Collection of remote Shellcode Loaders using Asyncronous Procedure Calls. The code is pretty simple and uses high level libraries (easy to flag) and encrypted shellcode. This code is for educational purposes only, do not use it for any malicious or unauthorized activity.

💻 Code

This repo consists of 3 projects that have the same basic structure and share most of the code, they are: APC Process injection, DLL version (targeting its own process), and a DLL Injector (LoadLibrary using APC), the shellcode is for a windows msg box. In all 3 of the samples there are 2 versions of choosing the thread to queue the shellcode/dll:

We either find the first thread and queue to it;
Or we enumerate every thread of the process and queue to all of them.

1) APC Simple Process Injection

Queues shellcode execution to a remote process, here's the flow:

First the shellcode is decrypted, for a better view of the encryption mechanism check it out here;
Secondly we find and take a handle to the process by enumerating a snapshot of the system's processes;
Then we do the classic Allocate -> Write/Copy -> Protect RWX in the remote process;
Then we either queue the shellcode to the first thread we find or to all threads of the process with the function ShotgunApc.

2) DLL Version

Dll version that does the exact same thing in the process its' being injected into, you could replace this:

if (!GetProcess(lpProcessName, &pid, &hProcess)) {
		printf("Failed to get process handle/pid"); }

with something like this:

pid = GetCurrentProcessId()
hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_SET_INFORMATION | PROCESS_SET_QUOTA |
					PROCESS_VM_OPERATION | PROCESS_VM_READ | PROCESS_VM_WRITE | SYNCHRONIZE, FALSE, pid);

The new thread outside the loader lock is essential to avoid deadlock. You also might want to disable precompiled headers to remove the pch files and Visual Studio errors.

The Dll might not work if it's being injected by the Early Bird injector (which i will upload in the future)

3) DLL Injection

Loads a malicious Dll in a remote process queueing LoadLibraryA to it, before building the exe insert the Dll next to the other files. Here's the flow:

First the dll (considered a resource) is extracted from the exe and written to disk, and calculate its path/size/name lenght and other info;
Secondly we find and take a handle to the process by enumerating a snapshot of the system's processes;
Then we allocate memory the size of the dll path inside of it, write the path into the process, make it RWX;
Then we get the base address of kernel32 dll to get the pointer of the function which will load the malicious library;
Finally we queue the base address of the Dll using loadlibrary to the process, either to its first thread or to all of them.

🛡️ AV Detection

On the right are the virus total detections for the 3 samples and some of their obfuscated versions.

The first and last are easily blocked by bitdefender and sometimes windows defender.

The DLL bypasses them both except for Bitdefender Advanced Threat Defense (which Is very difficult to bypass i've tried everything xd).

I've obduscated them using resource hacker and uploading VisualStudioSetup (in the simple and injector) and ntdll.dll (in the dll), the detections drop significantly, especially for the dll.