Duration: 35:06

983 views

39

The first, real step in our journey to write real malware: process injection! Process injection is the act of taking code from one place, whether it be a DLL or code in another executable, and injecting it into another running process. Malware uses this for stealth, privilege escalation and lots more. We're going to talk about process memory, process memory rebasing and reallocation and creating remote threads in this one, so buckle up for a long and complicated video!

RRE is a series where I write malware so I can better learn how to fight it. If you liked this video or the series, be sure to leave me a like, subscribe to see more and follow me on Twitter for more updates!

-- Twitter --
https://twitter.com/viking_sec

-- Patreon --
https://www.patreon.com/Viking_Sec

-- Video Notes and Resources --

iredteam article that explains a lot of this and helped me learn a ton:
https://www.ired.team/offensive-security/code-injection-process-injection/pe-injection-executing-pes-inside-remote-processes#code

MSDN article on process handles
https://docs.microsoft.com/en-us/windows/win32/procthread/process-handles-and-identifiers

MSDN article on GetModuleHandle
https://docs.microsoft.com/en-us/previous-versions/ms908443(v=msdn.10)

PE Header Explanation
https://blog.kowalczyk.info/articles/pefileformat.html

MSDN article on VirtualAlloc()
https://docs.microsoft.com/en-us/windows/win32/api/memoryapi/nf-memoryapi-virtualalloc

MSDN article on OpenProcess()
https://docs.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-openprocess

iredteam article on memory rebasing
https://www.ired.team/offensive-security/code-injection-process-injection/process-hollowing-and-pe-image-relocations#relocation

-- Table of Contents --


0:00 intro
0:30 demo, intro to process injection
6:00 GetModuleHandle
7:55 DOS Headers and NT Headers
11:20 Process Memory and Base Addresses
13:40 VirtualAlloc and Allocating Memory
17:30 OpenProcess to Access Target Process Memory
21:15 Memory Reallocation
32:07 CreateRemoteThread
33:40 Wrap-up

--
#malwaredevelopment #hacking #malware