Re: InjCode.cpp

From: Simon (NOsimbilSPAM_at_THANKSbtinternet.CoM)
Date: 01/16/04 

Date: Fri, 16 Jan 2004 11:28:55 -0000

> Im a little new to this so please bear with me. Why would it matter if
> user32.dll was remapped?
>
>
> hUser32 := GetModuleHandle('user32');
> DataLocal.fnSendMessage := TSendMessage(GetProcAddress( hUser32,
> 'SendMessageA') );
>
> Surely this would always get us the valid start address of the sendmesage
> function in process (a). If I have understood correctly you are saying we
> should get the start address of the sendmesage function from the target
> process (b). Why does it matter?
>
Because the addresses could be different. A process can not call an address
in another processes address space - that will produce an access violation.

> When you talk of sufficient rights, would that be the security attributes
> parameter in CreateRemoteThread?
>
The security attribute in the CreateRemoteThread is for processes that want
to use that handle (hThread), not for the injection itself.
IIRC, the application that does the injection normally inherits security
attributes from the logged on user - this security must have rights for the
injection process.
You can make the app use another account by LogonUser and
ImpersonateLoggedOnUser - check the Windows SDK help for descriptions.

Good luck, Simon

Relevant Pages

  • Re: Pentester convicted..
    ... No matter how much good will is arguably present (think about the Daniel ... case in terms of the same defense) you have gained unauthorised access. ... As ethical IT security experts, with all our knowledge, skill and esoteric talent, we do not have a right to gain unauthorised access. ... Download FREE whitepaper on how a managed service can ...
    (Pen-Test)
  • Re: Re:How To Suspend Thread In Kernel?
    ... matter of helping people to not choose bad designs. ... ONLY security feature that cannot be overcome in the whole OS (not to say ... Malware comes to kernel mode and begin hooking SDT, ...
    (microsoft.public.win32.programmer.kernel)
  • Re: WASC-Announcement: MX Injection - Capturing and Exploiting Hidden Mail Servers By Vicent
    ... Application Security Scanner for a long time (SMTP Injection). ... Cenzic Hailstorm finds vulnerabilities fast. ...
    (Pen-Test)
  • Re: Lightweight Ruby?
    ... I don't believe it's a matter of being light, ... written within IBM and now open source uses Java's security manager to ... in an open class system but hopefully I am terribly misguided. ... threads wouldn't be required so that it could be more lightweight. ...
    (comp.lang.ruby)
  • Re: Assigning groups to Printers?
    ... "Security" role. ... Just wondering what role would be better or does it matter? ... But for some reason, nobody in the group can ...
    (microsoft.public.windows.server.general)