Security Hustle

APC Internals | User-Mode APC Injection | Windows 10 ver 1909

Another windows process injection technique, which uses the Windows APC calls. Windows APC are commonly used by malwares. It's concept is similar to a thread pool, expect the fact that in thread …

injection technique

Inline Hooking - Windows 10 ver. 1909

Rishal Dwivedi 19:53

This post shows and explains how a windows API inline hooking works. For folks who are not aware of what a hooking is, it's a technique which allows to intercept a given API & also the abil…

injection technique

PE Injection by Patching relocation table - Windows 10 ver. 1809

Rishal Dwivedi 21:53

PE Injection is another subset of process injection, where we attempt to copy a PE executable into remote process & execute it. This is widely used to execute any malicious code into stealth mo…

process injection

Classic DLL Injection using CreateRemoteThread - Windows 10 Ver.1809

Rishal Dwivedi 03:19

DLL Injection is a subset of Process Injection. The goal/essence being, injection of custom code into a process. The below shared code is to build a DLL injectior, which uses a classic method of usi…

binary exploitation

Discovering & exploiting EOP - CVE-2020-13149 [Micro-Star MSI]

Rishal Dwivedi 03:13

Vulnerability – Local Privilege escalation due to weak ACL Vulnerable Version – Dragon Center 2 - 2.5.1905.3001 & Prior Fixed Version – Dragon Center 2 - 2.6.x & Later Vuln…