print "[+] Universal DLL Injector by Y"
print "[+] contact : If you know me then give me a shout"
print "[+] usage: ./dll_injector.py <PID> <DLLPATH>"
print "
"
from ctypes import *
import sys,ctypes
# Define constants we use
PAGE_RW_PRIV = 0x04
PROCESS_ALL_ACCESS = 0x1F0FFF
VIRTUAL_MEM = 0x3000
#CTYPES handler
kernel32 = windll.kernel32
def dll_inject(PID,DLL_PATH):
print "[+] Starting DLL Injector"
LEN_DLL = len(DLL_PATH)# get the length of the DLL PATH
print " [+] Getting process handle for PID:%d " % PID
hProcess = kernel32.OpenProcess(PROCESS_ALL_ACCESS,False,PID)
if hProcess == None:
print " [+] Unable to get process handle"
sys.exit(0)
print " [+] Allocating space for DLL PATH"
DLL_PATH_ADDR = kernel32.VirtualAllocEx(hProcess,
0,
LEN_DLL,
VIRTUAL_MEM,
PAGE_RW_PRIV)
bool_Written = c_int(0)
print " [+] Writing DLL PATH to current process space"
kernel32.WriteProcessMemory(hProcess,
DLL_PATH_ADDR,
DLL_PATH,
LEN_DLL,
byref(bool_Written))
print " [+] Resolving Call Specific functions & libraries"
kernel32DllHandler_addr = kernel32.GetModuleHandleA("kernel32")
print " [+] Resolved kernel32 library at 0x%08x" % kernel32DllHandler_addr
LoadLibraryA_func_addr = kernel32.GetProcAddress(kernel32DllHandler_addr,"LoadLibraryA")
print " [+] Resolve LoadLibraryA function at 0x%08x" %LoadLibraryA_func_addr
thread_id = c_ulong(0) # for our thread id
print " [+] Creating Remote Thread to load our DLL"
if not kernel32.CreateRemoteThread(hProcess,
None,
0,
LoadLibraryA_func_addr,
DLL_PATH_ADDR,
0,
byref(thread_id)):
print "Injection Failed, exiting"
sys.exit(0)
else:
print "Remote Thread 0x%08x created, DLL code injected" % thread_id.value
PID = int(sys.argv[1])
DLL_PATH = str(sys.argv[2])
dll_inject(PID, DLL_PATH)
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
print "[+] Universal DLL Injector by Y"
print "[+] contact : If you know me then give me a shout"
print "[+] usage: ./dll_injector.py <PID> <DLLPATH>"
print "
"
from ctypes import *
import sys,ctypes
# Define constants we use
PAGE_RW_PRIV = 0x04
PROCESS_ALL_ACCESS = 0x1F0FFF
VIRTUAL_MEM = 0x3000
#CTYPES handler
kernel32 = windll.kernel32
def dll_inject(PID,DLL_PATH):
print "[+] Starting DLL Injector"
LEN_DLL = len(DLL_PATH)# get the length of the DLL PATH
print " [+] Getting process handle for PID:%d " % PID
hProcess = kernel32.OpenProcess(PROCESS_ALL_ACCESS,False,PID)
if hProcess == None:
print " [+] Unable to get process handle"
sys.exit(0)
print " [+] Allocating space for DLL PATH"
DLL_PATH_ADDR = kernel32.VirtualAllocEx(hProcess,
0,
LEN_DLL,
VIRTUAL_MEM,
PAGE_RW_PRIV)
bool_Written = c_int(0)
print " [+] Writing DLL PATH to current process space"
kernel32.WriteProcessMemory(hProcess,
DLL_PATH_ADDR,
DLL_PATH,
LEN_DLL,
byref(bool_Written))
print " [+] Resolving Call Specific functions & libraries"
kernel32DllHandler_addr = kernel32.GetModuleHandleA("kernel32")
print " [+] Resolved kernel32 library at 0x%08x" % kernel32DllHandler_addr
LoadLibraryA_func_addr = kernel32.GetProcAddress(kernel32DllHandler_addr,"LoadLibraryA")
print " [+] Resolve LoadLibraryA function at 0x%08x" %LoadLibraryA_func_addr
thread_id = c_ulong(0) # for our thread id
print " [+] Creating Remote Thread to load our DLL"
if not kernel32.CreateRemoteThread(hProcess,
None,
0,
LoadLibraryA_func_addr,
DLL_PATH_ADDR,
0,
byref(thread_id)):
print "Injection Failed, exiting"
sys.exit(0)
else:
print "Remote Thread 0x%08x created, DLL code injected" % thread_id.value
PID = int(sys.argv[1])
DLL_PATH = str(sys.argv[2])
dll_inject(PID, DLL_PATH)