Process Injection Tool Updates

Hello All,

In the post I will highlight few updates that are made to improve the code base & add long pending features to the Process Injection Tool that I wrote for learning about various Process Injection techniques and to enhance my knowledge about C# and Windows API.

The tool for process injection can be found on my Github. https://github.com/3xpl01tc0d3r/ProcessInjection

New Features:

1) Encryption - Added XOR & AES encryption support with custom key that needs to be passed to decrypt the shellcode at runtime. To encrypt the shellcode I have wrote another tool Obfuscator. I have wrote another short blog post for Obfuscator tool that can be found here. The tool currently only supports XOR & AES encryption. Obfuscated shellcode might help operator's to evade static detection while trying to inject the shellcode into remote process. 

Required parameters to leverage Encryption:

/enc : This parameter is used to specify the encryption type(xor or aes).

/key : This parameter is used to specify the key that will be used to decrypt the shellcode.

2) RAW Shellcode - The tool now also accepts the shellcode in raw format. This might be helpful for user's who want's to directly pass the shellcode file generated from tools such as Donut without converting or encoding it to any specify readable format such as c,csharp or base64 encoding. 

Required parameters to leverage RAW Shellcode:

/f : This parameter is used to specify the format of the shellcode. To leverage RAW shellcode feature just pass raw as the value to format parameter

3) Fetch shellcode remotely - The operator can now host the shellcode on the remote server & the tool can fetch the shellcode from the specified URL at runtime and inject the same into the remote process. 

Required parameters to fetch shellcode remotely:

/url : This parameter is used to specify the URL of the shellcode that is hosted remotely.

General Updates:

Revised the code logic to reduce the duplicated code. 

Removed the additional technique id's that were needed for leveraging Parent Process ID Spoofing evasion technique with various process injection techniques. Now the tool will checked for /ppath & /parentproc parameters to leverage Parent Process ID Spoofing technique with various process injection techniques.

Demo

Help

1) XOR encrypted shellcode with vanilla process injection technique :-

2) AES encrypted shellcode with vanilla process injection technique :-

3) Fetch raw shellcode remotely :-

For this demo we will use Covenant C2 framework that has a shellcode launcher & we will leverage Covenant feature to host the shellcode file.

Note:- In this post I will not cover the steps of creating the shellcode launcher and hosting the same in Covenant.

Feel free to provide me the feedback on twitter @chiragsavla94

Thanks for reading the post.

Special thanks to all my friends who help / supported / motivated me for writing blogs. 🙏