Process injection RWX injection / Mockingjay local injection

[thomasxm]

Details:
This test exploited the vulnerability in legitimate PE formats where sections have RWX permission and enough space for shellcode. The RWX injection avoided the use of VirtualAlloc, WriteVirtualMemory, and ProtectVirtualMemory, thus evading detection mechanisms that relied on API call sequences and heuristics.

The RWX injection utilises API call sequences: LoadLibrary --> GetModuleInformation --> GetModuleHandleA --> RtlCopyMemory --> CreateThread.

The injected shellcode will open a message box and a notepad. RWX Process Injection, also known as MockingJay, was introduced to the security community by SecurityJoes. More details can be found at https://www.securityjoes.com/post/process-mockingjay-echoing-rwx-in-userland-to-achieve-code-execution.

The original injector and idea were developed for game cheats, as visible at https://github.com/M-r-J-o-h-n/SWH-Injector.

Testing:
Tested with both Windows 10 and Windows 11 fully patched. Windows defender was unaware of the process injection.
Test spawned a message box with "Atomic Red Team" and a notepad. Test will terminate the injected process.

Associated Issues:
N/A

[clr2of8]

Thank you for provided the source code, along with the DLL and for the great description.