mirror of
https://github.com/andreisss/Remote-DLL-Injection-with-Timer-based-Shellcode-Execution
synced 2026-06-06 15:14:31 +00:00
Andrea Bocchetti
59 lines
2.2 KiB
Markdown
59 lines
2.2 KiB
Markdown
# Thread Pool Timer Process Injection
|
|
|
|
> ⚠ **Educational Research Only**
|
|
> This repository contains security research for **educational purposes** and **authorized use only**.
|
|
> Use responsibly and in accordance with all applicable laws and regulations.
|
|
|
|
---
|
|
|
|
## Overview
|
|
|
|
**Thread Pool Timer Process Injection** is a novel technique that leverages the Windows thread pool infrastructure to execute shellcode. By combining traditional DLL injection with the `CreateThreadpoolTimer` API, this method enables in-memory code execution through legitimate system-managed threads—potentially bypassing many modern detection mechanisms.
|
|
|
|
This approach introduces a stealthy execution vector that avoids classic API hooks such as `CreateRemoteThread`, `NtCreateThreadEx`, and APCs, making it highly attractive for red team operations and malware research.
|
|
|
|
---
|
|
|
|
|
|
|
|
---
|
|
|
|
---
|
|
|
|
🛠️ Technical Implementation
|
|
|
|
<img width="732" height="172" alt="image" src="https://github.com/user-attachments/assets/60df6f0d-b2e9-4d88-88c1-da88a3d1217a" />
|
|
|
|
---
|
|
|
|
## 🧩 Core Components
|
|
|
|
### 🛠 Main Injector (`Injector.cpp`)
|
|
- Process enumeration and targeting logic
|
|
- DLL injection using `CreateRemoteThread` and `LoadLibraryW`
|
|
- Error handling and execution status reporting
|
|
|
|
### ⏲ Timer DLL (`TimerDLL.cpp`)
|
|
- Timer-based shellcode execution implementation
|
|
- `TP_CALLBACK_ENVIRON` structure setup for thread pool configuration
|
|
- Execution of shellcode via the timer callback
|
|
|
|
|
|
## 📋 API Sequence
|
|
|
|
### 🧪 Traditional Injection APIs
|
|
```cpp
|
|
OpenProcess() // Access the target process
|
|
VirtualAllocEx() // Allocate memory in remote process
|
|
WriteProcessMemory() // Write shellcode or DLL path
|
|
CreateRemoteThread() // Create a remote thread to execute payload
|
|
LoadLibraryW() // Load a DLL via thread execution
|
|
|
|
|
|
⏱️ Thread Pool Timer-Based APIs
|
|
|
|
InitializeThreadpoolEnvironment() // Configure threadpool callback environment
|
|
CreateThreadpoolTimer() // Create a timer object
|
|
SetThreadpoolTimer() // Schedule the timer for execution
|
|
TimerCallback() // Callback function that executes shellcode
|