DllNotificationInjection: a POC of a new “threadless” process injection technique
DllNotificationInjection
DllNotificationInection is a POC of a new “threadless” process injection technique that works by utilizing the concept of DLL Notification Callbacks in local and remote processes.
An accompanying blog post with more details is available here.
How Does It Work?
DllNotificationInection works by creating a new LDR_DLL_NOTIFICATION_ENTRY in the remote process. It inserts it manually into the remote LdrpDllNotificationList by patching of the List.Flink of the list head and the List.Blink of the first entry (now second) of the list.
Our new LDR_DLL_NOTIFICATION_ENTRY will point to a custom trampoline shellcode (built with @C5pider‘s ShellcodeTemplate project) that will restore our changes and execute a malicious shellcode in a new thread using TpWorkCallback.
After manually registering our new entry in the remote process we just need to wait for the remote process to trigger our DLL Notification Callback by loading or unloading some DLL. This obviously doesn’t happen in every process regularly so prior work finding suitable candidates for this injection technique is needed. From my brief search, it seems that RuntimeBroker.exe and explorer.exe are suitable candidates for this, although I encourage you to find others as well.
OPSEC Notes
This is a POC. In order for this to be OPSEC-safe and evade AV/EDR products, some modifications are needed. For example, I used RWX when allocating memory for the shellcodes – don’t be lazy (like me) and change those. One also might want to replace OpenProcess, ReadProcessMemory, and WriteProcessMemory with some lower-level APIs and use Indirect Syscalls or (shameless plug) HWSyscalls. Maybe encrypt the shellcodes or even go the extra mile and modify the trampoline shellcode to suit your needs, or at least change the default hash values in @C5pider‘s ShellcodeTemplate project which was utilized to create the trampoline shellcode.
