Skip to content

maziland/StackBombing

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

10 Commits
 
 
 
 
 
 
 
 
 
 

Repository files navigation

StackBombing

A highly sophisticated technique which allows code injection onto a chosen running process, while bypassing every security mechanism (checked until Windows 10 build 1909).

Stackbombing abuses the Alertable state mechanism in Windows machines. While the target thread is in this state, Stackbombing writes to this thread's current stack its payload, after it saved the normal thread state.

When the thread returns from the Alertable-state, the retn instruction jumps to the malicious ROP chain inserted by Stackbombing. After Stackbombing finishes running the ROP chain, a clean up for the malicious stack occurs, and the thread stack is being rerwitten.

With this technieque, an attacker is able to be stealty, and pwn every process he disires.

About

Next gen process injection technique

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published