Offensive perspective

In this section, we will examine the theory behind process injection and why it is an important red team technique, to the end of avoiding various forensic artifacts. We will start by looking at a specific implementation of process injection, CreateRemoteThread, as a very basic example to illustrate how users can use process injection and its various implementations for their desired effect. Later, I will show how this technique can be chained with various implementations to achieve complete in-memory operations. By not touching the disk, we can avoid the traditional dead disk forensic analysis as described earlier. Furthermore, I will point to a wide array of process injection techniques, to give you options in terms of how you choose to implement your tools. Later in this section, we will use a memory corruption exploit to get the Meterpreter session in memory. After gaining a Meterpreter session, we will automate the CreateRemoteThread method to inject Sliver...