[Autogenerated] If you've watched one of the previous courses in
these series specifically memory management.
There.
Was an example of how to inject the DLL into a target
process by using a remote thread.
Let me quickly recap how that was done in that demonstration.
We have a target process,
that We would like to load the DLL into and We have our injector process,
that is supposed, to force the target process,
to load a DLL of our choosing.
The first thing we need.
To do is to open, a handle, to the target process,
and use right process memory, to write the path of the L L.
Two load into the target process.
Address space, and That's because our next call.
Is going, to be to create remote thread function which will create a thread,
in the target process, and force it, to call the load library,
a P I which is The one responsible for actually loading our DLL,
and that works because the load library function has essentially the
same prototype as the thread function in general.
From a binary perspective, they all accept a simple pointer.
So, that works.
And the injected DLL would be loaded into the target process.
However, one of the problems of this mechanism,
is that it, is very easily detectable by ant malware solutions.
That might flag your injection as malicious which it
may or may not be but its very easy.
Relatively speaking using a kernel driver,
to figure out that a remote threat execution,
is happening.
And the DLL L, is being loaded by a thread, that didn't exist.
In the process, to begin with.
So one way, to go around,
that is to use an idea that involves a PCs So instead of using a new thread,
to be created which is the thing,
that can be easily flagged or identified by anti URL solutions.
We want to take an existing thread in target process.
And force it, to load our DLL using a user mode a PC,
and this is a much self fi approach because there's no new thread involved.
It might look just like a thread, in the process loading,
a DLL, something which is super common.
So in order to do that what we need.
To do is first have to ride the path of the DLL, to the target process.
As before this is something we have to do either way but then
instead of calling create remote thread,
we'll use the Q, user app see function somehow,
to give another thread or some thread.
In the target process, a function, to run which is going,
to be load library again,
and then the load data be function will be called and the thread,
is going to load the L L D L will be loaded.
Everything will be great.
However, there, is one little snag here because remember,
user mode a PCs don't run automatically.
They can only run if the thread in question goes into an alert,
able state,
and Since we can't tell whether a particular thread will go into an alert,
able state or not.
There's no way.
To 100% guarantee, that the way to improve our odds significantly.
Is by using Q or a PC on all the threads,
in the target process hoping,
that at least one of them will be into an will be going
into an notable state at some point.
And our DLL loaded because only one just needs to load the DLL.
There's no need to do that more than once.
You don't really care which threat does.
That As long as this is happening.
In the target process.
So this is the next demo, I want to show you how to use this approach.
To load the DLL into a target process by using Q, user a PC