Hello and welcome.
In this video, we are going to get started.
The DHL injection.
The lexicon go in, download this project zero nine.
The injection and zip it and put it in the murder for the opening.
And you see a number of files.
One on the FBI's is bin 64 bin, which is the 64 bit Microsoft page Chalco, which we generated using
Metasploit in Kali Linux.
And there are two compiler scripts.
The first compulsory is to compile this entire file.
In this use of a definition, Foresthill.
Right click open.
You bet.
Plus, plus.
You will see that the input far is Microsoft been the CP, the definition far is Microsoft paint the
the.
And the output file is Makassar being a done deal.
And this is your final output file.
You are going to use this screen to build a DFA out of this CP fa.
Let's look at the far we have not backed plus plus the DFL specifies the library as Microsoft Benguiat
and the Xbox as Iran Sherkat.
That means that our Yale, who have won a spot which is ramshackled, that is open to the A's law school,
is not bad plus.
So now we're going to put our Chalco in here, the Microsoft page.
This regenerator Metasploit.
So open your høst.
Drive to Microsoft, S.C. for Binbin Sherko into Hedgecoe.
And export all of this.
I see fire.
A city insight here.
The injection for the.
Confirmed in a new fire is being created and then close it.
Next opened a new file.
We have not backed by Splice.
And Copia Formate that Chalco.
Right click, copy and then open your I guess I've been Yayo source code.
And be sitting down here.
Let's rename this Raw Data.
The chocolate bill, so we copy from the sample and put it down here.
Next, delete the sample.
Next, check to make sure that the number here.
And here are the scene.
And then click on See.
This is the year of.
The DFA has called dear mean inside, and you will see a switch.
The first case is when the D.A. said Desch are loaded by a be executable.
When that happens, this case will be triggered and this function will run.
And this function is defined here, you call what you're allowed to allocate some memory and you is
a safety dresser.
Yeah, look at that memory to this variable next to you.
Copy the shellcode to the newly allocated memory.
And then he will change the protection of that allocated memory containing the Chalco to become executable
and readable.
Next to you with Darth Vader and which to protect was successful.
If it is, you will create a trick to execute the educated memory which contains the Chako that is compiled,
copied this path.
Open your access for native to us from.
CD and BCO part, in fact, compiled the album into.
That there are no arrests.
So now your gear is created?
It is.
Yeah.
So we are going to inject this Microsoft Paint yellow into Explorer.
Explorer is whenever you click on any of the folders, you know, Point Explorer.
So our objective is to inject.
A year into Explorer, and this is the idea we want to enjoy.
So there once this deal is injected, it will open up because of pain.
So the next day we need to do is a DEA injector.
And this is the COMPAR script for the injector.
Rackley and openI.
It takes the input file dioh injectors Seip and gives the output file called the injector, the EIC.
This is the input far.
The injector CP Reichling an opening, if not bad.
Plus, plus.
There is a main function.
Containing the path to the deal to get this path a deal.
This is a deal.
Select this correctly and copy.
And then come down here and face the path next.
He said that because in the semicolon at the back and a double confront.
And then copy this and put it here.
Let's put the backslash.
You need to put two backslash in order to tell the operating system that this is her decision, not
an escaped character.
Same thing over here, here and here and here, and they're back here.
You need to put.
The name of the Diantha expenditure that you're referring to this far, then you can come into the sample.
Danny Sabih.
Over here, given the name of the process that you want to inject in this case, he is an Explorer EIC.
You would then call the function search for process and passed the name of the process.
Then you when you inject, which is Explorer EIC, after he has found the process, he will return the
process.
Edee, Egypt process idea he zero you will give the ARACY process to inject not found and you actually.
Otherwise, he will continue here and bring the message process to inject.
And paid for that, and then he will see injecting.
Next, he will call the process address and extract the library address from country two and save the
address of the library in this variable.
Although we're injecting remote process explorer, we can still use this method to find the address
and no library for the target process.
That is because it does seem address for all the files in the Windows system.
Next, we call open process.
You open the process based on the pad.
Well, here in this case, you will be explorer and then we save the handle to the Explorer process
in this variable Carhenge process.
Then we test if you successfully managed to open the process.
This will not be now.
Now, we used to watch Elaheh s function to allocate some space in the Explorer process.
And then we save the address into this variable.
Then we call the right process memory to copy path to the Dáil.
Which is this one.
Is far over to the newly allocated memory, which is here again, we call the remote trek and pus the
address to the library and also the parameters for that library, which is the path to the Explorer
process, who then used a library API to look the Dow from the past.
And the deal that is going to look his progress of been.
Yeah.
As soon as the Americans have been on the air is loaded.
He will satisfy first case process attached, and he will run the show.
And what they show called is run he will execute, shall sherko to show the Microsoft PIN program.
So now we are going to build this year and later by running the buggy and jack the screen.
So let's start on file.
The injector and hit enter.
And notice we have a new far here.
He has successfully built the Microsoft beinir and also the injector who stopped basketful now and continue
to run this and examine it in the next video.
Thank you for watching.