kmanc-remote_code_oxidation/process_migration

RCO: Process Migration

Linux target	Windows target

How it works

Windows process migration works by obtaining a handle to the target process and writing shellcode to it. A remote thread is then created; the starting point of this thread is the newly written shellcode.

Linux process migration works slightly differently. After temporarily pausing the target process, RCO writes shellcode over the process's instruction pointer. This can cause issues (the most likely of which is crashing) for the victim machine.

Using it

1. [Not shown in GIF] Generate shellcode for the desired end result (for example, use msfvenom to generate a reverse TCP shell shellcode for the target operating system)

2. [Not shown in GIF] Open the config file and change the shellcode to the shellcode generated in step 1

3. [Optional] Encrypt the shellcode using xor_shellcode and update the encrypted shellcode value in the config file

4. [Not shown in GIF] Compile the executable, only including --features encrypted if you did step 3

   Build for Linux target

   cargo build -p process_migration [--features encrypted] --release
   

   Build for Windows target

   cargo build --target x86_64-pc-windows-gnu -p process_migration [--features encrypted] --release
   

5. Start a netcat listener on the attacking machine on the same port you configured the shellcode to connect to in step 1

   nc -nlvp 4444
   

6. Execute the payload on the victim machine

7. Return to the listener and enter desired commands for the victim machine to run

Detection rates

Linux

Unencrypted - 7 / 40	Encrypted with --features encrypted - 0 / 40

Windows

Unencrypted - 13 / 40	Encrypted with --features encrypted - 1 / 40