Red Teaming Experiments

Red Teaming Experiments

Code & Process Injection

Here are the articles in this section:

CreateRemoteThread Shellcode Injection

Injecting shellcode into a local process.

Injecting DLL into a remote process.

Reflective DLL Injection

Loading DLL from memory

Shellcode Reflective DLL Injection

Process Doppelganging

Loading and Executing Shellcode From PE Resources

Process Hollowing and Portable Executable Relocations

Code injection, evasion

APC Queue Code Injection

Early Bird APC Queue Code Injection

Shellcode Execution in a Local Process with QueueUserAPC and NtTestAlert

Shellcode Execution through Fibers

Shellcode Execution via CreateThreadpoolWait

Local Shellcode Execution without Windows APIs

Injecting to Remote Process via Thread Hijacking

SetWindowHookEx Code Injection

Finding Kernel32 Base and Function Addresses in Shellcode

Executing Shellcode with Inline Assembly in C/C++

Writing Custom Shellcode Encoders and Decoders

Backdooring PE Files with Shellcode

NtCreateSection + NtMapViewOfSection Code Injection

AddressOfEntryPoint Code Injection without VirtualAllocEx RWX

Module Stomping for Shellcode Injection

PE Injection: Executing PEs inside Remote Processes

API Monitoring and Hooking for Offensive Tooling

Windows API Hooking

Import Adress Table (IAT) Hooking

DLL Injection via a Custom .NET Garbage Collector

Writing and Compiling Shellcode in C

Injecting .NET Assembly to an Unmanaged Process

T1216: pubprn.vbs Signed Script Code Execution

CreateRemoteThread Shellcode Injection

Last updated 2 years ago