Malware Development: Process Injection

Рет қаралды 192,542

Күн бұрын

#Malware #Development #redteam
Pork is airborne and hell hath frozen over; MALDEV PART 2 IS FINALLY OUT! Thank you, guys, so much for bearing with my RNG upload schedules (I don't even know if the word "schedule" can even be associated with me). Please enjoy the newest installment of our ongoing Malware Development series. As always, you can find more on my blog here: crows-nest.gitbook.io/
In the next video, we'll be taking a look at the lower-level NTAPI from NTDLL, and perhaps some system calls! I am going to be taking a bit of a break since this video almost obliterated my soul; I'm a one-man team and this takes forever, especially when it's an hour long. I sincerely hope you guys found some use for this video, and once again, thank you for being here and watching. I will catch you guys later :)
I love you guys, enjoy.
⚠️ Disclaimer:
The information presented in this video is for educational purposes only. It is not intended to be used for illegal or malicious activities. The creator and any individuals involved in the production of this video are not responsible for any misuse of the information provided. It is the responsibility of the viewer to ensure that they comply with all relevant laws and regulations in their jurisdiction.
🔖 My Socials:
avatar/mascot made with picrew: picrew.me/en/image_maker/1108773
- full credits to the artist: / mimisentakosen
- visit her shop: coconala.com/services/1871766...
official discord server: dsc.gg/crow-academy
crows-nest.gitbook.io/
github.com/cr-0w
/ cr0ww_
💖 Support My Work
/ cr0w
ko-fi.com/cr0ww
www.buymeacoffee.com/cr0w
Join this channel to get access to perks:
/ @crr0ww
🎵 Music/Videos Used:
/ @kronomuzik = • [Twitch safe] Animal C...
/ @superlofiworld = • No Copyright Music Pla...
/ @jonathanwebster1452 = • Stargate style wormhole
❤️ Websites Featured:
www.elastic.co/blog/ten-proce...
learn.microsoft.com/en-us/win...
crows-nest.gitbook.io
crows-nest.gitbook.io/crows-n...
crows-nest.gitbook.io/crows-n...
The images and music used in this video are used under the principle of fair use for the purpose of criticism, comment, news reporting, teaching, scholarship, and research. I do not claim ownership of any of the images/music and they are used solely for the purpose of enhancing the content of the video. I respect the rights of the creators and owners of these images and will remove any image upon request by the rightful owner.
Copyright Disclaimer under section 107 of the Copyright Act of 1976, allowance is made for “fair use” for purposes such as criticism, comment, news reporting, teaching, scholarship, education, and research. Fair use is a use permitted by copyright statute that might otherwise be infringing.
🕰️ Timestamps:
00:00 - Intro
01:18 - Prerequisites
03:52 - Small Disclaimer
04:44 - What is Process Injection?
06:58 - Shellcode Injection
38:37 - Generating Shellcode
41:05 - Starting The Listener
41:36 - Performing The Injection
42:36 - Next Step
43:12 - What is a DLL?
45:03 - Creating a DLL
50:42 - DLL Injection
1:01:20 - Performing The Injection II
1:03:53 - Common Pitfalls
1:05:11 - Outro

Пікірлер: 390

@crr0ww Жыл бұрын

HELLO, EVERYONE :P THANK YOU SO MUCH FOR STICKING AROUND AND WATCHING THE VIDEO

@Celestenshi Жыл бұрын

@kedislav_ Жыл бұрын

this boolean statement is false

@Shrek5when Жыл бұрын

@@Celestenshi hi Elaine!

@Uriah_Heep_ Жыл бұрын

How would u use those if u don't have access to the server shell to run ur exe file?

5 ай бұрын

I could go pay lots and lots of money to learn this stuff and still wouldn't have it been explained that well. You have a talent for teaching.

Жыл бұрын

Imagine a "rewrite in rust, memory safety" comment on a malware dev video.

Жыл бұрын

Rewrite it in Rust so you can litter the code with unsafe { ... }! It does feel like when you use the Windows API in Rust you're just writing C but with Rust's syntax.

Жыл бұрын

@Adam Macdonald Really, not a great fit for the purpose.

Жыл бұрын

I asked him to rewrites it in rust over a month ago. Thanks for the support.

