https://github.com/hasherezade/process_ghosting

Process Ghosting - a PE injection technique, similar to Process Doppelgänging, but using a delete-pending file instead of a transacted file
https://github.com/hasherezade/process_ghosting

pe-injection pe-injector pefile

Last synced: about 1 month ago
JSON representation

Process Ghosting - a PE injection technique, similar to Process Doppelgänging, but using a delete-pending file instead of a transacted file

• Host: GitHub
• URL: https://github.com/hasherezade/process_ghosting
• Owner: hasherezade
• License: mit
• Created: 2021-06-16T00:59:47.000Z (about 3 years ago)
• Default Branch: master
• Last Pushed: 2024-03-11T18:23:06.000Z (6 months ago)
• Last Synced: 2024-06-01T18:07:35.861Z (3 months ago)
• Topics: pe-injection, pe-injector, pefile
• Language: C
• Homepage:
• Size: 70.3 KB
• Stars: 606
• Watchers: 12
• Forks: 113
• Open Issues: 7
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

• awesome-hacking-lists - hasherezade/process_ghosting - Process Ghosting - a PE injection technique, similar to Process Doppelgänging, but using a delete-pending file instead of a transacted file (C)

README

        
Process Ghosting

==========

[![Build status](https://ci.appveyor.com/api/projects/status/2nabj2ukws4ees0w?svg=true)](https://ci.appveyor.com/project/hasherezade/process-ghosting)

This is my implementation of the technique presented by [Gabriel Landau](https://twitter.com/GabrielLandau):


https://www.elastic.co/blog/process-ghosting-a-new-executable-image-tampering-attack

![](img/proc_ghost.png)

Characteristics:

-

+ Memory artifacts as in [Process Doppelgänging](https://github.com/hasherezade/process_doppelganging)

+ Payload mapped as `MEM_IMAGE` (unnamed: not linked to any file)

+ Sections mapped with original access rights (no `RWX`)

+ Payload connected to PEB as the main module

+ Remote injection supported (but only into a newly created process)

+ Process is created from an unnamed module (`GetProcessImageFileName` returns empty string)



WARNING: 


The 32bit version works on 32bit system only.