Hello and welcome in this new session, you going to study 32 bit to 64 bit cross injections.
It is about how to inject 64 bit payload into 64 bit processors using 32 bit processes.
Dinosaur cross injections.
We have a sixty four week process for week injecting into be process, and that's the first time in
this time he's a 32 bit process, having a 32 bit pill injecting into 32 bit process.
The next time, use a 64 bit process, having a 32 bit pill, injecting into a 32 bit process.
The last time is a 32 bit process, FCC phobic people trying to inject into a 64 bit player of all this,
the first, second and then wildly sexy by the fourth one.
Normally you feel.
This is home 32 bit applications run on 64 bit system.
So how does this 32 bit applications run on 64 bit system, assuming you have 64 bit kernel?
Running Windows 64 bit.
And you have to be processed.
Did it do that, it'll be process we have to go through an emulator known as Windows on Windows emulator,
also known as well.
64.
This emulator is running in the user space.
The emulator within the system calls to the 64 bit kernel.
In addition to that, even the simulator will also provide security hooks for engines and other security
devices to monitor that a little bit processes.
However, there is a way to bypass windows on Windows Simulator, and that is by using different fuels
as excessive for and different functions algorithms found in the Metasploit Framework.
If they only use in this state with use algorithms, also known as the Heaven's Gate technique, what
are the advantages of having a cross injection?
Heaven's Gate bypasses the security measures of the Wall 64 emulator.
Every antivirus and security house depends on washes you his death or evade it.
References.
These are two links you can read up on.
For more details.
32 bit to 64 bit cross injection.
This is their explanation of how he works on a knife, you have a Trojan, a 32 bit Trojan and inside
it embedded a 64 bit payload.
The Trojan is running into 32 bit more.
That is a normal mode that they take to be happy.
Think you are running inside it?
You also have to show coach as excessive force and excessive force function.
Both of them come from different view.
Metasploit Framework.
Over here.
And on the right, we have staggered process, which is a 64 bit process.
And this is a one guy going to inject.
The first step is to copy the payload to the target process.
Then the second step is to transition the Trojan into the 64 bit.
He does that by executing the excessive force.
Once the A64 shackle is runny, the Drugeon, which is today to be handed start, will again shift into
a 64 bit more.
Then the next step is to execute the A64 function.
The excessive function, who then ran the payload, which has been copied over to the target process.
He does that by making use of an API called RTL create using a tray.
So that is how you can use.
Cross injection by making use of different fuels, heaven's gate implementation from Metasploit in order
to execute 64 bit pedal from a 32 bit Trojan horse on target 64 bit process.
That's all for this video.
Thank you for watching.