# ThreadBoat | Program Uses Thread Execution Hijacking To Inject Native Shell-code Into A Standard Win32 Application

**URL:** <https://onehack.st/t/threadboat-program-uses-thread-execution-hijacking-to-inject-native-shell-code-into-a-standard-win32-application/207537>\
**Category:** Tools & Scripts\
**Tags:** tools, hacking\
**Created:** [November 22, 2021, 1:31pm UTC](https://onehack.st/t/threadboat-program-uses-thread-execution-hijacking-to-inject-native-shell-code-into-a-standard-win32-application/207537 "2021-11-22T13:31:56Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![TheStrength](https://onehack.st/user_avatar/onehack.st/thestrength/32/46753_2.png) [@TheStrength](https://onehack.st/u/TheStrength)\
**Post date:** [November 22, 2021, 1:31pm UTC](https://onehack.st/t/threadboat-program-uses-thread-execution-hijacking-to-inject-native-shell-code-into-a-standard-win32-application/207537/1 "2021-11-22T13:31:57Z")

</div>

[https://camo.githubusercontent.com/d54fb78d7f3fdc84e375b317048b4c0c2ff70529fba9f581554a838ac6f55127/68747470733a2f2f312e62702e626c6f6773706f742e636f6d2f2d70514358506b364e4242382f585a5535694c57584f46492f41414141414141415166342f32596a7643496d746c7141717968504b4c365f656131476e584a594e6953497741434e63424741735948512f733634302f546872656164426f61745f312e676966](https://camo.githubusercontent.com/d54fb78d7f3fdc84e375b317048b4c0c2ff70529fba9f581554a838ac6f55127/68747470733a2f2f312e62702e626c6f6773706f742e636f6d2f2d70514358506b364e4242382f585a5535694c57584f46492f41414141414141415166342f32596a7643496d746c7141717968504b4c365f656131476e584a594e6953497741434e63424741735948512f733634302f546872656164426f61745f312e676966)

Program uses Thread Hijacking to Inject Native Shellcode into a Standard Win32 Application.

## About

I developed this small project to continue my experiences of different code injection methods and to allow RedTeam security professionals to utilize this method as a unique way to perform software penetration testing. With Thread hijacking, it allows the hijacker.exe program to susepend a thread within the target.exe program allowing us to write shellcode to that target thread, and later be executed (via; WriteProcessMemory(), SetThreadContext(), ResumeThread(), CreateThread()).

### Example GIF (Credits To Endgame)

[![alt text](https://camo.githubusercontent.com/d54fb78d7f3fdc84e375b317048b4c0c2ff70529fba9f581554a838ac6f55127/68747470733a2f2f312e62702e626c6f6773706f742e636f6d2f2d70514358506b364e4242382f585a5535694c57584f46492f41414141414141415166342f32596a7643496d746c7141717968504b4c365f656131476e584a594e6953497741434e63424741735948512f733634302f546872656164426f61745f312e676966)](https://camo.githubusercontent.com/d54fb78d7f3fdc84e375b317048b4c0c2ff70529fba9f581554a838ac6f55127/68747470733a2f2f312e62702e626c6f6773706f742e636f6d2f2d70514358506b364e4242382f585a5535694c57584f46492f41414141414141415166342f32596a7643496d746c7141717968504b4c365f656131476e584a594e6953497741434e63424741735948512f733634302f546872656164426f61745f312e676966)

## Usage

int main() { System sys; Interceptor incp; Exception exp; sys.returnVersionState(); if (sys.returnPrivilegeEscalationState()) { std::cout \<\< “Token Privileges Adjusted\n”; } if (DWORD m\_procId = incp.FindWin32ProcessId((PCHAR)m\_win32ProcessName)) { incp.ExecuteWin32Shellcode(m\_procId); } system(“PAUSE”); return 0; }

## For Further Information On Thread Execution Hijacking

#### Click On The Link Below

> **[CAPEC - 

                CAPEC-30: Hijacking a Privileged Thread of Execution ...](https://capec.mitre.org/data/definitions/30.html)**
>
> Common Attack Pattern Enumeration and Classification (CAPEC) is a list of software weaknesses.

## Environment

- Windows Vista+
- Visual C++

#### Libs

- Winapi
  - user32.dll
  - kernel32.dll

- ntdll.dll

## Ethical Notice

This code was simply written to demonstrate an overlooked method to inject shellcode or a DLL into a Win32 program. This code is not to be used for malicous purposes. The author, Josh Schiavone, is not liable for misuse of this software. May God bless you all.

## GitHub:

[https://github.com/MandConsultingGroup/ThreadBoat](https://github.com/MandConsultingGroup/ThreadBoat)