Жыл бұрын

I wrote an injector last night using Rust and it is literally just unsafe blocks & C-style typecasting everywhere

@yeahhhhhhhhhhhhhhhhhhhhhhhhhh 11 ай бұрын

@Adam Macdonald Yeah. Just write it in C. Saves all the hassle. Rust's syntax is weird anyway.

@dead-wi2el Жыл бұрын

malware is cool and all but youre an amazing presenter and you NEED to keep this up! love it!

@crr0ww Жыл бұрын

thank you so much for the kind words, I appreciate it so much

Жыл бұрын

@Proferk Malware is bad and unethical if it's used in a bad and unethical way

@css2165 11 ай бұрын

@@Proferk in ethical hacking, you could write special malware and deploy it onto your client's network, demonstrating security issues/outdated software versions. It's more likely for your client to fix those issues that way, since you are showing them it's possible to exploit certain vulnerabilities in their network.

@phi5835 8 ай бұрын

@@css2165 my wifes boyfriend sadly didnt see it that way 🙄

Жыл бұрын

i thought you were not gonna make these anymore thank you for these you really know how to make everything comprehensible

@Timm2003 Жыл бұрын

U can literally see that these videos take lots of time, the animations are great and the stuff is soo good explained, thank u!

@crr0ww 11 ай бұрын

i appreciate that so much, thank you so much

@no-one6790 Жыл бұрын

I JUST yesterday thought about learning some more about making malware and watching a video of yours, so this was a perfect timing!

Жыл бұрын

almost dropped my phone on my face seeing the notification for this video

@midenderboy5287 Жыл бұрын

Жыл бұрын

righttt

5 ай бұрын

I never thought I would learn about process injection so easily, in my mind it was a monster too complicated for me, and you just made it easy. Thank you so much for your content and I hope you do many many more of these! ❤

@rahulramteke3338 10 ай бұрын

This is content is at the level of John Hammond, Hackersploit, LiveOverflow etc Underrated

@Jenusx Жыл бұрын

Thanks! You are on a different level. You made complicated concepts easy to understand and fun at the same time.

@crr0ww Жыл бұрын

oh my GOD thank you so much!! that's so freaking sweet of you : ( you didn't have to do that !!

Жыл бұрын

@Proferk please just stfu

@lainwired3946 Жыл бұрын

@@Proferk you can rote memorise how to play a song on piano from a book or KZfaq video just like you can programming. Maybe you'd do it a lot slower, but when you're a new programmer, your code will be horribly inefficient too. Its understanding the concepts that's difficult, not the physical acts

@fransmanlaparis4830 Жыл бұрын

Crow, I know you must hear this all the time but: Your videos are amazing. You are funny and combine it with explaining things EXTREMELY well and easy to understand. Your edit is so perfect. A lot of programming "tutorials" or teachings just browse over stuff like we would take for granted, but you take time and explain it with easy language so people having difficulties learning can still follow along. As I learned to do dll injections when I used to create game hacks I feel how I took stuff for granted and had forgot about why we do certain stuff which would be very good knowledge to beginners wanting to learn. Sorry for the long comment (if you read it at all xD) but once again, Very big thank you for the videos, they are soo good and I hope they help you too as you said. Take care

@crr0ww Жыл бұрын

aw man : ( thank you so so so much. seriously, comments like this are what make all of this all so worth it. The point behind my videos is to make them super in-depth about things, almost to the point of it being exhausting, just so we're all on the same page - always. I'm so glad you got something out of this video. thank you so much

11 ай бұрын

Phenomenal explanation! I love how thorough you are when discussing the details, I wish I had someone like you to learn from when I first started out.

11 ай бұрын

At some point it's not about the info, it's about the way it's feed. Just wanna say thanks SO MUCH for the way you explain things, not only they're crystal clear but it's also fun to watch!

Жыл бұрын

Firstly I thought you wouldn't make next video but now I'm surprised. Good job, keep going! Thanks for your content ❤

@crr0ww Жыл бұрын

thank you so much! i appreciate that :D

@brmenna Жыл бұрын

I was waiting for the next episode! Thanks, you can explain really well

@crr0ww Жыл бұрын

thank you!! :) that's the goal

@Trikstarck 9 ай бұрын

Seriously, this video and the previous are so interesting, wonderfully presented and funny throughout. I’m sure you will be my main inspiration to get started in malware development, to aid my malware analysis selfstudy. Keep it up!

