使用 PPID 欺骗路由进程的标准输出

Question

我尝试编写使用CreateProcess() 执行CMD 命令并将stdout 重定向到命名管道的代码。我想添加一个功能来欺骗父 PID，以便 cmd 将在 explorer.exe 下生成。每个功能都可以独立工作，但是当我尝试合并它们时，它就不起作用了。

标准输出路由：

int main()
{
    HANDLE hStdout_Rd = NULL;
    HANDLE hStdout_Wr = NULL;
    SECURITY_ATTRIBUTES saAttr;
    saAttr.nLength = sizeof(SECURITY_ATTRIBUTES);
    saAttr.bInheritHandle = TRUE;
    saAttr.lpSecurityDescriptor = NULL;

    CreatePipe(&hStdout_Rd, &hStdout_Wr, &saAttr, NULL);
    SetHandleInformation(hStdout_Rd, HANDLE_FLAG_INHERIT, 0);

    //Set startup info
    STARTUPINFO si;
    ZeroMemory(&si, (sizeof(STARTUPINFO)));
    si.cb = sizeof(STARTUPINFO);
    si.dwFlags = STARTF_USESHOWWINDOW | STARTF_USESTDHANDLES;
    si.hStdError = hStdout_Wr;
    si.hStdOutput = hStdout_Wr;
    si.wShowWindow = SW_HIDE;

    PROCESS_INFORMATION pi;
    ZeroMemory(&pi, sizeof(PROCESS_INFORMATION));
    CString cmd;
    if (CreateProcess(NULL, cmd.GetBuffer(), NULL, NULL, TRUE, 0, NULL, NULL, &si, &pi))
    {
        //Great success read pipe contents
    }
    CloseHandle(hStdout_Rd);
    CloseHandle(hStdout_Wr);
}

PPID 欺骗：

int main() {

    CString cmd;
    STARTUPINFOEXA sInfoEX;
    PROCESS_INFORMATION pInfo;
    SIZE_T sizeT;

    HANDLE expHandle = OpenProcess(PROCESS_ALL_ACCESS, false, getParentProcessID());

    ZeroMemory(&sInfoEX, sizeof(STARTUPINFOEXA));
    InitializeProcThreadAttributeList(NULL, 1, 0, &sizeT);
    sInfoEX.lpAttributeList = (LPPROC_THREAD_ATTRIBUTE_LIST)HeapAlloc(GetProcessHeap(), 0, sizeT);
    InitializeProcThreadAttributeList(sInfoEX.lpAttributeList, 1, 0, &sizeT);
    UpdateProcThreadAttribute(sInfoEX.lpAttributeList, 0, PROC_THREAD_ATTRIBUTE_PARENT_PROCESS, &expHandle, sizeof(HANDLE), NULL, NULL);
    sInfoEX.StartupInfo.cb = sizeof(STARTUPINFOEXA);

    CreateProcessA(NULL, cmd.GetBuffer(), NULL, NULL, TRUE, CREATE_SUSPENDED | CREATE_NO_WINDOW | EXTENDED_STARTUPINFO_PRESENT, NULL, NULL, reinterpret_cast<LPSTARTUPINFOA>(&sInfoEX), &pInfo);


    return 0;
}

齐心协力：

int main() {

    HANDLE hStdout_Rd = NULL;
    HANDLE hStdout_Wr = NULL;
    SECURITY_ATTRIBUTES saAttr;
    saAttr.nLength = sizeof(SECURITY_ATTRIBUTES);
    saAttr.bInheritHandle = TRUE;
    saAttr.lpSecurityDescriptor = NULL;
    CString cmd;
    STARTUPINFOEXA sInfoEX;
    PROCESS_INFORMATION pInfo;
    ZeroMemory(&pInfo, sizeof(PROCESS_INFORMATION));
    SIZE_T sizeT;

    HANDLE expHandle = OpenProcess(PROCESS_ALL_ACCESS, false, getParentProcessID());

    ZeroMemory(&sInfoEX, sizeof(STARTUPINFOEXA));
    sInfoEX.StartupInfo = sizeof(STARTUPINFO);
    sInfoEX.StartupInfo = STARTF_USESHOWWINDOW | STARTF_USESTDHANDLES;
    sInfoEX.StartupInfo = hStdout_Wr;
    sInfoEX.StartupInfo = hStdout_Wr;
    sInfoEX.StartupInfo = SW_HIDE;
    InitializeProcThreadAttributeList(NULL, 1, 0, &sizeT);
    sInfoEX.lpAttributeList = (LPPROC_THREAD_ATTRIBUTE_LIST)HeapAlloc(GetProcessHeap(), 0, sizeT);
    InitializeProcThreadAttributeList(sInfoEX.lpAttributeList, 1, 0, &sizeT);
    UpdateProcThreadAttribute(sInfoEX.lpAttributeList, 0, PROC_THREAD_ATTRIBUTE_PARENT_PROCESS, &expHandle, sizeof(HANDLE), NULL, NULL);
    sInfoEX.StartupInfo.cb = sizeof(STARTUPINFOEXA);

    if (CreateProcessA(NULL, cmd.GetBuffer(), NULL, NULL, TRUE, CREATE_SUSPENDED | CREATE_NO_WINDOW | EXTENDED_STARTUPINFO_PRESENT, NULL, NULL, reinterpret_cast<LPSTARTUPINFOA>(&sInfoEX), &pInfo))
    {
        //Read pipe contents
    }
    return 0;
}

我有什么遗漏的吗？

Answer 1

每个功能都可以独立运行，但是当我尝试 合并它们是行不通的。

匿名管道是一种未命名的单向管道，通常在父进程和子进程之间传输数据。要使用管道进行通信，管道服务器必须将管道句柄传递给另一个进程。通常，这是通过继承来完成的；即进程允许子进程继承句柄。

由于您将子进程的父进程更改为 explorer.exe。最初的父子关系不再存在。所以新进程无法访问旧父进程中创建的handle（hStdout_Wr）。这就是它停止工作的原因。

为了达到你的目的：

• 一种方式是：“The process can also duplicate a pipe handle using the DuplicateHandle function and send it to an unrelated process using some form of interprocess communication, such as DDE or shared memory.”
• 另一种方法是使用named pipe。任何进程都可以访问命名管道，但需要经过安全检查，这使得命名管道成为相关或不相关进程之间的一种简单通信形式。