Support remote thread execution? about pe_to_shellcode HOT 8 OPEN

Hi @VoldeSec !
First of all I need to know more details to investigate what could possibly have cause it.

• Did your converted shellcode worked when you try to run it with the runshc32/64 application?
• What did you use for making the injection, did you try injector32/64 from the package? BTW, it uses CreateRemoteThread :

  pe_to_shellcode/injector/main.cpp

  Line 47 in 0f60692

  if ((hMyThread = CreateRemoteThread(hProcess, NULL, NULL, (LPTHREAD_START_ROUTINE)remote_buf, NULL, 0, &threadId)) == NULL) {

• What flags were set on the process into which you tried the injection?
• Are you 100% sure that the process and the payload had the same bitness?

from pe_to_shellcode.

Thanks @hasherezade ,

1. Yes tried with runshc and it works perfectly fine.
2. I am trying the module stomping, referenced to your another project "module_overloading". (already get rid of CFG). I will take a look on the injector and compare the difference.
3. I am using the same flag with you above and input the implant entrypoint to the LPTHREAD_START_ROUTINE . But the process still failed to execute and crashed. Do i
4. I already checked the memory and the payload had the exact same bitness in the target process e.g. calc.exe
   Thank you again for your prompt response!

from pe_to_shellcode.

@VoldeSec - does it work if you try to inject the same shellcode to the same process, but using injector32/64 (from the pe2shc release package)?

from pe_to_shellcode.

@hasherezade Yes, it works by using the injector to inject (e.g. calc.exe and other PE to output file for PoC) remote process (i.e. cmd.exe)

from pe_to_shellcode.

I see, so if the shellcode works, and it can be injected with the original injector, then it seems to be a problem with your replacement injector. BTW, using module_overloading method for shellcode injection sounds odd, but I will need to analyze your code to really know what happens there.

from pe_to_shellcode.

I have invited you in wire for further discussion. I am glad if you have time to give recommendation on the code.
Thanks!

from pe_to_shellcode.

ok, I accepted your invite. Let's talk on Wire.

from pe_to_shellcode.