@jordan1300 10 ай бұрын

You explain this stuff very well and your random humour keeps me interested for the entire hour. Keep it up looking forward to part three!

@0xf1uff 9 ай бұрын

The way you are explaining goes straight to my brain in an understandable, funny and very pleasant way. Thank you for existing!

Жыл бұрын

i'm halfway trough the video and i have to say this is extremely impressive, cant wait for the next episode :D

@crr0ww Жыл бұрын

aw thank you so much, it makes me so happy to hear that you've enjoyed it so far : )

@ward7576 10 ай бұрын

@@crr0ww he must be a glowie trying to blend in

@WesselvanderGoot-tb9gg 10 ай бұрын

Thank you so much for what you're doing. I think you strike the exact right balance between being hilarious, humble, informative and interactive. The content you make is simply the best. I hope that you will continue making this content for a long time!

Жыл бұрын

really good explanation, the way it is presented is entertaining, but still very informational and you can really learn a lot from this, and overall this series is really good! also thanks for helping me with the shellcode injection on the discord lol, good thing you included the architecture thing in the video to avoid a lot of headaches

Жыл бұрын

It’s not that I want to know how to make malware, I’ve just been going to school for data science and want to get into some other low level stuff. Your video was one of the few that goes in depth on stuff, format structure and pacing is all bang on. So thanks!

@crr0ww Жыл бұрын

thank you! yeah, maldev deals with a lot of the super cool low-level stuff so it's always fun to talk about that : ), thank you so much for the comment!

11 ай бұрын

i love you, bringing all this content on an easy way to learn... really, thank you.

9 ай бұрын

You're a great communicator and stay focused on the issue at hand very well without unnecessary side trails

10 ай бұрын

Dude I love these videos please keep uploading them.

@christopherwoodall3464 11 ай бұрын

I love your style! Please keep these coming.

Жыл бұрын

The most anticipated sequel hahah, for real awesome work man, top educational videos

@crr0ww Жыл бұрын

thank you so much! : )

11 ай бұрын

This is super well done! It may be interesting to include toolhelp32snapshot stuff in the next vid for iterating thru processes to find the proc id.

@k1ber474 Жыл бұрын

No way, you really did second part at least of this playlist! Thank you! This time your cat is safe... (waiting for the next part)

@crr0ww Жыл бұрын

heheh thank you for sparing my cat >: ) (and thank you for the sweet comment

@IT_Shkolnik Жыл бұрын

Got this one in recommendations, and honestly, I really enjoyed your style of explanation. Also it seems that messing around with logging stuff is pretty interesting, never thought about it btw For me, this video is a different look at winapi and msdn. Usually I just search for the documentation of function I need, and experimenting with values until I get something working. At the same time you carefully read description of every argument, trying to figure out what each individual one means. Well done!

@crr0ww Жыл бұрын

thank you so much! i agree; actually, i used to be like that as well! I then started reading the documentation very deliberately and it actually made a lot of sense, and was really interesting for me as well - so I'm trying to share that experience with everyone : ) thank you so much for the kind comment, I appreciate it so much

@jamiraq8499 11 ай бұрын

@@crr0ww Brother, can you make an episode about making a Trojan for Android?

@uhhhwhatdoipick Жыл бұрын

great job on the video, crow! loving the content!

@crr0ww Жыл бұрын

thank you so much!! : ) i appreciate it so much

5 ай бұрын

I've been completely self taught for about 5 years now and I gotta say you have a way of explaining things that I have never seen before

@tracetv8115 5 ай бұрын

I love u video style and how u explain things! Absolutely amazing, pls continue with ur work!

@brandonwheeler2226 Жыл бұрын

good shit! been hype for this video since the first one!

Жыл бұрын

two hours ago i needed something to watch for the last two hours that was an hour long each ima hit the bell

Жыл бұрын

Again another banger please continue with that same energy ty :) !!

@crr0ww Жыл бұрын

thank you so much, i really appreciate that :)

Жыл бұрын

This content is peak, keep releasing this type of content!

@crr0ww Жыл бұрын

thank you so much, i appreciate that

@seeas.8093 Жыл бұрын

Was waiting for that video thanks!

