🖥 Stealthy Shellcode Injection: Exploiting Windows Fork API for Memory Manipulation

Abusing Windows fork API and OneDrive.exe process to inject the malicious shellcode without allocating new RWX memory region. This technique is finding RWX region in already running processes in this case OneDrive.exe and Write shellcode into that region and execute it without calling VirtualProtect, VirtualAllocEx, VirtualAlloc.

🚀 Steps:

— Find the OneDrive.exe in running processes;
— Get the handle of OneDrive.exe;
— Query remote process memory information;
— look for RWX memory regions;
— Write shellcode into found region of OneDrive.exe;
— Fork OneDrive.exe into a new process;
— Set the forked process's start address to the cloned shellcode;
— Terminate the cloned process after execution.

🔗 https://github.com/Offensive-Panda/RWX_MEMEORY_HUNT_AND_INJECTION_DV

#winapi #onedrive #injection #maldev #cpp

🖥 Assembly for Hackers

"Assembly Unleashed: A Hacker's Handbook" is a definitive resource tailored specifically for hackers and security researchers seeking to master the art of assembly programming language. Authored by seasoned practitioners in the field, this book offers a comprehensive journey into the depths of assembly, unraveling its complexities and exposing its potential for exploitation and defense.

🔗 Source:
https://redteamrecipe.com/assembly-for-hackers

#asm #syscalls #dll #apc #injection #redteam