笔记分享:各种注入方法Windows API组合 – 作者:lewfahr

整理笔记时发现之前留下的资料,抛砖引玉,分享给大家。

常见注入方法 OpenProcess
VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
DLL注入 LoadLibrary/LoadLibraryEx
GetProcAddress
SetWindowsHookEx
钩子注入
APC注入 CreateToolhelp32Snapshot
Process32First
Thread32First
Thread32Next
Process32Next
OpenProcess
VirtualAllocEx
WriteProcessMemory
QueueUserAPC/NtQueueApcThread
VirtualFreeEx
CloseHandle
异步过程调用中断
Atom Bombing注入 CreateToolhelp32Snapshot
Thread32First
Thread32Next,
OpenThread
CreateEvent
DuplicateHandle
NtQueueApcThread
QueueUserAPC
GetModuleHandle
GetProcAddress
SetEvent
GetCurrentProcess
SleepEx
WaitForMultipleObjectsEx
MsgWaitForMultipleObjectsEx
CloseHandle
据说可以绕过所有Windows AV查杀机制 
ALPC注入 NtQuerySystemlnformation
NtDuplicateObject/ZwDuplicateObject
GetCurrentProcess
NtQueryObject
NtClose
RtllnitUnicodeString
NtConnectPort
VirtualAllocEx
WriteProcessMemory
CopyMemory
ReadProcessMemory
VirtualFreeEx
VirtualQueryEx
GetMappedFileName,
OpenProcess
CloseHandle
GetSystemlnfo
Advanced/Asynchronous Local Procedure Call
LOCKPOS CreateFileMappingW
MapViewOfFile
RtlAllocateHeap
NtCreateSection
NtMapViewOfSection
NtCreateThreadEx
与僵尸网络Flokibot使用类似的注入技术
Hollowing注入 CreateProcess
NtQueryProcesslnformation
ReadProcessMemory
GetModuleHandle
GetProcAddress
ZwUnmapViewOfSection/NtUnmapViewOfSection
VirtualAllocEx
WriteProcessMemory
VirtualProtectEx
SetThreadContext
ResumeThread
进程替换和RunPE,见封装工具:RISCyPacker
DOPPELGANGING CreateFileTransacted
WriteFlle
NtCreateSection
RollbackTransaction
NtCreateProcessEx
RtICreateProcessParametersEx
VirtualAllocEx
WriteProcessMemory
NtCreateThreadEx
NtResumeThread
类似Hollowing,参考:https://www.blackhat.com/docs/eu-17/materials/eu-17-Liberman-Lost-In-Transaction-Process-Doppelganging.pdf
REFLECTIVE反射注入 CreateFileA
HeapAlloc
OpenProcessToken
OpenProcess
VirtualAlloc
GetProcAddress
LoadRemoteLibraryR/LoadLibrary
HeapFree
CloseHandle
也可通过封装ReflectiverLoader实现
线程执行劫持 RtlAdjustPrivilege
OpenProcess
CreateToolhelp32Snapshot
Thread32First
Thread32Next
CloseHandle
VirtualAllocEx
OpenThread
VirtualFree/VirtualFreeEx
SuspendThread
GetThreadContext
VirtualAlloc
WriteProcessMemory
SetThreadContext
ResumeThread

其实现方法可在github上搜索源码,还有一些常见的方法(如注册表Appinit_DLL, AppCertDlls, IFEO)和不常见的hook方法(如EWMI),后期再整理…

来源:freebuf.com 2020-11-27 10:00:13 by: lewfahr

© 版权声明
THE END
喜欢就支持一下吧
点赞0
分享
评论 抢沙发

请登录后发表评论