mirror of
https://github.com/andreisss/Remote-DLL-Injection-with-Timer-based-Shellcode-Execution
synced 2026-06-06 15:14:31 +00:00
Andrea Bocchetti
43 lines
1.5 KiB
Markdown
43 lines
1.5 KiB
Markdown
# Remote DLL Injection with Timer-based Shellcode Execution
|
|
|
|
### Documentation updated from previous mistake proces injection title! ###
|
|
|
|
|
|
> ⚠ **Educational Research Only**
|
|
> This repository contains security research for **educational purposes** and **authorized use only**.
|
|
> Use responsibly and in accordance with all applicable laws and regulations.
|
|
|
|
---
|
|
|
|
## Overview
|
|
|
|
**Remote DLL Injection with Timer-based Shellcode Execution** is a technique that leverages the Windows thread pool to execute shellcode. Using the classic DLL injection with CreateThreadpoolTimer to run shellcode in-memory using legit system threads, stealthy, and likely to slip past modern defenses
|
|
|
|
This approach introduces a stealthy execution using Timer-based Shellcode Execution
|
|
|
|
---
|
|
|
|
|
|
|
|
---
|
|
|
|
---
|
|
|
|
🛠️ Technical Implementation
|
|
|
|
<img width="732" height="172" alt="image" src="https://github.com/user-attachments/assets/60df6f0d-b2e9-4d88-88c1-da88a3d1217a" />
|
|
|
|
---
|
|
|
|
## 🧩 Core Components
|
|
|
|
### 🛠 Main Injector (`ConsoleApplication5.cpp`)
|
|
- Process enumeration and targeting logic
|
|
- DLL injection using `CreateRemoteThread` and `LoadLibraryW`
|
|
- Error handling and execution status reporting
|
|
|
|
### ⏲ Timer DLL (`Dll1.cpp`)
|
|
- Timer-based shellcode execution implementation
|
|
- `TP_CALLBACK_ENVIRON` structure setup for thread pool configuration
|
|
- Execution of shellcode via the timer callback
|