process_ghosting

开源

Process Ghosting - 一种 PE 注入技术,与 Process Doppelgänging 类似,但使用待删除的文件而不是事务化文件

695 stars0 点赞0 次浏览

工具介绍

Process Ghosting - 一种 PE 注入技术,与 Process Doppelgänging 类似,但使用待删除的文件而不是事务化文件

This is my implementation of the technique presented by Gabriel Landau:

Memory artifacts as in Process Doppelgänging
Payload mapped as MEM_IMAGE (unnamed: not linked to any file)
Sections mapped with original access rights (no RWX)
Payload connected to PEB as the main module
Remote injection supported (but only into a newly created process)
Process is created from an unnamed module (GetProcessImageFileName returns empty string)

WARNING:

The 32bit version works on 32bit system only.