mirror of
https://github.com/Offensive-Panda/ProcessInjectionTechniques
synced 2026-06-06 16:24:33 +00:00
Usman Sikander
351 lines
19 KiB
HTML
351 lines
19 KiB
HTML
---
|
||
layout: default
|
||
---
|
||
|
||
<!DOCTYPE html>
|
||
<html lang="en">
|
||
<head>
|
||
<meta charset="UTF-8">
|
||
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
||
<title>Process Injection</title>
|
||
<style>
|
||
body {
|
||
font-family: Arial, sans-serif;
|
||
background-color: #000;
|
||
color: #fff;
|
||
margin: 0;
|
||
padding: 0;
|
||
}
|
||
header {
|
||
text-align: center;
|
||
padding: 50px 0;
|
||
background-color: #333;
|
||
color: white;
|
||
}
|
||
.content-section {
|
||
width: 90%;
|
||
max-width: 1200px;
|
||
margin: 20px auto;
|
||
padding: 20px;
|
||
}
|
||
.content-section h2 {
|
||
color: #fff;
|
||
border-bottom: 2px solid #fff;
|
||
padding-bottom: 10px;
|
||
margin-bottom: 20px;
|
||
}
|
||
.content-section p {
|
||
line-height: 1.6;
|
||
color: #ccc;
|
||
}
|
||
.card-container {
|
||
display: flex;
|
||
flex-wrap: wrap;
|
||
gap: 20px;
|
||
justify-content: center;
|
||
}
|
||
.card {
|
||
width: 100%;
|
||
max-width: 600px;
|
||
background-color: #fff;
|
||
border: 1px solid #ddd;
|
||
border-radius: 8px;
|
||
box-shadow: 0 2px 8px rgba(0, 0, 0, 0.1);
|
||
overflow: hidden;
|
||
position: relative;
|
||
padding: 20px;
|
||
color: #000;
|
||
transition: transform 0.3s;
|
||
}
|
||
.card:hover {
|
||
transform: scale(1.05);
|
||
}
|
||
.card h3 {
|
||
font-size: 1.5em;
|
||
margin: 0;
|
||
margin-bottom: 10px;
|
||
color: #000;
|
||
}
|
||
.card img.technique-image {
|
||
width: 200px;
|
||
height: 200px;
|
||
object-fit: cover;
|
||
float: left;
|
||
margin-right: 20px;
|
||
}
|
||
.card img.windows-icon {
|
||
position: absolute;
|
||
top: 20px;
|
||
right: 20px;
|
||
width: 24px;
|
||
height: 24px;
|
||
opacity: 0.7;
|
||
}
|
||
.card p {
|
||
font-size: 1em;
|
||
color: #555;
|
||
margin-left: 120px;
|
||
}
|
||
body {
|
||
font-family: Arial, sans-serif;
|
||
background-color: #000;
|
||
color: #fff;
|
||
margin: 20px;
|
||
}
|
||
.heatmap {
|
||
display: grid;
|
||
grid-template-columns: repeat(4, 1fr);
|
||
gap: 10px;
|
||
max-width: 1200px;
|
||
margin: 0 auto;
|
||
}
|
||
.heatmap-item {
|
||
background-color: #fff;
|
||
color: #000;
|
||
border: 1px solid #ddd;
|
||
border-radius: 5px;
|
||
padding: 10px;
|
||
text-align: center;
|
||
position: relative;
|
||
transition: background-color 0.3s, color 0.3s;
|
||
}
|
||
.heatmap-item:hover {
|
||
background-color: #f0f0f0;
|
||
color: #000;
|
||
}
|
||
.heatmap-item::after {
|
||
content: attr(data-tooltip);
|
||
position: absolute;
|
||
bottom: 100%;
|
||
left: 50%;
|
||
transform: translateX(-50%);
|
||
background-color: #333;
|
||
color: #fff;
|
||
padding: 5px;
|
||
border-radius: 3px;
|
||
white-space: nowrap;
|
||
opacity: 0;
|
||
transition: opacity 0.3s;
|
||
font-size: 14px;
|
||
}
|
||
.heatmap-item:hover::after {
|
||
opacity: 1;
|
||
}
|
||
</style>
|
||
</head>
|
||
<body>
|
||
<div align="center">
|
||
<img width="400px" src="Assets/PE.jpg" alt="Injection Series" />
|
||
<br />
|
||
</div>
|
||
|
||
<div class="content-section">
|
||
<h2>C:\Users\Offensive-Panda>whoami</h2>
|
||
<p> <B>Usman Sikander</B> (a.k.a Offensive-Panda) is a seasoned security professional specializing in adversary emulation, malware analysis, and red teaming. With a focus on practical application, he excels in analyzing real-world threats to extract Tactics, Techniques, and Procedures (TTPs), validating security postures through Advanced Persistent Threat (APT) emulations, and developing exploits across MITRE ATT&CK tactics. His expertise lies in enhancing security measures by leveraging meticulous research and hands-on experience.</p>
