FunctionStomping

Description

This is a brand-new technique for shellcode injection to evade AVs and EDRs. This technique is inspired by Module Stomping and has some similarities. As to this date (23-01-2022) also hollows-hunter doesn't find it.

The biggest advantage of this technique is that it isn't overwritting an entire module or pe, just one function and the target process can still use any other function from the target module.

The disadvantage is that it won't work for every function in the wild (but it will work for most of them), the exact explanation is in my blog: The Good, The Bad And The Stomped Function.

NOTE: It is possible that AV will flag this, if the signature is a signature of msfvenom/metasploit it is fine! you just need to change the shellcode or encrypt it.

UPDATE: Apperantly this isn't the first PoC avaliable and RastaMouse wrote a blog post that is a similar thing in C#.

Usage

You either include the header to your program like this:

#include "functionstomping.hpp"

int main() {
    // Just get the pid in any way and pass it to the function.
    DWORD pid = 3110;
    FunctionStomping(pid);
    return 0;
}

Or use the rust program:

cd functionstomping
cargo b
functionstomping.exe <pid>

After you ran this program you MUST call the function from the remote process! (If you used the default function CreateFile then you must call to it from the remote process!).

Setup

Currently, the shellcode to run is just to pop a calculator, but all you need to do is replace the unsigned char shellcode[] with your shellcode. I used C++ 17 and VS2019 to compile the program with the C++ header and rust version 2021 to compile the rust program (you can see the dependencies in the Cargo.toml).

POC

Disclaimer

I'm not responsible in any way for any kind of damage that is done to your computer / program as cause of this project. I'm happily accept contribution, make a pull request and I will review it!

Acknowledgments

ModuleStomping

Masking Malicious Memory by CyberArk

RastaMouse's Version