Process Injection and Migration
Now that we have demonstrated various ways to get a reverse shell,
it is time to examine the inner workings of these techniques
and discuss how we can manually inject our code into other programs
and migrate to different processes.
When obtaining a reverse shell, it must execute within a process.
A typical shellcode runner, like those we developed in Microsoft Word,
PowerShell, and Jscript
executes the shell inside its own process.
There are potential issues with this approach.
First, the victim may close the application,
which could shut down our shell.
Second, security software may detect network communication
from a process that normally doesn’t generate it and block our shell.
One way to overcome these challenges is with process injection
or process migration.
In this module, we’ll discuss these concepts
and demonstrate various implementation techniques.