Ntdll-Early-Bird-Injection-Trojans

KO | EN

gitlite — search

#javascript #python #hacktoberfest #react #ai #typescript #llm #go #golang #android #machine-learning #rust #deep-learning #linux

Ntdll-Early-Bird-Injection-Trojans

★ 12 Open GitHub ↗

Collection of remote shellcode Loaders using Early Bird APC Injection, windows native api, low level utilities and stealth techniques.

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# Native Api Early Bird Injection Trojans

Collection of remote shellcode Loaders using Early Bird APC Injection, windows native api, low level utilities and stealth techniques. This code is for educational purposes only, do not use it for any malicious or unauthorized activity.

# 🖥️ Code
This repo is a more advanced version of [this one](https://github.com/Hue-Jhan/Early-Bird-Process-and-Dll-injection/), it consists of 3 projects that have the same basic structure and share most of the code, they are: Nt Early bird APC injection, DLL version, and a DLL Injector (LoadLibrary using APC), the shellcode is for a windows msg box. Every code includes 2 versions, one with NtCreateUserProcess (stealthier, low level), and one with RtlCreateUserProcess (higher level but easier to manage).

Btw i forgot to remove some useless functions like `NtCreateThreadEx` or `NtGetThreadContext` from the Native api related parts because i took most of `apc.h` from `injection.h`, part of my previous repos, so you should remove them to lower the amount of functions resolved from ntdll in order to raise stealth. Next to each code as you can see i put the virus total detections for its raw executable.

### Native Api explained

Instead of using simple ```Windows.h``` api functions we use ntdll functions, which are sometimes less likely to be hooked by EDRs at user level, these are the lowest level Win API calls exposed to the user mode, and are the closest interface to the Windows kernel, below them there are just system calls (i will post a Syscall version in the future). Once we get a handle to ntdll we dynamically resolve its functions at runtime, and we use them similarly to how classic windows api functions are used:

- In order to use Ntdll we create custom typedef structs for each function, and we define all the internal structures and objects that they need, sometimes structures may be nested and require even more internal objects;
- Then we use ```GetNtFunctionAddress``` function to dynamically retrieve addresses of NT functions from ntdll using ```GetProcAddress```.
- Once we retrieve them in `InitNtFunctions()`, we can call these native NT functions directly and use them for the injection.

### 1) Early Bird Simple Process Injection

Spawns a process and queues shellcode to it:

1) First the shellcode is decrypted, for a better view of the encryption mechanism check it out [here](https://github.com/Hue-Jhan/Simple-shellcode-crypter);
2) Secondly we create the necessary structures and spawn a process in a suspended state;
3) We get the Handles to it and its main thread;
4) Then we do the classic Allocate -> Write/Copy -> Protect RWX in it;
5) Finally we queue the shellcode to the main thread and resume the process, triggering execution.
   
### 2) DLL Version 
<img align="right" src="media/nt-early-dll-reshack.png" width="250" />

Dll version that does the exact same thing in the process its' being injected into, the new thread outside the loader lock is essential to avoid deadlock. You also might want to disable precompiled headers to remove the pch files and Visual Studio errors.

The Dll might not work if it's being injected by its dll injector version, don't ask me why.

### 3) DLL Injection

Spawns a process and loads a malicious Dll into it by queueing LoadLibraryA that loads the dll, before building the exe insert the Dll next to the other files:  <img align="right" src="media/nt-early-dll-inj.png" width="340" />

1) First the dll (considered a resource) is extracted from the exe, written to disk, and its path/size/name lenght/other info are calculated;
2) Secondly we spawn and take the handle to the suspended process and its main thread;
3) Then we allocate memory the size of the dll path inside of it, write the path into the process, make it RWX;
4) Then we get the base address of kernel32 dll to get the pointer of the function which will load the malicious library;
5) Finally we queue the base address of the Dll using loadlibrary to the process and resume it.

Might fail if the dll inserted is another Early Bird thing, as i said before.

# 🛡️ AV Detection

Gets blocked by BitDefender Advanced Thread Defense, bypasses Windows Defender and BitDefender antivirus, below is the virus total detections for the dll injector with obfuscated metadata, needless to say that the classic injector and the dll both get 0 detections if obfuscated.

Ntdll-Early-Bird-Injection-Trojans

Explore Similar Repositories

Was this content helpful?

Recent Feedback

Download README