Red Team Codex
  • Welcome to Red Team Codex (RTC)
  • Posts
    • Red Teaming
      • Initial Foothold Reconnaissance
  • Active Directory Enumeration
    • Overview
    • Domain Enumeration
      • Domain Name
      • Domain Forest Trusts
      • Password Policy
    • Computer Enumeration
      • Domain Controllers
    • User Enumeration
    • Group Enumeration
    • AppLocker Enumeration
  • Payload Development
    • VBA Macros and the Windows API
      • Windows Defender
  • AV / EDR
    • Windows Advanced Threat Protection (ATP)
  • Remote Process Injection
    • CreateRemoteThread()
    • QueueUserAPC()
    • QueueUserAPC() + NtTestAlert()
    • SetWindowsHookEx()
    • SetThreadContext()
    • Process Hollowing
  • My Config Files
    • Windows Terminal
    • Tmux Configuration
    • .bashrc and PS1 Environment
Powered by GitBook
On this page

Was this helpful?

  1. Remote Process Injection

QueueUserAPC() + NtTestAlert()

Use the previously documented QueueUserAPC() function to create an APC in the main thread, but then force the kernel to execute that thread.

PreviousQueueUserAPC()NextSetWindowsHookEx()

Last updated 4 years ago

Was this helpful?

DWORD QueueUserAPC(
  PAPCFUNC  pfnAPC,
  HANDLE    hThread,
  ULONG_PTR dwData
);

NTSYSAPI 
NTSTATUS
NTAPI
NtTestAlert( );

You can use NtTestAlert() to empty APC queue for the current thread. If the queue was empty before the call, NtTestAlert() has no effect.

  • Create a new sacrificial process in a suspended state

    • CreateProcess(CREATE_SUSPENDED)

  • Allocate some memory in the process

    • VirtualAllocEx()

  • Write shell-code to the remote process, or write a DLL to the process

    • GetProcAddress()

    • LoadLibrary()

    • WriteProcessMemory()

  • Queue a new procedure call in the process thread

    • QueueUserAPC()

  • Force the alert to the kernel

    • NtTestAlert()

https://docs.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-queueuserapc