Windows-x64-Processes-Injector

Shellcode Title: Windows/x64 - Inject All Processes with Meterpreter Reverse Shell (655 Bytes)
Tested on: Windows 10 v2004 (x64)
Compiled from: Kali Linux (x86_64)
Shellcode Description:
64bit Windows 10 shellcode that injects all processes with Meterpreter reverse shells. The shellcode first resolves the base address of
kernel32.dll dynamically in memory via the Intel GS Register & host processes Process Environment Block (PEB). Then resolves the addresses
for the OpenProcess, VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread APIs via kernel32.dll's Export Table.
Once all API's are resolved the shellcode then attempts to open a handle to other processes using the OpenProcess API via bruteforcing the PIDs.
When a handle to a remote process is returned, the shellcode then attempts to allocate writable & executable memory in the remote process using the
VirtualAllocEx API. If successful, the shellcode will then use the WriteProcessMemory API to write the Meterpreter shellcode into the memory of the
remote process. To this point, if everything has returned sucessful, then the CreateRemoteThread API will be executed to create a thread in the remote
process that will run the Meterpreter shell within that remote process. The shellcode then continues to bruteforce through more PIDs to launch more
Meterpreter shells.

Name		Name	Last commit message	Last commit date
Latest commit History 3 Commits
README.md		README.md
x64win-InjectAllProcMeterpreterRevSh.asm		x64win-InjectAllProcMeterpreterRevSh.asm

Provide feedback