Advanced-Process-Injection-Workshop

由 CyberWarFare Labs 举办的高级流程注入研讨会

要设置环境,请参阅以下内容: https://docs.google.com/document/d/1bNrSDWy-Yc3as2ZlvB_X3XOICUjbGUaKkw9PHDvxNAo

使用的工具

PE 熊: https://github.com/hasherezade/pe-bear-releases CFF Explorer: https://ntcore.com/?page_id=388 Visual Studio 2022: https://visualstudio.microsoft.com/vs/community/

参考资料

1. APC 代码注入 https://www.ired.team/offensive-security/code-injection-process-injection/apc-queue-code-injection
2. 模块踩踏 https://blog.f-secure.com/hiding-malicious-code-with-module-stomping/ https://github.com/countercept/ModuleStomping
3. 工艺空心 https://github.com/m0n0ph1/Process-Hollowing
4. 处理双重身份 https://github.com/3gstudent/Inject-dll-by-Process-Doppelganging https://hshrzd.wordpress.com/2017/12/18/process-doppelganging-a-new-way-to-impersonate-a-process/
5. 交易式空心 https://github.com/hasherezade/transacted_hollowing
6. 处理 Herpaderping https://jxy-s.github.io/herpaderping/ https://github.com/jxy-s/herpaderping
7. 进程伪影 https://www.elastic.co/blog/process-ghosting-a-new-executable-image-tampering-attack https://github.com/hasherezade/process_ghosting