Article
introduction:
I am engaged in collecting various process injection principles and source codes. Collect these personal learning needs and automation needs in multiple environments. If compiled using pure C++ binary aggregation, the file size is only 3mb.
| Technical name | Completion progress | Link (empty represents common items, available on Baidu) |
|---|---|---|
| CreateRemoteThread Shellcode Injection | Completed | |
| DLL Injection | Completed | |
| Reflective DLL Injection | Completed | |
| Shellcode Reflective DLL Injection | Completed | |
| Process Doppelganging | Completed | |
| Loading and Executing Shellcode From PE Resources | Completed | |
| Process Hollowing and Portable Executable Relocations | Completed | |
| APC Queue Code Injection | Completed | |
| Early Bird APC Queue Code Injection | Completed | |
| Shellcode Execution in a Local Process with QueueUserAPC and NtTestAlert | Completed | |
| Shellcode Execution through Fibers | Completed | |
| Shellcode Execution via CreateThreadpoolWait | Completed | |
| Local Shellcode Execution without Windows APIs | Completed | |
| Injecting to Remote Process via Thread Hijacking | Completed | v0.0.5 |
| SetWindowHookEx Code Injection | Completed | |
| Finding Kernel32 Base and Function Addresses in Shellcode | Completed | |
| Executing Shellcode with Inline Assembly in C/C++ | Completed | |
| Writing Custom Shellcode Encoders and Decoders | Completed | |
| Backdooring PE Files with Shellcode | Completed | |
| NtCreateSection + NtMapViewOfSection Code Injection | Completed | |
| AddressOfEntryPoint Code Injection without VirtualAllocEx RWX | Completed | |
| Module Stomping for Shellcode Injection | Completed | |
| PE Injection: Executing PEs inside Remote Processes | Completed | |
| API Monitoring and Hooking for Offensive Tooling | Completed | |
| Windows API Hooking | Completed | |
| Import Adress Table (IAT) Hooking | Completed | |
| DLL Injection via a Custom .NET Garbage Collector | Completed | |
| Writing and Compiling Shellcode in C | Completed | Belongs to pre-development options |
| Injecting .NET Assembly to an Unmanaged Process | Completed | |
| Binary Exploitation | Completed | |
| pool party | Completed | A pool party you will never forget: using the new process injection technology of Windows thread pool - Prophet Community (aliyun.com) blackhat |
| TLS callback inject | Completed | Thread Local Storage of Process Injection - commonly used in malware anti-debugging, detecting whether there is a debugger before OEP and then exiting the program - bonelee - Blog Park (cnblogs.com) |
| ListPlanting | Completed | Process injection of ListPlanting - abusing the message callback function of the listview control - bonelee - Blog Garden (cnblogs.com) |
| Extra Window Memory | Completed | Process injection: Extra Window Memory (extra window memory) injection - using user-defined data to inject malicious code - bonelee - Blog Park (cnblogs.com) |
| Asynchronous Procedure Call | Completed | https://www.cnblogs.com/bonelee/p/17705390.html |
| Transacted Hollowing | Completed | Personal projects ALL in ONE |
| Process Overwriting | Completed | Another use of Process Hollowing - Process Overwriting-DecoyMini Technical Exchange Community - Powered by Discuz! (decoyit.com) |
| loacal API x 13 | Completed | Added 13 new localAPIs. For details, please see my previous blog article vt full anti-kill loader - CD_blog (cdxiaodong.github.io) |
| pagetableinject | Completed | kkent030315/PageTableInjection: Code injection, injecting malicious payload via pagetables pml4. (github.com) |
| threadless | Completed | New remote injection method-Threadless injection (qq.com) |
| Plug-in: Main thread hook | Completed | Just put your own logic in the game main loop or send and receive packets and run something. You can only hook a new thread. |
| Cross-session activation mechanism remotely calls com to achieve process injection | Completed | CICADA8-Research/IHxExec: Process Injection Alternative (github.com) |
| ROP process injection | Completed | Bw3ll/ROP_ROCKET: ROP ROCKET is an advanced code reuse attack framework with extensive ROP chain generation capabilities, including novel Windows Syscalls attacks, novel Heaven's Gate, and "shellless" ROPs. The framework leverages emulation and obfuscation to help expand the attack surface. --- Bw3ll/ROP_ROCKET: ROP ROCKET is an advanced code-reuse attack framework, with extensive ROP chain generation capabilities, including for novel Windows Syscalls attack, a novel Heaven's Gate, and "shellcodeless" ROP. The framework utilizes emulation and obfuscation to help expand the attack surface. (github.com) |
| setwindowshook injection requires that the corresponding program does not open CFG | Not completed | https://mp.weixin.qq.com/s/mp_FcnPpvTEFPQ4LvBSE-AIt is not impossible to detect it at all. If EDR collects window data source, or has nucleation or infinityhook like xxx, it will be very easy to detect.Fortunately, win32k data source, hypervisor, and infinityhook have become the infrastructure components of most security software..So it is not difficult to detect. Take EDR for example, its detection results are exactly the same as those of the previous APT, because EDR collected the win32k data source |
| FrostLock injection | Not completed | FrostLock injection is a freeze/thaw-based code injection technique that uses a Windows job object to temporarily freeze (suspend) a target process, inject shellcode, and then seamlessly resume (thaw) the process.‣ |
| Indirect-Shellcode-Executor | Not completed | Indirect-Shellcode-Executor exploits a configuration error/vulnerability in the API Windows method ReadProcessMemory discovered by DarkCoderSc. It exploits a feature of the input/output pointer parameter called *lpNumberOfBytesRead, which perfectly allows an attacker to write to process memory without calling common API methods such as memcpy.‣ |
Comments (0)
Login to post a comment.