Hello, welcome.
We are not going to do a practical walkthrough on these types crossing issues.
We are going to confine each one of these and to see how it works.
So the first one is 64 bit process if a 64 bit payload trying to inject into a 64 bit target.
So let's see going download this project from the association and zip it and put it in there too for
the.
So Washington, D.C., or, you know, so let's open.
And here you find the source code.
Yes.
All right, click and open this cross injections are.
And here you will see the pale.
A pillar is supposed to generate a message box.
Then he is injected into target.
We have two types here 64bit and you have a little bit better.
And then we learned that some call should be discussing data, maybe do the Heaven's Gate session.
Here we have two types of congestion pricing classic Inyang is the normal injection we without using
the Heaven's Gate exploit, and you also have the Heaven's Gate exploit here, which I'll be discussing
later.
So for now, just ignore the Heaven's Gate.
Just focus on classic inject so classic Inyang, who allocate space and the target process.
And then he will write to the memory.
He will say that you run the pill, which is injected.
Can you print the handle for your for you to inspect?
And then it costs the Hibbett for a single trip?
He basically saying, OK, because this is a multi track project and the main function is who were here.
You can see there are four types, of course, injection, so we are going to start off the first time.
And the main main protease main function is here.
He's such a target.
In this case, you are going to inject into make yourself paint.
Microsoft Bing is our target for all of these four different experiments.
And the on the left will be a Trojan, which will be compiled.
So after he face the Microsoft Pay, he will return the iPad.
And then he printed off and he opens the process based on the pad officiating and written the handle.
And down here you can choose either heaven's gate in all the normal range.
So for this experiment, you are going to use the classic ink.
So now we say we make sure it's classic and so classy, enjoying reading your process, handle and then
inject the payload.
You can study the different payload here, either 64 bit or 32 bit.
So now 64 bit.
So you said 64 bit payload, which is referring to.
This 64 bit.
And also, the second parameter would be the science 64 bit the length of it.
So this line of people is coming from down here.
I'm here since probably like 27 size of the trying to sound bites.
So now that you've got it, let's try to compile it.
So we open x64 native problem because we are comparing a city where we process.
Click on the sign.
So excited, needed to command prompt a change to this folder.
So we copy this folder, right click pasty and granny compound script to compile it.
And you see, he has successfully compact.
So now we are going to inject into Microsoft pains me, share your Microsoft being is static.
See, this is a 64 bit version of Microsoft Paint.
So now we run how he our children.
And he's supposed to.
Of course, the message box to pop up in India.
And I heard the the notification sound and the message boxes popped up to confirm that this message
box is coming from Microsoft Bing.
You can use Process Hacker.
Gain from process hacker, you can drag this this tool here and drag this to here and drop it here,
and you see it opens up the parent for the message box Microsoft Ping, which is recess to do for all.
Another confirmation is from the memory you can play on memory tech and the protection, scroll down
to our x readable and executable and look for X here in the one machine unmarked and then here in the
weekly and you see your Shakeri say hello from clicking license.
The other thing you want to make sure that they show this Trojan is actually 64bit, you can use the
dumping mine dummy, select the options, hate us and then if you just click internal, you'll find
it's a lot.
So you have to provide the name of the binary, you have to allow us to get information about this.
How about this region?
But you just want to know very 64bit or not?
So what do you do is you specify you who find this tree for your machine specification?
So repeated command Typekit yes, spikes in boys phone in the above, the enter key of her keyboard
fine string and then put forward slash hi option means ignore case.
You don't care what type of case on the case, you're looking for the story machine.
So what this does is it will you pass ahead?
Is, of course, enjoying the behavior and then you are put in regarding.
To the fine string or mine fine string, we look for the string machine.
So you press enter, you find 80, 64 and a 64 bit.
All right.
So now you know that the first.
The first experiments in success in Asia injected 64 bit payload from a 64 bit process into a 64 bit
target now in Australia's second one.
The second one, we are going to have a 32 bit payload, so we need to change the payload here.
So he has successfully done the first one.
So let's put it this way to say that you are successfully Danny, put a blast in boy.