@Celestenshi Жыл бұрын

AN HOUR LONG VIDEO HOLY! amazing amazing job crow definitely need to buy another cupcake :> or maybe a cookie bcs they're nice too :3 thank you for making such quality content, you're my new fav youtuber

@crr0ww Жыл бұрын

FIHAFIHIAIPHAFIHP THANK YOU SO MUCH WTFF you didn't have to elaine : (

@jwankrho Жыл бұрын

@@crr0ww My man is too excited, like a femboy...

11 ай бұрын

@Jwan Krho so I guess you felt nothing when you got your first pay check

@jwankrho 11 ай бұрын

@Latitud Dev my first paycheck went to my bills 🐻‍❄️

11 ай бұрын

@Jwan Krho what a shame, i got my first one at 16 so i was so exicted, but i think you get my point.

Жыл бұрын

The bg music >>>>>>>>>

@PetersExcapades Жыл бұрын

babe wake up, crow uploaded episode 2

Жыл бұрын

excited to watch! keep it up :D

@Diego-Garcia Жыл бұрын

"I'm just an average guy with internet connection" Being kind and teaching others is the greatest sign you're very knowledgeable in something! Just a note for what happened here: 1:02:00 CMD is a sh!t. When you select something on its window, it stops rendering new content. Make sure to clean every selection before anything else. You can clean up with right mouse, but it will also paste the clipboard content. Idk if ESC works. (or add a space)

@crr0ww Жыл бұрын

thank you so much diego, that's so kind of you - I don't regard myself as being knowledgeable xD I consider myself to be quite stupid at most things actually (not a bad thing, just means I have a lot to learn, which I'm always excited about!), I sincerely appreciate those incredibly kind words - regardless

@ad4m300 Жыл бұрын

What kind of visual theme is that? And what kind of font do you use? Btw really interesting video!

11 ай бұрын

I've recently been reading up about injecting DLLs as part of my internship at Microsoft, where a part of my work requires me to inject bunch of debugging based DLLs into humongous apps. I won't be able go more into detail than that without raising red flags. TLDR; Thank you for making it more intuitive to understand than any of the engineers on my have so far!

11 ай бұрын

Can you hook injection? I want to find a customized thing that can hook injection, can you?

10 ай бұрын

@SydneyWheeler-bh9xy Look into detouring function signatures. Might be a good starting place. You can hook anything as long as you know what to hook.

Жыл бұрын

babe wake up new bird vid just dropped

@fsec6369 11 ай бұрын

Greetings Bro!!, thank you for you time, your videos are awesome

@ayooshiyer8621 Жыл бұрын

I read your blog on this topic probably like 6 times

@buretmarcano8851 10 ай бұрын

waiting for mores videos! awesome content!

@cybersecadventures01123 Жыл бұрын

Finally...it's here...part 2❤

@netspud8422 11 ай бұрын

5 mins into the video. HOW AM I NOT ALREADY SUBSCRIBED?!

@yodaheyohannes2776 2 ай бұрын

Bruh I need your stuff, definitely subscribing

@ieatdapsy Жыл бұрын

One of the few youtubers who got me to hit the bell icon too

@crr0ww Жыл бұрын

i appreciate you, thank you so much

4 ай бұрын

There's no better defense than understanding the offense. And there's no worst defense than ignorance

@curryjl1027 6 ай бұрын

Another fantastic video, keep it up the good work!

@firosiam7786 Жыл бұрын

So if you wana get past any defenses could u modify the shell code so it won't get flaged or if someone has to write shellcode isn't shellcode just any native language code which is compiled ??

Жыл бұрын

Leeeeeeeeet's go i was losing hope, even watched again old videos.

@aalekhmotani3877 Жыл бұрын

you are not average!!, my mentor :)

@alexander_adnan 11 ай бұрын

7:54 😂😂😂😂 you are cool bro … i will follow this video .. will see how fun it can get

10 ай бұрын

This is a really good video, you have explained it perfectly. When can we expect part 3?

11 ай бұрын

congrats on 50k!!

Жыл бұрын

damnn 1hr of banger

@Zetty Жыл бұрын

Blessed be

@cassianoperes2062 6 ай бұрын

Amazing video, the example worked perfectly!

