EarlyCascade

POC for Early Cascade Injection technique to spawn a Message Box. Only NT APIs.

NtCreateUserProcess: create suspended process
NtQueryInformationProcess: get NTDLL address + functions
NtAllocateVirtualMemory: allocate memory
NtWriteVirtualMemory: write memory
NtResumeThread: resume suspended thread

What to expect?

PS Z:\pi\new\EarlyCascade\bin\Debug\net9.0> .\EarlyCascade.exe
[^] PROCESS HANDLE:                      2B0
[^] THREAD HANDLE:                       2AC
[^] g_ShimsEnabled ADDRESS:              7FFF7F15D194
[^] g_pfnSE_DllLoaded ADDRESS:           7FFF7F171268
[^] STUB ADDRESS:                        22EC1FB0000
[^] SHELLCODE ADDRESS:                   22EC1FB0185
[^] Enjoy!

To-Do

• Find g_ShimsEnabled and g_pfnSE_DllLoaded dinamically.
• Include user input for shellcode file.

References

• https://www.outflank.nl/blog/2024/10/15/introducing-early-cascade-injection-from-windows-process-creation-to-stealthy-injection/
• https://github.com/0xNinjaCyclone/EarlyCascade
• https://github.com/Cracked5pider/earlycascade-injection