[p4r4n0id]

PowerLoaderEx

http://breakingmalware.com/injection-te ... /#more-747

https://github.com/BreakingMalware/PowerLoaderEx

Enjoy :)

p4r4n0id

[EP_X0FF]

Nice, does it work on win10?

[kerpow1]

Looking at code it will just work on Win7 but looks very good :)

[EP_X0FF]

The question was about method not this code exactly. As far as I remember all the secret is "call eax/rax" inside Explorer function which make it interesting to see if win10 CFG handle this.

[p4r4n0id]

Sorry for the late response guys,

It wasn't tested on windows 10 yet, but i dont think there will be any problem with CFG (as EP_X0FF said, due to the call eax/rax).

Will check and let u know,

Thanks for your feedback guys,

p4r4n0id

[Brock]

Will be interesting to see if immersive UI/modern UI apps like their windows played with. I just checked Windows 10 and Explorer is immersive, but it's not a traditional metro app (to inject into these the DLL must have the ALL APPLICATION PACKAGES group added to the file permissions and contain no manifest). Explorer still allows any DLL to be injected so it doesn't follow the strict rules of DLL loading that traditional metro apps require. Interesting code, keep us updated

[jacks.alex]

Code: Select all

PVOID KiUserApcDispatcher = (PVOID)GetProcAddress(LoadLibrary(_T("ntdll.dll")), "KiUserApcDispatcher");
    PVOID WriteProcessMemory = (PVOID)GetProcAddress(LoadLibrary(_T("kernel32.dll")), "WriteProcessMemory");
    PVOID ntchkstk = (PVOID)GetProcAddress(LoadLibrary(_T("ntdll.dll")), "_chkstk");
    PVOID atan = (PVOID)GetProcAddress(LoadLibrary(_T("ntdll.dll")), "atan");
    PVOID LoadLibraryAddr = (PVOID)GetProcAddress(LoadLibrary(_T("kernel32.dll")), "LoadLibraryA");

What about ASLR?

[Vrtule]

Hello,

with a slight modification, you can use the result of the GetProcAddress calls as offset into the corresponding DLLs (kernel32.dll, ntdll.dll).

Code: Select all

ULONG_PTR GetRoutineOffset(PWCHAR LibraryName, PCHAR RoutineName)
{
  ULONG_PTR ret = 0;
  HMODULE modHandle = GetModuleHandleW(LibraryName);

  if (modHandle != NULL)
    ret = (ULONG_PTR)GetProcAddress(modHandle, RoutineName) - (ULONG_PTR)modHandle;

  return ret;
}

The routine uses GetModuleHandle rather than LoadLibrary function to get module handles. You usually do not need to call LiadLibrary for kernel32.dll and ntdll.dll since they are loaded nearly in all processes (ntdll.dll is, at least).

If you get the offsets, you can then obtain base addresses for the modules for the target process. Use Tool Help Library (CreateToolHelp32Snapshot, Module32First, Module32Next). Then, you get addresses of the routines in the address space of the target process.

[jacks.alex]

CreateToolHelp32Snapshot, Module32First, Module32Next. OpenProcess FOR READ (without aslr bypass no need in this code) so for what was all this i don't know...

[jacks.alex]

"Injection without reading memory from the target process" without aslr bypass it will not work, for bypass aslr it's need to read memory of target process