3xpl01tc0d3r

Hello All, In the post I will highlight few updates that are made to improve the code base & add long pending features to the Process Injection Tool that I wrote for learning about various Process Injection techniques and to enhance my knowledge about C# and Windows API. The tool for process injection can be found on my Github. https://github.com/3xpl01tc0d3r/ProcessInjection New Features: 1) Encryption - Added XOR & AES encryption support with custom key that needs to be passed to decrypt the shellcode at runtime. To encrypt the shellcode I have wrote another tool Obfuscator . I have wrote another short blog post for Obfuscator tool that can be found here . The tool currently only supports XOR & AES encryption. Obfuscated shellcode might help operator's to evade static detection while trying to inject the shellcode into remote process.  Required parameters to leverage Encryption: /enc  : This parameter is used to specify the encryption type(xor or aes). /key : Th...

Hello All, In this post we will cover how can we leverage GadgetToJScript for generating payload in various supported format such as HTA, JS, VBS & VBA(macro) which will execute our covenant grunt(Grunt is the implant for  Covenant  C2 framework). Wondering why are we using  GadgetToJScript  tool to generate  Covenant  payload in hta / js format wherein  Covenant  has default launcher to generate hta / js payload ? Covenant  uses  DotNetToJScript  for generating payloads in hta / js format which indeed doesn't work well with Windows 10 environment. We can see the note in the description field. DotNetToJScript  - A tool to generate a JScript which bootstraps an arbitrary .NET Assembly and class. GadgetToJScript  - A tool for generating .NET serialized gadgets that can trigger .NET assembly load/execution when deserialized using BinaryFormatter from JS/VBS based scripts....

Hello All, Wondering where is the part IV of the process injection blog post series ? The part IV of this series was written by Renos  on  Parent PID Spoofing  technique. Parent PID Spoofing technique is useful for evading detection. In this post I will cover about Asynchronous Procedure Calls (APC) Queue Process Injection technique. Parent PID Spoofing can also be used with APC Queue Process Injection. The tool can be found on my github repo . What is Asynchronous Procedure Calls (APC) ? This is best described by Microsoft in their documentation . Below is the short brief about APC from the Microsoft Docs. An asynchronous procedure call (APC) is a function that executes asynchronously in the context of a particular thread. When an APC is queued to a thread, the system issues a software interrupt. The next time the thread is scheduled, it will run the APC function. An APC generated by the system is called a kernel-mode APC. An APC generated by an application i...

Hello All, Finally I have got one contributor ( Renos ) who has added process hollowing technique to the Process Injection tool which I wrote for learning about various Process Injection techniques and to enhance my knowledge about C# and Windows API. In this post I will cover about the Process Hollowing technique. The tool can be found on my github repo . What is Process Hollowing ? Process hollowing occurs when a process is created in a suspended state and the executable section of the legitimate process in the memory is unmapped and replaced with malicious executable (Shellcode in our case). This technique allows an attacker to disguise his malware as a legitimate process and execute malicious code. As a result, attacker may evade defenses and endpoint detection. In this Process Hollowing technique 10 Windows API are used. ZwCreateSection - The ZwCreateSection function creates a section object that represents a section of memory that can be shared. A process c...

Hello All, In the series of learning various process injection techniques and enhancing my knowledge about C# leveraging Windows API I started to explore and understand about another very famous process injection technique known as DLL Injection. What is DLL ? Dynamic Link Library (DLL) is a file which contains the code and is been loaded by the program to perform one or more actions during run time. What is DLL Injection ? DLL Injection is a process of injecting an DLL into the running process which might contains malicious code and can be used for performing malicious activities. In this post I will provide an overview about the technique and a demo using the process injection tool which I created. It can be found on my github repo . In this DLL Injection technique 6 Windows API are used. OpenProcess  - The OpenProcess function returns a handle of an existing process object. VirtualAllocEX  - The VirtualAllocEx function is used to allocate the memory and gr...

Hello All, After publishing the post about Dumping Process Memory with Custom C# Code my friend Himanshu suggested me to write a tool & a blog post about Process Injection for learning and he referenced his post about Code Injection which covers the concept about the vanilla process injection technique. It was quite interesting to learn and understand the core concepts about Process Injection techniques and as a learning path to code in c# leveraging Windows API I started writing the tool for Process Injection. What is Process Injection ? Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process. Why Process Injection ? ...