Shellcode Injection Techniques Explained
Uploaded by
sta.akpaShellcode Injection Techniques Explained
Uploaded by
sta.akpaCommon questions
Powered by AI'WriteProcessMemory' is used to copy a payload into the allocated memory space of a target process, which enables the code injection. It essentially writes data to a specified location in the memory space of the specified process, facilitating the transfer of the malicious payload into the memory of the target process where it can later be executed. Its parameters include a handle to the target process, the base address of where to write the payload, a buffer containing the data to write, the number of bytes to write, and a pointer to store the number of bytes actually written .
The main functions utilized in the payload injection example include 'OpenProcess', 'VirtualAllocEx', 'WriteProcessMemory', and 'CreateRemoteThread'. These functions interact sequentially wherein 'OpenProcess' obtains process access with necessary rights, 'VirtualAllocEx' allocates executable memory space in the target process' memory, 'WriteProcessMemory' transfers the payload into that allocated space, and 'CreateRemoteThread' executes the payload by starting a thread in the target process using the address of the payload as the start point .
The debugging API, despite being intended for legitimate debugging tasks, is leveraged for code injection by exploiting its functions, such as 'OpenProcess' to gain access to processes, 'VirtualAllocEx' to allocate memory in the target process, 'WriteProcessMemory' to write the payload into allocated memory, and 'CreateRemoteThread' to execute the payload. These APIs provide extensive control over processes, such that misuse can occur, allowing unauthorized code execution within another process's memory framework .
'CreateRemoteThread' facilitates the execution of a payload in a code injection operation by creating a new thread in the target process, allowing the injected code (payload) to be executed in the context of that target process. It takes several parameters, including 'hProcess', a handle to the target process; 'lpStartAddress', which is a pointer to the starting address of the code to execute; and 'lpParameter', which is a pointer to any parameter to pass to the execution of the thread .
The key steps involved in injecting a payload into a running process using the Windows debugging API include: first, obtaining the process ID (PID) of the target process, such as calc.exe or mspaint.exe; second, opening the target process using the 'OpenProcess' function to gain the necessary access rights; third, allocating memory within the target process using the 'VirtualAllocEx' function to reserve and commit space for the payload; fourth, writing the payload into the allocated memory of the target process using 'WriteProcessMemory'; and finally, creating a remote thread in the target process using 'CreateRemoteThread' to execute the payload .
The 'VirtualAllocEx' function is used to allocate memory in the virtual address space of a specified process, enabling the injection of code into that process. Its parameters include 'hProcess' which is a handle to the process; 'lpAddress', an optional parameter specifying a desired memory address; 'dwSize', which indicates the size of the memory to allocate; 'flAllocationType', which flags the allocation type such as MEM_COMMIT or MEM_RESERVE; and 'flProtect', which sets the memory protection, commonly PAGE_EXECUTE_READWRITE for executable code .
When opening a process for code injection, various system protections such as Mandatory Integrity Control (MIC) need to be considered. MIC enforces restrictions based on the integrity level of the processes, potentially preventing low-integrity processes from writing to higher integrity levels. Additionally, User Account Control (UAC) can limit the permissions of processes run by users with administrative rights, and some processes may require explicit permissions or run with restricted access, requiring the injection code to handle such scenarios appropriately .
When compiling a program that performs code injection on Windows, considerations should include using the appropriate compiler flags to optimize for performance and compatibility, such as -s for stripping symbols, -ffunction-sections, and -fdata-sections for section optimization. Additionally, ensuring static linking with standards like -static-libstdc++ and -static-libgcc to avoid dependency issues and reduce detection by security tools is crucial for the effective execution of the injection without disruption .
Integrity levels set by Mandatory Integrity Control (MIC) affect a code injection attempt by restricting the ability of a process at a lower integrity level to modify or interfere with processes at a higher integrity level. For instance, a process running at a low integrity level like a web browser is prevented from injecting code into a process with medium, high, or system integrity levels, thus safeguarding critical system and user operations from unauthorized code injection attempts .
Mandatory Integrity Control (MIC) enforces security by restricting the access that lower integrity level processes have on higher level processes. It helps prevent unauthorized or less privileged processes from accessing or modifying more critical system areas. MIC defines four integrity levels: low level for restricted access processes like internet browsers, medium level as the default for most processes started by regular users, high level for processes with administrative privileges, and system level for the most protected system processes .