So in this video we'll be discussing about the threads asynchronous processor cores.
So IPC is a function that executes asynchronously in the context of particular thread.
When an IPC is queued to a thread, the system issues software in the next time thread we should do
it will run this APC function, so we'll be issuing the user mod APC and in order to in order for the
thread to run that function, that should be in the other state.
So here the thread to which queued is not related to the function unless it is in a laptop state.
So the thread goes into the writable state where these functions so three pegs, wait for similar object
x, etc..
So what we're going to do is first we are going to write our shell code into the remote process and
we'll be using the apex function for the thread to go into the other state.
And in this adaptable state, the thread monitors for this APC queue and if there is any function in
that APC queue, then it's going to execute that function.
So I'm I open the two projects.
So one is a normal three program.
It will use the three picks to go into a one minute sleep and it goes into the other state as well.
So I have already implemented this open process.
It's very not nothing much process, all access inheritable first and pad.
Now we are going to write the our paper into this process.
So we'll be first allocating using what, x.
Independent juror.
So the system will decide where to allocate.
So the size, let's face it, will bites.
Allocation tapes.
So men commit and deserve.
And the page production is page execute rate rate.
So the value is just hexadecimal 40.
Now the return type is the base address.
No.
Now we have allocated we need to write our payload into that memory region.
If base address not is equal to or in 2.0, then the memory region was committed.
Then we can write the payload to that region.
So we are going to use right process memory.
I have already defined all of these functions in another file so you can copy from in work or you can
just copy from previous programs or you can directly copy from the website.
So let's go and write this one.
And the proc handle.
Process handle.
And the base address and the payload.
Where are that length?
And we are going to create a variable bytes.
Return is equal to zero and that will be out.
Now we can place another check condition if bite's return greater than zero, but obviously the better
will be written.
So after that, what we need to do is we need to
call this function.
Q User ABC And here the first parameter is the functions address and the thread handle and the parameter
to the function.
So it's very simple.
So before getting the thread handle, we need to use open thread function.
So I have already searched for these constant values and copied here.
So these are similar to the process of access.
So now we need to call open thread to get the thread handle.
So desired access thread all access and inherit handle true and thread id that is the thread id will
be getting that using processor card.
And the return type is the thread handle.
Now we can pass this thread handler to the queue user apk function.
And the function address is the base address.
At that base address, the our shared code resides.
And the third handle which we have got recently and the function parameter is not.
So I think we are good to go.
Now here we have first input.
So.
If I go and run this one.
So let's stop here and put a breakpoint at this.
And let's also put break point just after the right process memory.
And we can get the process ID.
So if you want to inject into other processes, you can inject as well.
So you can loop over through all the threads and identify which thread the pass which to that process
belongs, which process that thread belongs to.
And then you need to wait until the thread goes into a vegetable state.
Otherwise you are not going to execute for demonstrated purpose.
I am going to create another process and the process pad is this one.
Copy this.
And pasted here and the thread ID is go to threads and here you will have the thread data.
Copy this one.
So we have said and today we are going to open the process and allocate some memory and writing the
payroll.
So let's run this.
And if you go and see.
Okay.
So we are not printing anything.
So let's go to print.
Remote base address.
Or you can also check in the process for read, write, execute regions.
So let's run this and let's close this one and open another memory window.
That is memory two.
So memory two is this process.
Now copy the trade data.
And now let's run this and you have the best address.
So if you go to this and we will have this category.
So let's go ahead and run this one.
Now the program is waiting for our input.
Now you can directly go and cue this, uh, APC function.
So let's continue this.
And it's.
So we have killed the APC function and now if I go and hit enter, this threat will go in order to --
and our paper gets executed.
So now we can see after a.
Give this input.
This function goes out that goes into the writable state.
But this function and our projects executed.
I.
So you can also.
So now let's go into this sleep mode state.
Now our program is in alliteration.
Now we can go ahead and try to run this to pop up the calculator.
So that's how you kill the user.
PC to a thread and the thread must be in order to set to execute our payload.