|
||
<h2>Purpose</h2>
|
||
<p>The purpose of the Process Injection Series is to share valuable knowledge with the cybersecurity community, particularly those eager to learn about malware development and advanced evasion techniques. Through this series, I aim to not only expand my own expertise but also provide a centralized resource for all tactics, techniques, and procedures (TTPs) related to process injection. By doing so, I hope to empower others with the skills and understanding needed to navigate and contribute to the evolving landscape of cybersecurity.</p>
|
||
<h2>Shellcode</h2>
|
||
<p>Throughout the series, I will be using my custom-generated shellcode, which displays a message box with the text "Hello from Offensive Panda." This shellcode serves as a consistent and straightforward payload for demonstrating various process injection techniques. However, you are encouraged to experiment with different shellcodes tailored to your needs, allowing you to explore and apply the concepts in ways that best suit your learning objectives or project requirements.</p>
|
||
<h2>Process Injection Techniques Heatmap</h2>
|
||
<div class="heatmap">
|
||
<div class="heatmap-item" data-tooltip="Injects code into a local process’s memory space.">Classic Code Injection Local Process</div>
|
||
<div class="heatmap-item" data-tooltip="Injects code into a remote process’s memory space.">Classic Code Injection Remote Process</div>
|
||
<div class="heatmap-item" data-tooltip="Injects code with obfuscated API calls to avoid detection.">Classic Code Injection with API Obfuscation</div>
|
||
<div class="heatmap-item" data-tooltip="Uses VirtualProtect to modify memory protection and inject code.">Classic Code Injection VirtualProtect</div>
|
||
<div class="heatmap-item" data-tooltip="Injects a DLL into a process’s address space.">Classic DLL Injection</div>
|
||
<div class="heatmap-item" data-tooltip="Injects and loads a DLL into memory without standard API functions.">Reflective DLL Injection</div>
|
||
<div class="heatmap-item" data-tooltip="Injects and loads a DLL into a process’s memory without relying on the traditional Windows API functions.">Reflective DLL Loading (Lagos Island)</div>
|
||
<div class="heatmap-item" data-tooltip="Creates a process in a suspended state, replaces its code with malicious code">Process Hollowing</div>
|
||
<div class="heatmap-item" data-tooltip="Injects a PE file into a process for execution.">PE Injection</div>
|
||
<div class="heatmap-item" data-tooltip="Modifies the entry point address of an executable for code injection.">AddressOfEntryPoint Injection</div>
|
||
<div class="heatmap-item" data-tooltip="Uses APCs to execute code within a process’s thread.">APC Injection</div>
|
||
<div class="heatmap-item" data-tooltip="Injects code early in the process’s execution.">Early Bird Injection</div>
|
||
<div class="heatmap-item" data-tooltip="Searches for RWX memory regions to inject and execute code.">RWX Hunting Injection</div>
|
||
<div class="heatmap-item" data-tooltip="Exploits file system operations for code injection.">Doppelganging Injection</div>
|
||
<div class="heatmap-item" data-tooltip="Walks through the PEB to locate and inject code.">PEB Walk Injection</div>
