MythicAgents / thanatos

Mythic C2 agent targeting Linux and Windows hosts written in Rust
BSD 3-Clause "New" or "Revised" License
310 stars 42 forks source link

Shellcode doesn't work with the most common process injection technique #7

Open b1scoito opened 2 years ago

b1scoito commented 2 years ago

Hello, I tried injecting the generated shellcode from mythic with the injector present on the pe2shc project which uses the most common routine to inject a shellcode on a remote process and it doesn't work, it simply does absolutely nothing when injected. I find it really intriguing is that you create the shellcode with donut but donut as of right now apparently doesn't support binaries with no relocation data, same with pe2shc. I also tried creating the shellcode myself from the Windows binary (which works perfectly) and it won't work out because it doesn't have relocation data.