- Shellcode Title: Windows/x64 - Inject All Processes with Meterpreter Reverse Shell (655 Bytes)
- Tested on: Windows 10 v2004 (x64)
- Compiled from: Kali Linux (x86_64)
- Shellcode Description:
- 64bit Windows 10 shellcode that injects all processes with Meterpreter reverse shells. The shellcode first resolves the base address of
- kernel32.dll dynamically in memory via the Intel GS Register & host processes Process Environment Block (PEB). Then resolves the addresses
- for the OpenProcess, VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread APIs via kernel32.dll's Export Table.
- Once all API's are resolved the shellcode then attempts to open a handle to other processes using the OpenProcess API via bruteforcing the PIDs.
- When a handle to a remote process is returned, the shellcode then attempts to allocate writable & executable memory in the remote process using the
- VirtualAllocEx API. If successful, the shellcode will then use the WriteProcessMemory API to write the Meterpreter shellcode into the memory of the
- remote process. To this point, if everything has returned sucessful, then the CreateRemoteThread API will be executed to create a thread in the remote
- process that will run the Meterpreter shell within that remote process. The shellcode then continues to bruteforce through more PIDs to launch more
- Meterpreter shells.
cpt-jack-a-castle / windows-x64-processes-injector Goto Github PK
View Code? Open in Web Editor NEW0day Windows/x64 Inject All Processes With Meterpreter Reverse Shell Shellcode (655 bytes)