So in this video we will be talking about the data and the action.
In the previous videos we have seen how best are record in that remote process?
And this will be seeing how to inject the real inside another process.
So if you have not watching my previous videos gone, watch them.
But still, I'll be explaining the previous the functions we have written previously briefly so that
we can be on the same page.
So first function is open process.
So this will be this function may open the process and we will get the handle.
So we can do some operations on that process.
And the question is desired access.
So you do have this access rights for the process.
So what you have what you want to do on this process with this controls.
So process all access.
So you get the all access.
And with this process, create process, you can create the new process and new threads and duplicate
handle and you can create for information and etc..
Here we have the real operation breed, right?
So these three permissions are required if you want to perform operations on the virtual displays are
the process.
So that all will be including these three as well.
And the second parameter is the, uh, can be fast.
We don't want an inheritance handle and that a parameter prosody or any of the process, we want to
open the handle.
So after getting the handle, maybe allocating some memory using the virtual x function.
So this will take the process handle and the address where we want to allocate.
So we'll be sending this.
And now, uh, if you send Mel at this second parameter, that means operating system will automatically
decide where is the free space of this, let's say.
So we are also specifying how much sense of region we want to get and that much I want say will be allocated
in the free space of the process, whatever space but operating system.
And the rational parameters are a regression in production by regression.
Do we want to enable the on demand building?
Are we want to reserve and commit so we'll be using the reserve and commit and also production.
So so this production being partly page read, write, execute and read only and write on the etc. So
we'll be using the page reader to execute because we want to execute that region as well.
So after creating that memory region in that what does space are?
The process will be writing some actual data using the function called write, produce memory.
So it will take the process ended and the base address at at each address.
You want to start writing and what you want to write that is the battery and how much you want to write
that.
And I produce a number of bytes written.
So if I want to write under weights.
So that would be the 100 variable.
So integer variable holding hundred.
So after reading the proverb in the previous, You get smart.
We have written the show according to this process.
What place is in this movie?
And at that address we have executed, but not as a function.
But in this moment, what we are going to do is we are going to use a function called load library.
So it will label the file name so you can see the parameter is the file name.
And this can be their dealer.
So they use this available every year for a dealer in bought process.
And this resides in Connecticut.
So very convenient because the Canada deal is like our most important by almost all the transit because
this Canada right there contains the core functionality of any process.
So that's why every, uh, many process import this candidate, they automatically win the, uh.
When they start.
So what we need to do is we need to search this allowed library year functions address in the process
mental address space so you can do that using the get proper address.
So the module we need to get the get module handle.
So if we were using this function, that model handle and maybe getting the handle for this model and
this model should be loaded in the process.
What does this.
So then maybe creating a new thread, then finding the sort of finding the address of this around library
or function.
And we were passing that to this creative model.
So we are basically creating a period.
Uh.
That will at the specified function so far shown is the process handle.
And second one a trait data which we can specify null.
This will be inherited from the parent process and the stack says we can define getter and the start
address is the address of the function we want to execute of district.
And this is the parameter and the creation flags.
So whether you want to start the thread immediately after creating or you just want to suspend.
So we were starting out immediately after the creation and the Russian is the threaded output parameter,
so will be getting the territory as done into this variable.
And also we got the handle that that thread.
So I added it defined all of these functions here.
So you here can see, uh, importing the candidate data.
And we have this open process.
These are the axis handler I.D..
So I have already defined this.
So to save some time on lateral objects, you can see well plus memory correctly moderate.
So you're going to see these are the constants.
So we are opening the process.
Uh.
In the desert axis.
So we are we need to send some flags that is created quite information.
We are operation three.
Right.
And seven barramundi is fast and this is the argument we need to do the period.
Our process ideas, our argument then it will be placed here so that we have reopened the process.
Now we need to get some Maori material.
So the first one is the frog handle.
And the second one.
Is the you can point pointer dot zero.
So we are telling the operating system to choose a free region of the sites.
They're saying, okay, how much we want to allocate.
That is the length of the spring part.
So here you can see in my folder.
So this is the character that I had undergone using Metasploit.
It's a simple command I was offering them.
Commanding the Coast Guard, the Dixie Windows SC, Article 86.
So when it's run, it will just pop up the trigger.
So quiet if you've turned back on this and copy has but will get the part of the deal and I send this
to a variable and this much amount of me want to create the in the address space at the process because
we'll be sending this value as the parameter to the word library, a function.
So see what you can see in the string.
So we need to load this module.
And this started this point to the project manager and the parameter to this function binds to a parameter.
So this LP parameter will be the the particle nebula and the loop starter.
This will be the pointer to this library.
So this thread executes dysfunction and with this as a parameter.
So obviously.
And you do?
I have already converted this to bytes using this encoding gas and the popular instances.
So Election Day, we can say.
Committee members are.
And our action in Spain is good rhetoric and the return trip is the stopping address of this creative
space.
It's a starting PDR, so we have created a space.
We need to write that space using the right process memory.
And the first parameter is the process handle and second parameter is starting address where we want
to write that is starting with the right.
And the third one is battery.
So battery, this is the part.
Sainz returned to.
The sales of this spring.
And the last one is the output parameter.
We can say we can define integer bytes, return variable and initializing to zero.
Now we need to pass the reference bytes return.
So when I read this function indicates it will write this spring to that address and will be getting
the output.
Berlin does the to return to that address.
So we can also print this as it's written.
So after writing the.
So I'm providing this one way to get the broadcasters, that is the producers of this function.
So before that, we need to get the, uh, handle of this, uh.
Canada to do a deal.
Think I have to find a your.
So I had to find Europe.
So let's use this.
Here's what we're going to do is we are where we are getting the model handle of.
The Canada did a deal.
So let's pass this Canada deal and put peace.
The handle so and pointer.
My door handle.
And this model handle can be passed to this address.
And my door handle.
And what we want to search further.
That is the law library.
And also if you observe we can see he's not uh.
Uh.
And get broken business are pretty unique.
So that's why I have changed this function definition to normal string.
So otherwise I would be uh.
Can register and the long pointer Unicode string.
So I have got some errors.
So that's why I then after uh, uh, searching in Google I can do this function does not support Unicode.
So the return type is, uh, the function address.
Function address.
Something about the function address they can pass there to create.
So let's go and create the matrix.
And the first one is the process and the.
And the second one can be zero.
And stack sales zero.
And the starting address.
So that is the function address.
And then the parameters, the parameter to this function, which is gets educated at this address that
is not regulated here and the parameter is our this starting pointer.
So we have the right to return.
At this starting point to address.
And the next one is creation flags.
It can be zero and different spool thread so we can see where they are that are behind it.
So I put this provided.
And didn't bring peace.
This third hand.
So we can put in doubt the third party.
So I think our function.
A successful.
Okay.
So I think we are good to go.
I so remember, uh, you can just change 64.
Which does what?
And we do send the
process ideas, the arguments.
So let's open this together with application.
Because I would be instructed of it.
So that PowerShell is 1864018640.
And if you run this, we should see the character and we can see the calculator and we can also see
the bytes.
Newton 82 and the numerator.
So this is how you would normally election.
You can also write the green for this struct, their data set and the process and injecting into that
process.