# RemoteTLSCallbackInjection | Utilizing TLS Callbacks To Execute A Payload

**URL:** <https://onehack.st/t/remotetlscallbackinjection-utilizing-tls-callbacks-to-execute-a-payload/281734>\
**Category:** Tools & Scripts\
**Tags:** tools, hacking, networking\
**Created:** [April 23, 2024, 7:41pm UTC](https://onehack.st/t/remotetlscallbackinjection-utilizing-tls-callbacks-to-execute-a-payload/281734 "2024-04-23T19:41:16Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![WhiteHat](https://onehack.st/user_avatar/onehack.st/whitehat/32/162514_2.png) [@WhiteHat](https://onehack.st/u/WhiteHat)\
**Post date:** [April 23, 2024, 7:41pm UTC](https://onehack.st/t/remotetlscallbackinjection-utilizing-tls-callbacks-to-execute-a-payload/281734/1 "2024-04-23T19:41:17Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/5/0/50b0a46831b5759aa005a910bfcb75f0f74a0517.png)

# Maldev Academy - RemoteTLSCallbackInjection

## Quick Links

[Maldev Academy Home](https://maldevacademy.com/)

[Maldev Academy Syllabus](https://maldevacademy.com/syllabus)

## Related Maldev Academy Modules

[New Module 34: TLS Callbacks For Anti-Debugging](https://maldevacademy.com/new/modules/34)

[New Module 35: Threadless Injection](https://maldevacademy.com/new/modules/35)

## Overview

This method utilizes TLS callbacks to execute a payload without spawning any threads in a remote process. This method is inspired by [Threadless Injection](https://github.com/CCob/ThreadlessInject/tree/master) as RemoteTLSCallbackInjection does not invoke any API calls to trigger the injected payload.

## Implementation Steps

The PoC follows these steps:

1. Create a suspended process using the `CreateProcessViaWinAPIsW` function (i.e. `RuntimeBroker.exe`).
2. Fetch the remote process image base address followed by reading the process’s PE headers.
3. Fetch an address to a TLS callback function.
4. Patch a fixed shellcode (i.e. [g\_FixedShellcode](https://github.com/Maldev-Academy/RemoteTLSCallbackInjection/blob/main/RemoteTLSCallbackInjection/main.c#L56)) with runtime-retrieved values. This shellcode is responsible for restoring both original bytes and memory permission of the TLS callback function’s address.
5. Inject both shellcodes: `g_FixedShellcode` and the main payload.
6. Patch the TLS callback function’s address and replace it with the address of our injected payload.
7. Resume process.

The `g_FixedShellcode` shellcode will then make sure that the main payload executes only once by restoring the original TLS callback’s original address before calling the main payload. A TLS callback can execute multiple times across the lifespan of a process, therefore it is important to control the number of times the payload is triggered by restoring the original code path execution to the original TLS callback function.

### Demo

The following image shows our implementation, `RemoteTLSCallbackInjection.exe`, spawning a `cmd.exe` as its main payload.

[![demo](https://private-user-images.githubusercontent.com/111295429/298410672-1b1b2c9c-17af-490c-8d77-ea11f53ccfaf.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MTM5MDE0NTksIm5iZiI6MTcxMzkwMTE1OSwicGF0aCI6Ii8xMTEyOTU0MjkvMjk4NDEwNjcyLTFiMWIyYzljLTE3YWYtNDkwYy04ZDc3LWVhMTFmNTNjY2ZhZi5wbmc_WC1BbXotQWxnb3JpdGhtPUFXUzQtSE1BQy1TSEEyNTYmWC1BbXotQ3JlZGVudGlhbD1BS0lBVkNPRFlMU0E1M1BRSzRaQSUyRjIwMjQwNDIzJTJGdXMtZWFzdC0xJTJGczMlMkZhd3M0X3JlcXVlc3QmWC1BbXotRGF0ZT0yMDI0MDQyM1QxOTM5MTlaJlgtQW16LUV4cGlyZXM9MzAwJlgtQW16LVNpZ25hdHVyZT1kODc2ZjI2MDRiYjQyZjA2MWNkNjAwZjZkNmZiMGU2NWJiMDM4NDVhOWMyMGMwOWJmOGRkMTYyYThhZTY1NTlkJlgtQW16LVNpZ25lZEhlYWRlcnM9aG9zdCZhY3Rvcl9pZD0wJmtleV9pZD0wJnJlcG9faWQ9MCJ9.s_QCZ84-O0IOcF0fc2qQsqBgKQD_RVZTcILd8l2B_f4)](https://private-user-images.githubusercontent.com/111295429/298410672-1b1b2c9c-17af-490c-8d77-ea11f53ccfaf.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MTM5MDE0NTksIm5iZiI6MTcxMzkwMTE1OSwicGF0aCI6Ii8xMTEyOTU0MjkvMjk4NDEwNjcyLTFiMWIyYzljLTE3YWYtNDkwYy04ZDc3LWVhMTFmNTNjY2ZhZi5wbmc_WC1BbXotQWxnb3JpdGhtPUFXUzQtSE1BQy1TSEEyNTYmWC1BbXotQ3JlZGVudGlhbD1BS0lBVkNPRFlMU0E1M1BRSzRaQSUyRjIwMjQwNDIzJTJGdXMtZWFzdC0xJTJGczMlMkZhd3M0X3JlcXVlc3QmWC1BbXotRGF0ZT0yMDI0MDQyM1QxOTM5MTlaJlgtQW16LUV4cGlyZXM9MzAwJlgtQW16LVNpZ25hdHVyZT1kODc2ZjI2MDRiYjQyZjA2MWNkNjAwZjZkNmZiMGU2NWJiMDM4NDVhOWMyMGMwOWJmOGRkMTYyYThhZTY1NTlkJlgtQW16LVNpZ25lZEhlYWRlcnM9aG9zdCZhY3Rvcl9pZD0wJmtleV9pZD0wJnJlcG9faWQ9MCJ9.s_QCZ84-O0IOcF0fc2qQsqBgKQD_RVZTcILd8l2B_f4)

## GitHub:

> **[GitHub - Maldev-Academy/RemoteTLSCallbackInjection: Utilizing TLS callbacks to execute a payload...](https://github.com/Maldev-Academy/RemoteTLSCallbackInjection)**
>
> Utilizing TLS callbacks to execute a payload without spawning any threads in a remote process