ae/airborne
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Shellcode reflective DLL injection in Rust
33 Commits 1 Branch 0 Tags 912 KiB
Rust 100%
567e36a9f3
Go to file
17ms 567e36a9f3 loader-level obfuscation during IAT patching 
1.) shuffle Import Directory Table entries (image import descriptors)
2.) delay the relocation of each import a random duration
3.) conditional execution based on ordinal/name
4.) indirect function call via pointer
2024-02-12 20:10:20 +02:00
.cargo tested builds w/o loader-level obfuscation 2024-02-11 22:52:08 +02:00
generator tested builds w/o loader-level obfuscation 2024-02-11 22:52:08 +02:00
injector tested builds w/o loader-level obfuscation 2024-02-11 22:52:08 +02:00
payload tested builds w/o loader-level obfuscation 2024-02-11 22:52:08 +02:00
reflective_loader loader-level obfuscation during IAT patching 2024-02-12 20:10:20 +02:00
utils loader-level obfuscation during IAT patching 2024-02-12 20:10:20 +02:00
.gitignore tested builds w/o loader-level obfuscation 2024-02-11 22:52:08 +02:00
Cargo.lock loader-level obfuscation during IAT patching 2024-02-12 20:10:20 +02:00
Cargo.toml tested builds w/o loader-level obfuscation 2024-02-11 22:52:08 +02:00
LICENSE tested builds w/o loader-level obfuscation 2024-02-11 22:52:08 +02:00
README.md tested builds w/o loader-level obfuscation 2024-02-11 22:52:08 +02:00

README.md

Shellcode reflective DLL injection in Rust

Reflective DLL injection demo for fun and education. In practical applications, there's significant scope for enhancing build sizes, obfuscation, and delivery logic.

A blog post describing the technicalities of sRDI.

Project Structure

.
├── generator           # Shellcode generator (ties together bootstrap, loader, payload, and user data)
├── injector            # PoC injector
├── payload             # PoC payload (DllMain and PrintMessage)
└── reflective_loader   # sRDI implementation

Features

  • Compact filesize (~14 kB)
  • Hashed import names & indirect function calls
  • Randomized payload export iteration & IAT patching
  • XOR encryption for shellcode (shellcode generation specific keys)

Check out Alcatraz for additional obfuscation for the shellcode/injector.

Usage

The following command compiles the DLLs and executables into target:

$ cargo build --release
  1. Generate shellcode containing the loader and the payload
  2. Inject the created shellcode into target

Disclaimer

Information and code provided on this repository are for educational purposes only. The creator is in no way responsible for any direct or indirect damage caused due to the misuse of the information.

Credits