search

ufrisk / MemProcFS

MemProcFS
GNU Affero General Public License v3.0
2.98k stars 364 forks source link

Inject DLL #160

Closed SaionjiMKII closed 1 year ago

SaionjiMKII commented 1 year ago

Does anyone have a way to inject a DLL into a process?

jimster480 commented 1 year ago

Well that is fairly easy since you could read and write memory. You could either manual map or write a stub in that loads your dll.

On Thu, Dec 29, 2022, 11:33 AM Quazar @.***> wrote:

Does anyone have a way to inject a DLL into a process?

— Reply to this email directly, view it on GitHub https://github.com/ufrisk/MemProcFS/issues/160, or unsubscribe https://github.com/notifications/unsubscribe-auth/AA2Z3WH2FZR2GBNT3XLGDVLWPW4M7ANCNFSM6AAAAAATMHKEYI . You are receiving this because you are subscribed to this thread.Message ID: @.***>

ufrisk commented 1 year ago

It's not supported by default, but it should be straightforward to do, even if a bit complicated.

I've refrained from adding offensive capabilities to MemProcFS. MemProcFS is for memory forensics only. I've added the offensive capabilities in the PCILeech project. But currently PCILeech only support kernel injections - not arbitrary injections in user mode.

My guess is that you'd need to insert some shellcode in a code cave, place a hook somewhere to gain code execution, then allocate some memory (and write to it so it gets committed), DMA your DLL in there, and then let the Shellcode manual map it correctly with correct page permissions etc.

I'm not aware if this had been done already by someone else.

SaionjiMKII commented 1 year ago

Could you help me with that? I can pay you for your help.

ufrisk commented 1 year ago

@RiasGremoryCPP Most likely not. I'm both overly busy already and I'm also extremely wary of taking on offensive work. If you represent a trusted well-known organization it may be possible still. Please send me an email in that case. Otherwise unfortunately not.

SaionjiMKII commented 1 year ago

Okay, thanks for that at least!