Red Teaming Experiments

Ctrlk

Code & Process Injection

CreateRemoteThread Shellcode Injection DLL Injection Reflective DLL Injection Shellcode Reflective DLL Injection Process Doppelganging Loading and Executing Shellcode From PE Resources Process Hollowing and Portable Executable Relocations APC Queue Code Injection Early Bird APC Queue Code Injection Shellcode Execution in a Local Process with QueueUserAPC and NtTestAlert Shellcode Execution through Fibers Shellcode Execution via CreateThreadpoolWait Local Shellcode Execution without Windows APIs Injecting to Remote Process via Thread Hijacking SetWindowHookEx Code Injection Finding Kernel32 Base and Function Addresses in Shellcode Executing Shellcode with Inline Assembly in C/C++Writing Custom Shellcode Encoders and Decoders Backdooring PE Files with Shellcode NtCreateSection + NtMapViewOfSection Code Injection AddressOfEntryPoint Code Injection without VirtualAllocEx RWX Module Stomping for Shellcode Injection PE Injection: Executing PEs inside Remote Processes API Monitoring and Hooking for Offensive Tooling Windows API Hooking Import Adress Table (IAT) Hooking DLL Injection via a Custom .NET Garbage Collector Writing and Compiling Shellcode in C Injecting .NET Assembly to an Unmanaged Process

PreviousT1216: pubprn.vbs Signed Script Code Execution NextCreateRemoteThread Shellcode Injection

Last updated 4 years ago

Was this helpful?