16. Hugo Valette: Taming the Windows Module Loading for Stealthy Injection
Malicious code execution in a process is becoming harder as scrutiny from AV/EDR increases. In this talk we review how the complexities of the Windows DLL loading mechanisms can be abused to achieve code execution, either locally, or remotely, simply with read/write operations!
The ways to execute code within a process (especially for remote ones) are well-documented and achieved through a limited number of APIs which are, understandably, heavily monitored (CreateRemoteThread, QueueUserAPC being the most famous).
The Windows internals for handling DLL loading within a process are a complex set of functions and data structures that the OS manages throughout the lifespan of the process. In particular, it keeps tabs on which modules are loaded, where in memory, if their EntryPoint should be executed and where. This particular aspect can be abused, and in tampering with the module's structures within the process, code execution can be achieved with great stealth benefits for Red Teamers, since execution is triggered by the Windows' own routines and loading functions!
We will review how this can be leveraged within a process, for "API Proxying" (ie. executing an API indirectly), or, in the context of remote process, for a new Process Injection technique, achieved solely with read and write operations in the target's memory.