Welcome in this video, we're going to discuss the API used in early, but epic injection.
You may download these notes with the links that I provided for you from the resource section.
And it contains some of the extra readings that will help you understand some of the APIs that are being
used.
Also going on this weekend, zero seven, rebut ABC injection and zip it and put it in the now they
have to hold it, the insight you find all the similar fallacy he used in the previous lessons, the
media exception and this is something new.
So let's open the source code.
You've got that plus plus.
We also used the same charcoal payload, which is the charcoal used to open a pop up message box.
Everything is the same.
There is only one function, the main function, and you say here we create some of the structures,
the some of the objects variables which are used for process creation, which he starts up in full and
process information.
And over here, we zero those objects before we use them, we need to zero.
So this is a function of who convenient function for easy growing up, the cyber variable and by variable.
And both are being used in the process.
Create process API, as you can see here.
So after you zero out these two variables which are using this process, you can now use this new function
co-create process to open our target.
Our target is Microsoft Paint to get a better understanding of this API.
You can go and refer to this link here.
Great process from the MSDN documentation.
This is the documentation for key process here.
So this function creates a new process and its primary trick.
And these are the barometers to the commission.
So you can see the important one is the second parameter and the six parameter.
The second parameter is the name of the program that you want to start.
And the sixth parameter is the creation flags and you want to create the process in a suspended state.
So you have to pass to create suspended fly.
And then the last two parameters are the start up four and the processing for the objects which we develop
here.
So the important one is the second line, second parameter.
How common I must paint suspended is the six parameter six parameter creation, right?
So the creation flag?
Yes, you can look at process creation flag here.
This example, this documentation, the occasion flag can be any one of these.
And the one we're interested in is the suspended Greece suspended creation flag.
And the primary trend of the new process is creating a suspended state in the state run until the IS
to function is called.
So once you have created a process in suspended state, you can resume it later on down here, very
used to resume track function.
So next thing is you can add any additional decryption code or function call for decrypting the payload
if you use some kind of encrypted payload.
And that is entirely optional.
It's up to you after that, we allocate memory for the bill and copy the shall go to it by using the
virtual hicks function.
And then we passed these parameters.
The first one is the end of the process, which can be extracted from the process information by.
He has the documentation for processing permission structure.
The members are here.
So you can see he's got one, two, three, four four members.
And in order to get the.
Handled in process, you will access the first member handled the process over here.
Then you also pass the length of parent night for the size of the allocated region and every year when
you create and you want to create as executable, readable next, you write to the newly allocated region
of memory using the right process memory API and the first parameter.
You pass the handle to the process and the allocated region, which you got back from the previous call
and the shellcode payload, which is this chako here and also the size of the payload.
Next one is the important one.
This is where you you were to put your job into the APC queue of the trip.
So this queue APC, you APC functions the same one as you used before.
So you pass a cheap barometer study.
The first one is the allocated region of memory, which now contains a shark coming from the previous
call and also the handle to the train.
So do you handle that?
The train is obtainable through the process information by seeing the handle chamber, which is seen
here, the second member of the structure is handled to the tray.
And then you bring some debugging information so that we can see the addresses of the remote dress,
which has been allocated.
And then over here you will pass for the user to press enter.
And finally, you resume check.
So the reason API is exploding here.
Yes, that's one parameter, the handle to the track, which is here, specify here, and once you call
this, the chain will resume execution and execute your quick in the APC queue.
It will totally abandon whatever call you are supposed to execute because he has not reached the entry
point yet.
So this is how you can camouflage your shackle inside a newly created process.
So that's all for this expansion of the API.
Thank you for watching.