Windows Process Injection

A collection of techniques for process injection on Windows

Caution

Disclaimer: Intended only for use on systems that you are legally authorized to access.

Fundamentals

A collection of examples intended to demonstrate the fundamentals and provide a base for more advanced techniques.

• injection-example-1.c: injecting calc.exe msfvenom shellcode into the current process
• injection-example-2.c: injecting calc.exe msfvenom shellcode into the current process, toggling the memory protection between RW and RWX
• injection-example-3.c: injecting calc.exe msfvenom shellcode into a remote process, with memory protection toggling
• injection-example-4.c: injecting calc.exe msfvenom shellcode into a remote process, with memory protection toggling and using dynamic function resolution

Techniques

• Dynamic Function Resolution
• Module Stomping
• Walking the PEB and EAT
• Direct Syscalls
• Indirect Syscalls
• Thread Pool Injection

Blog Posts

• Process Injection Fundamentals
• The Ministry of Silly Walks Presents: Walking the PEB
• An Introduction To Module Stomping
• Advanced Evasion Tradecraft: Precision Module Stomping
• Hunting for Module Stomping Targets
• The Single-Primitive Write: WriteProcessMemory’s Hidden Page Flip
• Don’t Be So Primitive: Evolving the Module Stomping Staging Chain