https://github.com/hlldz/apc-ppid

Adds a user-mode asynchronous procedure call (APC) object to the APC queue of the specified thread and spoof the Parent Process.
https://github.com/hlldz/apc-ppid

Last synced: 22 days ago
JSON representation

Adds a user-mode asynchronous procedure call (APC) object to the APC queue of the specified thread and spoof the Parent Process.

• Host: GitHub
• URL: https://github.com/hlldz/apc-ppid
• Owner: hlldz
• Archived: true
• Created: 2019-04-03T09:36:42.000Z (over 5 years ago)
• Default Branch: master
• Last Pushed: 2019-06-10T01:26:17.000Z (over 5 years ago)
• Last Synced: 2024-08-05T09:15:51.875Z (4 months ago)
• Language: C++
• Size: 97.7 KB
• Stars: 157
• Watchers: 12
• Forks: 35
• Open Issues: 0
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

• awesome-network-stuff - **95**星 - mode asynchronous procedure call (APC) object to the APC queue of the specified thread and spoof the Parent Process. (<a id="295e14c39bf33cd5136be8ced9383746"></a>工具 / <a id="f855508acfc870b1f0d90ff316f1dd75"></a>伪造&&Spoof)

README

        
# APC-PPID

Nowadays, the most commonly used type of code injection is Reflective ones. This is due to high levels of stealth and Meterpreter, Beacon etc. projects support this type of injection. There is a rule: if something is popular, the defenders focus on it. I've seen so little that this rule has changed. Many studies have been done to capture the techniques of Reflective injections. I also do not prefer to use the popular things in red team operations at the first stage to avoid attracting attention.

This code adds a user-mode asynchronous procedure call (APC) object to the APC queue of the thread of the created process and spoof the Parent Process. So, you can do APC Injection with the code I shared and spoof the Parent Process as explorer.exe. The execution flow of the project is given below.

![](https://raw.githubusercontent.com/hlldz/APC-PPID/master/execFlow.png)

## Acknowledgements and References

* https://blog.xpnsec.com/becoming-system/

* https://www.countercept.com/blog/detecting-parent-pid-spoofing/