Exploitation Tools

RWX_MEMORY_HUNT_AND_INJECTION_DV : Exploiting OneDrive.exe To Inject Shellcode Without New RWX Allocations

Abusing Windows fork API and OneDrive.exe process to inject the malicious shellcode without allocating new RWX memory region.

This technique is finding RWX region in already running processes in this case OneDrive.exe and Write shellcode into that region and execute it without calling VirtualProtect, VirtualAllocEx, VirtualAlloc.

Usage

Just compile the program and run the (EXE) without any paremeter.

Steps

  • Find the OneDrive.exe in running processes.
  • Get the handle of OneDrive.exe.
  • Query remote process memory information.
  • look for RWX memory regions.
  • Write shellcode into found region of OneDrive.exe
  • Fork OneDrive.exe into a new process.
  • Set the forked process’s start address to the cloned shellcode.
  • Terminate the cloned process after execution.

Shellcode

This technique will work with ntdll based shellcode which is not dependent on any section. I used to generate my shellcode.

Shellcode Creation

  • Edit the shellcode template file funtion ‘shellcode_template’ according to instructions given on
  • Compile the code and open .EXE file in any hex editor (HxD)
  • Extract the .text section and use that in given project file.
  • To extract the shellcode there are other methods also explained in the repository.
Varshini

Varshini is a Cyber Security expert in Threat Analysis, Vulnerability Assessment, and Research. Passionate about staying ahead of emerging Threats and Technologies.

Recent Posts

cp Command: Copy Files and Directories in Linux

The cp command, short for "copy," is the main Linux utility for duplicating files and directories. Whether…

6 days ago

Image OSINT

Introduction In digital investigations, images often hold more information than meets the eye. With the…

6 days ago

cat Command: Read and Combine File Contents in Linux

The cat command short for concatenate, It is a fast and versatile tool for viewing and merging…

6 days ago

Port In Networking

What is a Port? A port in networking acts like a gateway that directs data…

6 days ago

ls Command: List Directory Contents in Linux

The ls command is fundamental for anyone working with Linux. It’s used to display the files and…

7 days ago

pwd Command: Find Your Location in Linux

The pwd (Print Working Directory) command is essential for navigating the Linux filesystem. It instantly shows your…

1 week ago