ae/airborne
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Shellcode reflective DLL injection in Rust
32 Commits 1 Branch 0 Tags 912 KiB
Rust 100%
08a32b0816
Go to file
17ms 08a32b0816 tested builds w/o loader-level obfuscation
2024-02-11 22:52:08 +02:00
.cargo tested builds w/o loader-level obfuscation 2024-02-11 22:52:08 +02:00
generator tested builds w/o loader-level obfuscation 2024-02-11 22:52:08 +02:00
injector tested builds w/o loader-level obfuscation 2024-02-11 22:52:08 +02:00
payload tested builds w/o loader-level obfuscation 2024-02-11 22:52:08 +02:00
reflective_loader tested builds w/o loader-level obfuscation 2024-02-11 22:52:08 +02:00
utils tested builds w/o loader-level obfuscation 2024-02-11 22:52:08 +02:00
.gitignore tested builds w/o loader-level obfuscation 2024-02-11 22:52:08 +02:00
Cargo.lock tested builds w/o loader-level obfuscation 2024-02-11 22:52:08 +02:00
Cargo.toml tested builds w/o loader-level obfuscation 2024-02-11 22:52:08 +02:00
LICENSE tested builds w/o loader-level obfuscation 2024-02-11 22:52:08 +02:00
README.md tested builds w/o loader-level obfuscation 2024-02-11 22:52:08 +02:00

README.md

Shellcode reflective DLL injection in Rust

Reflective DLL injection demo for fun and education. In practical applications, there's significant scope for enhancing build sizes, obfuscation, and delivery logic.

A blog post describing the technicalities of sRDI.

Project Structure

.
├── generator           # Shellcode generator (ties together bootstrap, loader, payload, and user data)
├── injector            # PoC injector
├── payload             # PoC payload (DllMain and PrintMessage)
└── reflective_loader   # sRDI implementation

Features

  • Compact filesize (~14 kB)
  • Hashed import names & indirect function calls
  • Randomized payload export iteration & IAT patching
  • XOR encryption for shellcode (shellcode generation specific keys)

Check out Alcatraz for additional obfuscation for the shellcode/injector.

Usage

The following command compiles the DLLs and executables into target:

$ cargo build --release
  1. Generate shellcode containing the loader and the payload
  2. Inject the created shellcode into target

Disclaimer

Information and code provided on this repository are for educational purposes only. The creator is in no way responsible for any direct or indirect damage caused due to the misuse of the information.

Credits