InjectProc – Process Injection Techniques – Digitalmunition




Pentest Tools i

Published on June 4th, 2017 📆 | 7091 Views ⚑

0

InjectProc – Process Injection Techniques

Process injection is a very popular method to hide malicious behavior of code and are heavily used by malware authors.
There are several techniques, which are commonly used: DLL injection, process replacement (a.k.a process hollowing), hook injection and APC injection.
Most of them use same Windows API functions: OpenProcess, VirtualAllocEx, WriteProcessMemory, for detailed information about those functions, use MSDN

DLL injection:

  • Open target process.
  • Allocate space.
  • Write code into the remote process.
  • Execute the remote code.

Process replacement:

  • Create target process and suspend it.
  • Unmap from memory.
  • Allocate space.
  • Write headers and sections into the remote process.
  • Resume remote thread.


Hook injection:

  • Find/Create process.
  • Set hook

▼Advertisement


APC injection:

  • Open process.
  • Allocate space.
  • Write code into remote threads.
  • “Execute” threads using QueueUserAPC.

Download
Windows x64 binary – x64 bit DEMO

Dependencies:
vc_redist.x64 – Microsoft Visual C++ Redistributable

DEMO:

 



Leave a Reply

Your email address will not be published. Required fields are marked *


loading...