shad0w
shad0w copied to clipboard
migrate and binject don't work on idle processes
The migrate and binject commands don't work on idle processes.
User: lee | Computer: test | OS: Windows 10 (x64) | Secure: Yes | Ping: 1s
shad0w(lee@target) ≫ getpid
[i] Beacon (27b2499bf0f3386ba90ab1830860d292) received task
PID: 10744
Image: rundll32.exe
shad0w(lee@target) ≫ ps
[i] Beacon (27b2499bf0f3386ba90ab1830860d292) received task
PID PPID Arch User Name
=== ==== ==== ==== ====
0 0 [System Process]
4 0 System
120 4 Registry
636 4 smss.exe
964 744 csrss.exe
672 744 wininit.exe
676 592 csrss.exe
936 672 services.exe
5592 1188 x64 ACME-CORP\lee SystemSettings.exe
shad0w(lee@test) ≫ migrate -p 5592
[i] Beacon (27b2499bf0f3386ba90ab1830860d292) received task
shad0w(lee@test) ≫ getpid
[i] Beacon (27b2499bf0f3386ba90ab1830860d292) received task
PID: 10744
Image: rundll32.exe
Same results with the binject command.
Note: I tried migrating to a process that I know was active (Chrome) and it worked.
im having similar issues with shinject and all other injection methods. even provided CS bin -f shellcode (x64 -> x64) and tried 32 just cuz. no luck :(