search

bats3c / shad0w

A post exploitation framework designed to operate covertly on heavily monitored environments
https://blog.dylan.codes/shad0w/
MIT License
2.03k stars 322 forks source link

migrate and binject don't work on idle processes #65

Open leebaird opened 3 years ago

leebaird commented 3 years ago

The migrate and binject commands don't work on idle processes.

User: lee | Computer: test | OS: Windows 10 (x64) | Secure: Yes | Ping: 1s

shad0w(lee@target) ≫ getpid
[i] Beacon (27b2499bf0f3386ba90ab1830860d292) received task
PID: 10744
Image: rundll32.exe

shad0w(lee@target) ≫ ps
[i] Beacon (27b2499bf0f3386ba90ab1830860d292) received task
PID     PPID    Arch    User                              Name
===     ====    ====    ====                              ====

0       0                                                 [System Process]
4       0                                                 System
120     4                                                 Registry
636     4                                                 smss.exe
964     744                                               csrss.exe
672     744                                               wininit.exe
676     592                                               csrss.exe
936     672                                               services.exe
5592    1188    x64     ACME-CORP\lee                     SystemSettings.exe

shad0w(lee@test) ≫ migrate -p 5592
[i] Beacon (27b2499bf0f3386ba90ab1830860d292) received task

shad0w(lee@test) ≫ getpid
[i] Beacon (27b2499bf0f3386ba90ab1830860d292) received task
PID: 10744
Image: rundll32.exe

Same results with the binject command.

Note: I tried migrating to a process that I know was active (Chrome) and it worked.

ghost commented 3 years ago

im having similar issues with shinject and all other injection methods. even provided CS bin -f shellcode (x64 -> x64) and tried 32 just cuz. no luck :(