4

With metasploit, we can do thing like injecting a backdoor to one exe file. For example, msfvenom is used ( here is a link for reference https://www.offensive-security.com/metasploit-unleashed/backdooring-exe-files/). Could you please tell me what really happens behind the scene when we inject shell code to an exe file?

To me, injecting backdoor to one exe file is just like injecting code to one existing process; and as I know, dll injection and inline function hooking can do this. However, we need to do DLL injection and inline function hooking in Windows. Here, metasploit and msfvenom could run in linux. Please help me correct my understanding if is there anything wrong.

2

When you run an executable, you're basically getting your computer to read and execute some specified sections of the file. Oversimplification:

Imagine you're reading a document. You first open the document and your reader will display the contents of the file to you. It can do this because the preceding section of the file, or its header tells it what the file is and what to do with it and also what sections are filled with valid data.

Something similar happens when you run an executable. Your computer reads the file and understands what section of the file to execute to show you some output on the screen. When msfvenom backdoors an executable, it identifies what sections of the compiled file are marked with executable data and proceeds to replace or add it's own payload (like a reverse shell script or whatever you'd like) in this place. When you send it to your victim and they run the file, their systems end up running the evil payload as it thinks it's legitimate. This sometimes does backfire though - since msfvenom has no way to see exactly what it's replacing, it sometimes replaces crucial portions like the GUI and that makes the executable look broken on execution.

You could do this yourself too. Just replace the main function of a program with your payload and it'll execute it as the normal application would.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.