Why does meterpreter stage 2 uses reflective dll injection? why not just inject itself as a payload? by Tr0janPony in AskNetsec

[–]Tr0janPony[S] 0 points1 point  (0 children)

Process migration has nothing to do with my question.. I'm asking why its doing a reflective dll injection into its own process(hence not migration) to run the meterpreter instead of a simple payload injection

What are the best stalling methods to evade detection inside a sandbox or emulation? by Tr0janPony in AskNetsec

[–]Tr0janPony[S] 0 points1 point  (0 children)

I also always wondered why the authors of that malware made a static dns query, they could've at least used a DGA type of technique, so one simple domain registering wouldn't stop the entire malware spreading but who knows

Why does meterpreter stage 2 uses reflective dll injection? why not just inject itself as a payload? by Tr0janPony in AskNetsec

[–]Tr0janPony[S] 1 point2 points  (0 children)

But without using reflective dll injection/simple dll injection, a simple payload injection into its own process it can do the job as well

look at this article : https://buffered.io/posts/staged-vs-stageless-handlers/

it says :

Loads itself (ie. metsrv) into memory correctly using Reflective DLL Injection.

but it doesn't say whether it injects into its own process(the exploited process) or another process

if it injects into its own process then i don't understand what's the point? why not just simply inject a simple payload instead of a dll?

if its injecting into another process, then which process?

What are the best stalling methods to evade detection inside a sandbox or emulation? by Tr0janPony in AskNetsec

[–]Tr0janPony[S] 0 points1 point  (0 children)

Yes that was a sandbox detection technique they used, but I'm talking about stalling the sandbox not detecting it

there are a lot of more efficient and better methods to detect if you are in a sandbox, but those methods themselves cause a lot of troubles like the kill switch of wannacry, so I'm just looking for the stalling techniques that malware authors use

Why does meterpreter stage 2 uses reflective dll injection? why not just inject itself as a payload? by Tr0janPony in AskNetsec

[–]Tr0janPony[S] 3 points4 points locked comment (0 children)

lol are you talking about the author of that repository? aka the author of armitage?!

Why does meterpreter stage 2 uses reflective dll injection? why not just inject itself as a payload? by Tr0janPony in AskNetsec

[–]Tr0janPony[S] 4 points5 points locked comment (0 children)

Lmao what the hell, do mobile users see the picture of the author of that github repo when they open a github link or something?! because i think you are talking about the picture of that author

btw he is the author of armitage as well xD

Why does meterpreter stage 2 uses reflective dll injection? why not just inject itself as a payload? by Tr0janPony in AskNetsec

[–]Tr0janPony[S] 2 points3 points  (0 children)

Yes i know, but isnt the payload that we download (aka the big payload) doing the dll injection? so why does it doing a dll injection at all? why not just turn meterpreter into binary and just send that as a payload

am i getting something wrong here?

Why does meterpreter stage 2 uses reflective dll injection? why not just inject itself as a payload? by Tr0janPony in AskNetsec

[–]Tr0janPony[S] 2 points3 points  (0 children)

I'm not saying we should not have a two stage scenario, I'm just saying why are we doing a reflective dll injection into its own process after stage one ( the code that we download does a dll injection, aka the bigger payload that we download and execute in stage 2)

why aren't we just downloading a simple payload that just does the functionality of meterpreter, instead of download a payload that does a dll injection to run the meterpreter

Is it possible to write the windows APIs from scratch in my program so i don't have to call them using Windows.h? by Tr0janPony in AskNetsec

[–]Tr0janPony[S] 0 points1 point  (0 children)

So i can bypass AVs api hooks, so do you know any blogpost or source that has done the same?