Now we are going in the second one.
So we changed the parent to 32 bit down here and here.
We also teach the science to teach you to be.
So now we are going to inject.
This bill, that it would be better in a sciences year, two nine three two nine three base cases involving
with is safe and then we have to use a new command environment.
Actually, six, which is if you don't see here, just don't need to search for it.
And you can see there are two, so select x86 92 command from and navigate to this folder.
Copy the address,
right click copy and over here.
See Cooee into a running compound.
That's great.
And then now you test whether it's
the little be be into.
Oops, I forgot something.
You need to provide the.
Then by pick to find strength, and she she.
Right.
So he's 32 bit.
So we confirm, he said today, so we said it will be.
We cannot use 64bit to test because now we are experimenting with second second experiment where you're
going to inject into 32 bit.
So we have to run.
We since you already do 32 bit or, you know, we need to run it through, it will be Microsoft Paint.
Well, where do you find it easy to beat Microsoft PIN on a 64 bit system?
He is very funny.
You hit over to your cell phone navigator, file explorer.
Go here and go to see go to Windows.
Go to Cicero, 64, inside here you will find Microsoft Bing must be easy.
This Microsoft maniac in this location is 32 bit version Microsoft Bing.
So you press, enter and knowing that it'll be the version of Microsoft Paint, he's running.
So now the 32 bit version of Microsoft Page is running that is, try to run our Trojan inventor.
And you can see Trojan, No.3 and I hear the beeping, and you will see that it will be your standard
message is different that it'll be message from cracking lessons dot com.
And again, we can use our process.
I could confirm by going to Microsoft pane down here, or you can click on this main drag.
Finally, losing track right here and you see the parents because I've been and and their memory.
You can also scroll down and the protection look for RW w r x.
Our ex.
And this one.
Here you can see the coldest day in Stockholm.
OK.
So it's working.
All right, so let's close this now.
The next experiment is this one 64 bit processing to 32 bit processor.
So now we have to compile this article in a 64.
Environment, so we just run this.
OK.
And we repeat the damning comment, confirm there is indeed 64 the.
So is 1864.
So the target.
He's also that it would be so let's run our 32 bit version of Microsoft Bin again.
And let's execute a twin.
And you can see Triangle Tony and I hear the beeping sound and the chocolate, it's open.
All right.
So far, so good.
So now we go for the last one, the last one is three to be precise, which is four week payload injected
into a 64 bit process.
So let's go and make the modification.
So for this last experiment so far, we've already successfully done the.
First Tree, how are you the last one that it will be through June six if we fail?
So we need to change this to 64 bit.
And this is also 64 bit.
And then the target is 64 bit because I've been so we need to close to the soft of pain.
Something needs to happen.
So it's quite normal for this kind of thing.
All right.
So now.
We are going to compile this.
Compile this as a 32 bit Trojan.
So go to your ex 86 environment combine.
All right.
And then use see done been to confirm it is indeed that it'll be OK.
So now we are supposed to run 64bit.
Microsoft been spread out a little bit, tweeting can inject into into a 64 bit process.
So I saw our 64bit a of paint.
And then try to inject to it.
And you see, he feels true handle is zero, right?
This Rihanna zero is coming from from the classy Inyang over here.
To handle so many situations, zero, it means that this API film to create a threat.
OK.
But he probably has succeeded to copy the show could write to confirm that we can go here and look for
Microsoft Pain Memory and look under our X as usual.
Scroll down to our scene and not one.
And you can see the shakeout indeed was successfully copied.
That means right process memory succeeded by creating more check feel.
OK, so that means the last one feels only the first, second and third one succeeded.
Right?
The lesson fails because the wrong process the raw emulator has got kind of protection.
It does not allow you to inject 64 bit payload into a 64 bit operating system coming from a 32 bit process.
All right.
So next, we are going to explore how to bypass that protection by using different fuels x86 execute
x64 and x64 function algorithms.
Finally, the Metasploit framework, which implements Heaven's Gate, right?
So that would be the next lesson coming up soon.
So that's all for this video.
Thank you for watching.