Hacking Articles Tips Tricks Videos Tutorials

Remote shellcode execution via CreateRemoteThreadAnother technique to create threads for shellcode execution is to call the CreateRemoteThread function, this will allow you to create threads remotely in another process. But the catch is that you will also want to allocate and write the shellcode payload into the remote process as well, since you’ll create a thread remotely that executes the payloads address that’s allocated within that process. In order to allocate the payload remotely, you’ll need to use the VirtualAllocEx function, this function is different from VirtualAlloc in that it can allocate memory regions in remote processes. To do this, Jektor creates a new process with the CREATE_NO_WINDOW flag set using CreateProcessW, this is used to spawn a new hidden notepad process. One the new process is spawned it remotely allocated memory in it and then uses WriteProcessMemory to write the shellcode payload into the allocated memory region. After this it calls CreateRemoteThread to execute the shellcode payload.Spawn a new process using CreateProcessW with CREATE_NO_WINDOW setOpen a HANDLE to the newly spawed process by PID with OpenProcess and dwProcessId from PROCESS_INFORMATIONAllocate memory remotely in the spawned process for the shellcode with VirtualAllocExWrite the shellcode payload into the allocated memory region with WriteProcessMemoryDetonate the remotely created shellcode payload with CreateRemoteThread and the HANDLE from OpenProcess

7 views11:36

7 views11:36

Hacking Articles Tips Tricks Videos Tutorials

Local shellcode execution via EnumTimeFormatsExAllocate memory locally for the shellcode payload with VirtualAllocMove the shellcode payload into the newly allocated region with memcpy/RtlCopyMemoryDetonate the shellcode by passing it as the lpTimeFmtEnumProcEx parameter for EnumTimeFormatsEx

8 views11:36

Hacking Articles Tips Tricks Videos Tutorials

Local shellcode execution via CreateFiberGet a HANDLE to the current thread using GetCurrentThreadConvert the main thread to a Fiber using ConvertThreadToFiberAllocate memory for the shellcode payload with VirtualAllocCopy the shellcode buffer into the newly allocated memory region with memcpyCreate a new fiber with the base address of the allocated memory region as the lpStartAddress parameter for CreateFiberDetonate the shellcode by scheduling the fiber with SwitchToFiberPerform cleanup by deleting the created fiber with DeleteFiber

8 views11:36

Hacking Articles Tips Tricks Videos Tutorials

8 views11:36

Hacking Articles Tips Tricks Videos Tutorials

Local shellcode execution via QueueUserAPCAllocate memory for the shellcode buffer with VirtualAllocGet a handle to the current process with GetCurrentProcessWrite the shellcode payload into the newly allocated memory region with WriteProcessMemoryGet a handle to the current thread with GetCurrentThreadQueue a new APC routine pass the address of the allocated memory region as the pfnAPC parameter to QueueUserAPCTrigger the shellcode payload by calling the undocumented NtTestAlert function which clears the APC queue for the current threadPerform cleanup by closing the handles to the current thread and current process

8 views11:36

Hacking Articles Tips Tricks Videos Tutorials

Download Jektor (https://github.com/FULLSHADE/Jektor)

9 views11:36

Hacking Articles Tips Tricks Videos Tutorials

9 views11:36

Hacking Articles Tips Tricks Videos Tutorials

10 views12:24

Hacking Articles Tips Tricks Videos Tutorials

Photo

Hacking on Medium
“드림 잡(Dream Job)” 작전은 진행 중

https://cdn-images-1.medium.com/max/1280/1*lGmtE_11gjj10uPztGsZHQ.png
북한 해킹 그룹 Lazarus의 새로운 공격 방법 분석

Continue reading on StealthSolution »

10 views12:24