POC of PPID spoofing using NtCreateUserProcess with syscalls to create a suspended process and performing process injection by overwritting ntdll:LdrInitializeThunk with shellcode.
Note: Non-reflective shellcode is required for this to work
-
Notifications
You must be signed in to change notification settings - Fork 13
PorLaCola25/PPID-Spoofing
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Folders and files
| Name | Name | Last commit message | Last commit date | |
|---|---|---|---|---|
Repository files navigation
About
POC of PPID spoofing using NtCreateUserProcess with syscalls to create a suspended process and performing process injection by overwritting ntdll:LdrInitializeThunk with shellcode.
Resources
Stars
Watchers
Forks
Releases
No releases published
Packages 0
No packages published