|
||
<div class="heatmap-item" data-tooltip="Combines PEB walking with obfuscation techniques.">PEB Walk and Obfuscation Technique</div>
|
||
<div class="heatmap-item" data-tooltip="Uses NtCreateThread and NtMapViewOfSection for code injection.">NtCreateThread and Map View</div>
|
||
<div class="heatmap-item" data-tooltip="Advanced injection technique with sophisticated methods.">Mokingjay</div>
|
||
<div class="heatmap-item" data-tooltip="Uses the Fork API to create a child process and inject code.">Fork API Injection</div>
|
||
<div class="heatmap-item" data-tooltip="Injects code using fibers, a lightweight thread-like construct.">Injection through Fibers</div>
|
||
<div class="heatmap-item" data-tooltip="Uses low-level NT Native API functions for code injection.">NT API Injection</div>
|
||
<div class="heatmap-item" data-tooltip="Executes system calls directly for code injection.">Direct Syscalls</div>
|
||
<div class="heatmap-item" data-tooltip="Uses indirect methods like function pointers for system calls.">Indirect Syscalls</div>
|
||
</div>
|
||
</div>
|
||
<div class="content-section">
|
||
<h2>Process Injection Series</h2>
|
||
<div class="card-container">
|
||
<!-- Example of a Card -->
|
||
<a href="Classic_Code_Injection_Local/Assets/readme.md" class="card">
|
||
<h3>PE 1 - Classic Code Injection Local Process</h3>
|
||
<img src="Assets/classic-local.jpg" alt="Technique Image" class="technique-image">
|
||
<img src="Assets/windows-icon.png" class="windows-icon" alt="Windows Icon">
|
||
<p>Injects code into a local process’s memory space, allowing the code to be executed within the context of that process.</p>
|
||
</a>
|
||
|
||
<a href="pe1.html" class="card">
|
||
<h3>PE 2 - Classic Code Injection Remote Process</h3>
|
||
<img src="Assets/classic-remote.jpg" alt="Technique Image" class="technique-image">
|
||
<img src="Assets/windows-icon.png" class="windows-icon" alt="Windows Icon">
|
||
<p>Injects code into a remote process’s memory space, enabling the injected code to run in the context of that process..</p>
|
||
</a>
|
||
|
||
<a href="pe1.html" class="card">
|
||
<h3>PE 3 - Classic Code Injection with API Obfuscation</h3>
|
||
<img src="Assets/api-obf.jpg" alt="Technique Image" class="technique-image">
|
||
<img src="Assets/windows-icon.png" class="windows-icon" alt="Windows Icon">
|
||
<p>Injects code into a process while obfuscating API calls to avoid detection by security mechanisms.</p>
|
||
</a>
|
||
|
||
<a href="pe1.html" class="card">
|
||
<h3>PE 4 - Classic Code Injection VirtualProtect</h3>
|
||
<img src="Assets/ccvp_AI.jpg" alt="Technique Image" class="technique-image">
|
||
<img src="Assets/windows-icon.png" class="windows-icon" alt="Windows Icon">
|
||
<p>Uses the VirtualProtect API to modify memory protection attributes, allowing code injection into a process.</p>
|
||
</a>
|
||
|
||
<a href="pe1.html" class="card">
|
||
<h3>PE 5 - Classic DLL Injection</h3>
|
||
<img src="Assets/classic-dll.jpg" alt="Technique Image" class="technique-image">
|
||
<img src="Assets/windows-icon.png" class="windows-icon" alt="Windows Icon">
|
||
<p>Injects a DLL into a process’s address space, allowing the DLL to be executed within that process.</p>
|
||
</a>
|
||
|
||
<a href="pe1.html" class="card">
|
||
<h3>PE 6 - Reflective DLL Injection</h3>
|
||
<img src="Assets/rdll_AI.jpg" alt="Technique Image" class="technique-image">
|
||
<img src="Assets/windows-icon.png" class="windows-icon" alt="Windows Icon">
