RWX_MEMEORY_HUNT_AND_INJECTION_DV

💬
Abusing Windows fork API and OneDrive.exe process to inject the malicious shellcode without allocating new RWX memory region. This technique is finding RWX region in already running processes in this case OneDrive.exe and Write shellcode into that region and execute it without calling CreateRemoteThread, NtCreateRemoteThread or Direct calls.

💻 Usage:
Just compile the program and run the (EXE) without any paremeter.

💡 Steps:
⚪️ Find the OneDrive.exe in running processes.
⚪️ Get the handle of OneDrive.exe.
⚪️ Query remote process memory information.
⚪️ look for RWX memory regions.
⚪️ Write shellcode into found region of OneDrive.exe
⚪️ Fork OneDrive.exe into a new process.
⚪️ Set the forked process's start address to the cloned shellcode.
⚪️ Terminate the cloned process after execution

▶ DEMO

😸 Github

⬇️ Download
🔒 A3l3_KA4

#ShellCode #Malware
➖➖➖➖➖➖➖➖➖➖
📣 T.me/BugCod3
📣 T.me/LearnExploit
📣 T.me/A3l3_KA4

Ghostly Hollowing Via Tampered Syscalls

Implementing the ghostly hollowing PE injection technique using tampered syscalls.

😸 Github

⬇️ Download
🔒 LearnExploit

#syscall #Injection
➖➖➖➖➖➖➖➖➖➖
📣 T.me/BugCod3
📣 T.me/LearnExploit