+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [C] Need resources for learning about injections (/showthread.php?tid=6050870)
Need resources for learning about injections - Abducted - Feb 19, 2020
Hey,
Do any of you have any experience with or know any good references to resources where I could learn more about C++ injections to running processes? Or malware development resources in general?
RE: Need resources for learning about injections - Shisho - Feb 19, 2020
At the moment I think process hollowing and process doppelganging are the de-facto injection methods involving trusted process hijacks. The latter also introduces a locking system in the form of NTFS transactions which makes the memory unreadable until the transaction is complete which will roll itself back and make it look like nothing ever happened in the first place.
A quick Google search can find you numerous PE loaders written to load arbitrary code into 32-bit or 64-bit processes. rohitab seems to have a lot of capable malware programmers that release their code for free and is a good place to find some examples to analyze.
RE: Need resources for learning about injections - ModernJS - Feb 19, 2020
Is this process injection also possible on linux with elf binaries?
RE: Need resources for learning about injections - Shisho - Feb 19, 2020
(Feb 19, 2020 11:11 AM)ModernJS Wrote: Is this process injection also possible on linux with elf binaries?
On Linux you could likely just fork, exec, SIGSTOP and then replace the memory of the new process and then inject your shellcode or ELF file and then rebuild the import tables and addresses to mimic process hollowing.
RE: Need resources for learning about injections - ModernJS - Feb 20, 2020
(Feb 19, 2020 11:42 AM)Shisho Wrote: On Linux you could likely just fork, exec, SIGSTOP and then replace the memory of the new process and then inject your shellcode or ELF file and then rebuild the import tables and addresses to mimic process hollowing.
Yup you're right
https://security.stackexchange.com/questions/153829/equivalent-of-windows-process-hollowing-on-linux-unix-macos
RE: Need resources for learning about injections - 3DES - Feb 21, 2020
Google has all the information in the world.