Жыл бұрын

Hello, man. IDK if you see it or!, but your videos is so cool. I appreciate it. Thanks a lot and hi from Russia. Love you and thanks, pls continue make it.

@crr0ww Жыл бұрын

aw man thank you so much, that's so sweet of you

@khaelkugler Жыл бұрын

This is so nicely broken down and explained, thanks! Also, you kinda sound like that youtuber Fe4rless, who did fortnite content a while back.

@crr0ww Жыл бұрын

thank you so much

Жыл бұрын

How can you only have 44.500 subs? You should atleast have 100k for that content. Your videos are fun to watch and good to understand!

@crr0ww Жыл бұрын

i wasn't even expecting to get 500 subs when I started this channel, I'm so grateful to everyone that's subscribed : (

7 ай бұрын

@@crr0ww I subscribed because I have no choice, YT will bury this channel If I didn't.

6 ай бұрын

You are hilarious! I have no intention of doing anything you're discussing and yet I will watch the entire video.

10 ай бұрын

great video, you explain things well

@ayooshiyer8621 Жыл бұрын

Holy shit! It’s here finally

Жыл бұрын

Perfect timing.

@squid13579 10 ай бұрын

For more help read Windows internals ! (Amazing book ) And good luck 😂.🔥

@jabr0nicus Жыл бұрын

this channel is goated tyvm🙏

@crr0ww Жыл бұрын

no, you're goated (ilysm thank you

11 ай бұрын

Could you explain how the encryption would work? Can you just run encrypted shell code or do you decrypt first?

11 ай бұрын

smooth start !

Жыл бұрын

It’s awesome please continue this course regular update ❤

@crr0ww Жыл бұрын

thank you : )

Жыл бұрын

Operation Tux is ongoing🐧

@noorkhara1429 Жыл бұрын

our dark overlord feeds us once again 🧎🏽‍♀️

@techjots 11 ай бұрын

Lmao

Жыл бұрын

DAMN AN HOUR LONG VIDEO LET'S GOOOO!!!

@crr0ww Жыл бұрын

>: ))))))

@whofuckingcares3 Жыл бұрын

Wooooooooo, new video, lets go

Жыл бұрын

Behold, caw caw is alive ! And damn nerdy-motivated !

@crr0ww Жыл бұрын

>: )

@suchtberater Жыл бұрын

AYOOOO

@Prohet200 10 ай бұрын

Do bad characters like "\x00" in your shell code cause any issues?

@IshuckShow 11 ай бұрын

Братан, хорош, давай, давай, вперёд! Контент в кайф, можно ещё? Вообще красавчик! Можно вот этого вот почаще?

Жыл бұрын

Dude you are awesome!

@bhavik_1611 Жыл бұрын

Finally ,The next video

@thereaperhimself5268 11 ай бұрын

Just a question, like in normal C/C++ would you not normaly Free the allocated memory again after use ? O.o Like with VirtualFreeEx()

10 ай бұрын

yea

Жыл бұрын

What window manager/panel/theme are you using in your kali vm? Btw, loving your videos :D

@Proferk Жыл бұрын

Not sure why he didn't reply after hearting the comment, but he's probably using bspwm with polybar and the catppuccin color scheme or similar ones

@crr0ww Жыл бұрын

oh crap, sorry about that, i meant to reply, I'm using bspwm with a custom polybar config : ) cattpuccin colour theme as well

Жыл бұрын

Oh okay, no problem ahah, thankss

@comosaycomosah 2 ай бұрын

the paperclip is a nice touch lol

@orlandocartwright1807 9 ай бұрын

Great video, thanks! Can you publish a teaching about Ring0?

@Tech69YT Жыл бұрын

excellent videos bro. subscribed :)

@crr0ww Жыл бұрын

thank you so much! i appreciate you

@0x0dy 7 ай бұрын

When i try to compile the program using g++, i get the following error: 'CreateRemoteThreadEx' was not declared in this scope; did you mean 'CreateRemoteThread'? I tried to use 'CreateRemoteThread' function, but the thread is not created and no error is returned. How can i fix that ?

@hotshot7019 7 ай бұрын

same issue

@kuenstername Жыл бұрын

Is there a more detailed explanation of the Kali part? I did get (with some research) the right Shellcode (I think xD) - but after that, I couldn't follow anymore. Anyways, great content :D