|
||
<p>Injects and loads a DLL into a process’s memory without relying on the traditional Windows API functions.</p>
|
||
</a>
|
||
|
||
<a href="pe1.html" class="card">
|
||
<h3>PE 7 - Reflective DLL Loading (Lagos Island)</h3>
|
||
<img src="Assets/lagos_AI.jpg" alt="Technique Image" class="technique-image">
|
||
<img src="Assets/windows-icon.png" class="windows-icon" alt="Windows Icon">
|
||
<p>Manually loads the ntdll.dll from server into memroy resolves APIs dynamically and Injection shellcode bypassing user-mode EDR hooks. </p>
|
||
</a>
|
||
<a href="pe1.html" class="card">
|
||
<h3>PE 8 -Process Hollowing</h3>
|
||
<img src="Assets/ph_AI.jpg" alt="Technique Image" class="technique-image">
|
||
<img src="Assets/windows-icon.png" class="windows-icon" alt="Windows Icon">
|
||
<p>Creates a process in a suspended state, replaces its code with malicious code, and resumes it, causing the process to execute the injected code while appearing legitimate. </p>
|
||
</a>
|
||
|
||
<a href="pe1.html" class="card">
|
||
<h3>PE 9 - PE Injection</h3>
|
||
<img src="Assets/pei_AI.jpg" alt="Technique Image" class="technique-image">
|
||
<img src="Assets/windows-icon.png" class="windows-icon" alt="Windows Icon">
|
||
<p>Injects a Portable Executable (PE) file into a process, allowing the PE file to be executed within the target process.</p>
|
||
</a>
|
||
|
||
<a href="pe1.html" class="card">
|
||
<h3>PE 10 - AddressofEntryPoint Injection</h3>
|
||
<img src="Assets/wpm_AI.jpg" alt="Technique Image" class="technique-image">
|
||
<img src="Assets/windows-icon.png" class="windows-icon" alt="Windows Icon">
|
||
<p>Injects code into a process by modifying the entry point address of the target executable using WPM magic.</p>
|
||
</a>
|
||
|
||
<a href="pe1.html" class="card">
|
||
<h3>PE 11 - APC Injection</h3>
|
||
<img src="Assets/apc_AI.jpg" alt="Technique Image" class="technique-image">
|
||
<img src="Assets/windows-icon.png" class="windows-icon" alt="Windows Icon">
|
||
<p>Uses Asynchronous Procedure Calls (APCs) to execute code within the context of a target process's thread.</p>
|
||
</a>
|
||
|
||
<a href="pe1.html" class="card">
|
||
<h3>PE 12 - Early Bird Injection</h3>
|
||
<img src="Assets/ebird_AI.jpg" alt="Technique Image" class="technique-image">
|
||
<img src="Assets/windows-icon.png" class="windows-icon" alt="Windows Icon">
|
||
<p> Injects code into a process early in its execution, often during process initialization.</p>
|
||
</a>
|
||
|
||
<a href="pe1.html" class="card">
|
||
<h3>PE 13 - RWX Hunting Injection</h3>
|
||
<img src="Assets/rwx_AI.jpg" alt="Technique Image" class="technique-image">
|
||
<img src="Assets/windows-icon.png" class="windows-icon" alt="Windows Icon">
|
||
<p>Searches for memory regions with Read-Write-Execute (RWX) permissions to inject and execute code.</p>
|
||
</a>
|
||
|
||
<a href="pe1.html" class="card">
|
||
<h3>PE 14 - Doppelganging Injection</h3>
|
||
<img src="Assets/dop_AI.jpg" alt="Technique Image" class="technique-image">
|
||
<img src="Assets/windows-icon.png" class="windows-icon" alt="Windows Icon">
|
||
<p>Exploits the Windows file system to inject code by manipulating legitimate processes and file operations.</p>
|
||
</a>
|
||
</a>
|
||
|
||
<a href="pe1.html" class="card">
|
||
<h3>PE 15 - PEB Walk Injection</h3>
|
||
<img src="Assets/peb_AI.jpg" alt="Technique Image" class="technique-image">
|
||
<img src="Assets/windows-icon.png" class="windows-icon" alt="Windows Icon">
