Skip to content

Instantly share code, notes, and snippets.

@haginara
Last active April 16, 2021 15:54
Show Gist options
  • Select an option

  • Save haginara/f8fb17833ebebe4c48a6 to your computer and use it in GitHub Desktop.

Select an option

Save haginara/f8fb17833ebebe4c48a6 to your computer and use it in GitHub Desktop.
inject python code into running process
# coding: utf-8
from winappdbg import Process, System
import sys
import time
import ctypes.util
if __name__ == '__main__':
python_lib = "python{0}{1}.dll".format(sys.version_info.major, sys.version_info.minor)
python_dll = ctypes.util.find_library(python_lib)
s = System()
s.scan_processes()
pl = s.find_processes_by_filename("bash.exe")
pid = pl[0][0].get_pid()
p = Process(pid)
print('pid', pid)
print('arch', p.get_bits())
t = p.inject_dll(python_dll)
p.scan_modules()
m = p.get_module_by_name(python_lib)
init = m.resolve("Py_InitializeEx")
pyrun = m.resolve("PyRun_SimpleString")
print(init, pyrun)
p.start_thread(init, 0)
time.sleep(0.1)
sh = 'import subprocess; subprocess.call("notepad.exe")'
addr = p.malloc(len(sh))
p.write(addr, sh)
#t, addr = p.inject_code(sh)
#print('sh', addr)
p.start_thread(pyrun, addr)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment