshot, &entry) == TRUE){
            if(GetLastError() != 0){
                break;
            }
            if(_stricmp(entry.szExeFile, "fokforum.exe") == 0){
                EnableDebugPriv();
                HANDLE hVictim = OpenProcess(PROCESS_ALL_ACCESS, FALSE, entry.th32ProcessID);
                if(hVictim == 0){
                    printf("Couldn't find Window.\n");
                    std::cin.get();
                    return 1;
                }
                else{
                    printf("Found PID:\t\t\t\t%d\nFound Window Handle:\t\t\t%d\n", entry.th32ProcessID, hVictim);
                }
                HMODULE hLocKernel32 = GetModuleHandle("Kernel32");
                FARPROC hLocLoadLibrary = GetProcAddress(hLocKernel32, "LoadLibraryA");
                dll += '\0';
                LPVOID hRemoteMem = VirtualAllocEx(hVictim, NULL, dll.size(), MEM_COMMIT, PAGE_READWRITE);
                DWORD numBytesWritten;
                WriteProcessMemory(hVictim, hRemoteMem, dll.c_str(), dll.size(), &numBytesWritten);
                HANDLE hRemoteThread = CreateRemoteThread(hVictim, NULL, 0, (LPTHREAD_START_ROUTINE)hLocLoadLibrary, hRemoteMem, 0, NULL);
                printf("\nError \n%d\n%s\n", GetLastError(), CWin32Error());
                std::cout << hRemoteThread << std::endl;
                bool res = false;
                if(hRemoteThread){
                    res = (bool)(WaitForSingleObject(hRemoteThread, MAXWAIT) != WAIT_TIMEOUT);
                }
                VirtualFreeEx(hVictim, hRemoteMem, 0, MEM_RELEASE);
                printf("\nError \n%d\n%s\n", GetLastError(), CWin32Error());
                CloseHandle(hVictim);
            }
        }
    }
    CloseHandle(snapshot);
    std::cin.get();
    return 0;
}