Art of the Dragon!

In this lab, I will learn to investigate and detect different code injection and remote file execution techniques used by threat actors to evade detection and maintain persistence on a compromised system. The lab consists of multiple tasks designed to provide hands-on experience in analyzing DLL Injection, Remote File Execution, and Remote PE Injection. These techniques are commonly used by adversaries to execute malicious code in the compromised system or within the address space of legitimate processes, making detection and mitigation more challenging.

Requirements

For this lab, I ensured that Ubuntu and Kali were working. As well as this, I checked my GOAD Windows VMs and that the Velociraptor Server was still properly installed on Ubuntu.

The tools I will be using are Sliver C2, SysInternals Sysmon, Velociraptor, and Process Hacker.

I downloaded the Simulation Tools from here or here. Password: infected.

Lab Setup and Getting Ready

This first part of the lab will focus on setting up the lab environment to simulate the real-world attack scenarios. I will be required to extract the provided files, configure a local HTTP server to serve the malicious payloads, and modify the Windows host file to resolve a simulated attacker's domain. This preparation ensures that all necessary components are in place for analyzing and investigating the various code injection techniques covered in the lab.

Extract Lab Files

On my Windows 11 VM, I extracted the provided tools to a working directory, leaving me with five files:

Setup HTTP Server on Kali

On Kali, I copied the files into a serving directory. I used /home/kali/Public. I made sure that Dll1.dll was also in this folder.

On Kali, I started a simple HTTP server:

sudo systemctl start apache2 && sudo systemctl status apache2

Modify Windows Host File

To simulate an attacker's infrastructure, I modified the Windows hosts file. Opening notepad as an Administrator, I opened C:\Windows\System32\drivers\etc\hosts and added the following line at the end of the file (the IP address is the Kali IP address):

I saved and closed the file once the line has been added!

Confirm the Domain Address is Reachable

I opened a command prompt window and pinged the remotesrv.lab domain. I made sure the domain was reachable before proceeding:

DLL Injection Investigation

A malicious script downloads a DLL from an attacker’s server and injects it into an unknown process. I need to determine the location of the downloaded DLL, which process it was injected into, any interesting keywords found inside the injected DLL, and how to remove the injected DLL.

Find the Downloaded DLL Using Sysmon

I downloaded and executed RemoteDLLInjection.exe on the victim machine. Navigating to Event Viewer and to the Sysmon -> Operational Logs, I looked at the following events:

Event ID 11 (FileCreate): Below shows the file creation event, including the filename as Dll1.dll with the file path as C:\Windows\Temp\Dll1.dll:

Event ID 8 (CreateRemoteThread): Below shows remote thread creation events, with the source process and the target process (explorer.exe, PID 5792):

Parent Processes and Related Sysmon Events:

---

---

Identify the Injected Process

From a command prompt, I ran ListDLLs from SysInternals:

listdlls64.exe > dlls.txt

I then searched the output file (dlls.txt) for the DLL name:

type dlls.txt | findstr /i "name.dll"

Note: the process that it is injected into is

---

Next, I will use Process Explorer to