|
||
<p>Walks through the Process Environment Block (PEB) to locate and inject code into a process.</p>
|
||
</a>
|
||
|
||
<a href="pe1.html" class="card">
|
||
<h3>PE 16 - PEB Walk and Obfuscation Technique</h3>
|
||
<img src="Assets/pebwalk_AI.jpg" alt="Technique Image" class="technique-image">
|
||
<img src="Assets/windows-icon.png" class="windows-icon" alt="Windows Icon">
|
||
<p>Combines PEB walking with obfuscation techniques to inject code while evading detection..</p>
|
||
</a>
|
||
|
||
<a href="pe1.html" class="card">
|
||
<h3>PE 17 - NtCreateThread and Map View</h3>
|
||
<img src="Assets/ntthreat_AI.jpg" alt="Technique Image" class="technique-image">
|
||
<img src="Assets/windows-icon.png" class="windows-icon" alt="Windows Icon">
|
||
<p>Uses the NtCreateThread and NtMapViewOfSection functions to inject and execute code in a process.</p>
|
||
</a>
|
||
|
||
<a href="pe1.html" class="card">
|
||
<h3>PE 18 - Mokingjay</h3>
|
||
<img src="Assets/mok_AI.jpg" alt="Technique Image" class="technique-image">
|
||
<img src="Assets/windows-icon.png" class="windows-icon" alt="Windows Icon">
|
||
<p>Loads vulnerable DLL with RWX memory region and injection shellcode using it in local process.</p>
|
||
</a>
|
||
|
||
<a href="pe1.html" class="card">
|
||
<h3>PE 19 - Fork API Injection</h3>
|
||
<img src="Assets/fork_AI.jpg" alt="Technique Image" class="technique-image">
|
||
<img src="Assets/windows-icon.png" class="windows-icon" alt="Windows Icon">
|
||
<p>Uses the Fork API to create a child process and then injects code into it.</p>
|
||
</a>
|
||
|
||
<a href="pe1.html" class="card">
|
||
<h3>PE 20 - Injection through Fibers</h3>
|
||
<img src="Assets/fiber_AI.jpg" alt="Technique Image" class="technique-image">
|
||
<img src="Assets/windows-icon.png" class="windows-icon" alt="Windows Icon">
|
||
<p>Utilizes fibers, a lightweight thread-like construct in Windows, to execute injected code.</p>
|
||
</a>
|
||
|
||
<a href="pe1.html" class="card">
|
||
<h3>PE 21 - NT API Injection</h3>
|
||
<img src="Assets/nt_AI.jpg" alt="Technique Image" class="technique-image">
|
||
<img src="Assets/windows-icon.png" class="windows-icon" alt="Windows Icon">
|
||
<p>Uses low-level NT Native API functions to inject code into a process.</p>
|
||
</a>
|
||
|
||
<a href="pe1.html" class="card">
|
||
<h3>PE 22 - Direct Syscalls</h3>
|
||
<img src="Assets/direct_AI.jpg" alt="Technique Image" class="technique-image">
|
||
<img src="Assets/windows-icon.png" class="windows-icon" alt="Windows Icon">
|
||
<p>Executes system calls directly to perform operations like code injection, bypassing standard Windows API functions.</p>
|
||
</a>
|
||
|
||
<a href="pe1.html" class="card">
|
||
<h3>PE 23 - Indirect Syscalls</h3>
|
||
<img src="Assets/indirect_AI.jpg" alt="Technique Image" class="technique-image">
|
||
<img src="Assets/windows-icon.png" class="windows-icon" alt="Windows Icon">
|
||
<p>Uses indirect methods to perform system calls for code injection.</p>
|
||
</a>
|
||
|
||
</div>
|
||
</div>
|
||
<div class="disclaimer">
|
||
<h2>Disclaimer</h2>
|
||
<p>The content, techniques, and tools provided in this repository are intended solely for educational and research purposes within the cybersecurity community. I explicitly disclaim any responsibility for the misuse or unlawful use of the provided materials. Any actions taken based on the information are done so at the user's own risk.</p>
|
||
</div>
|
||
|
||
</body>
|
||
</html>
|
||
|