From 4dfab3bec70b3b9f2f47ac69a17128a78e2d729a Mon Sep 17 00:00:00 2001 From: Alex Davies Date: Sun, 5 Nov 2017 09:45:35 +0000 Subject: [PATCH] Update README.md --- README.md | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 4d4c709..036a650 100644 --- a/README.md +++ b/README.md @@ -10,10 +10,14 @@ https://github.com/peterferrie/win-exec-calc-shellcode ### Contents +- apc-injection-any-process.cs - APC injection using QueueAPC into a currently running remote process. This method relies on the threads within the process entering an alertable state. + +- apc-injection-new-process.cs - APC injection using QueueAPC into a newly created process. As the threads of a newly created process will be alertable its easier to trigger APC usage with this technique, although you will generate a new process. + +- iat-injection.cs - Modify a specific import pointer for a target function within a specific process to point to shellcode before continuing to execute the legitimate function. + - process-dll-injection.cs - Classic dll injection where the path to a dll on disk is injected in a running process and then loaded with a call to CreateRemoteThread passing LoadLibrary and the dll path. - thread-hijack.cs - This example suspends a thread within a running process, injects shellcode in the process and redirects execution of an existing thread to the shellcode. Once the shellcode is executed the thread will continue as before. -- apc-injection-any-process.cs - APC injection using QueueAPC into a currently running remote process. This method relies on the threads within the process entering an alertable state. -- apc-injection-new-process.cs - APC injection using QueueAPC into a newly created process. As the threads of a newly created process will be alertable its easier to trigger APC usage with this technique, although you will generate a new process.