QueueUserAPC() + NtTestAlert()
Use the previously documented QueueUserAPC() function to create an APC in the main thread, but then force the kernel to execute that thread.
DWORD QueueUserAPC(
PAPCFUNC pfnAPC,
HANDLE hThread,
ULONG_PTR dwData
);
NTSYSAPI
NTSTATUS
NTAPI
NtTestAlert( );
You can use NtTestAlert() to empty APC queue for the current thread. If the queue was empty before the call, NtTestAlert() has no effect.
  • Create a new sacrificial process in a suspended state
    • CreateProcess(CREATE_SUSPENDED)
  • Allocate some memory in the process
    • VirtualAllocEx()
  • Write shell-code to the remote process, or write a DLL to the process
    • GetProcAddress()
    • LoadLibrary()
    • WriteProcessMemory()
  • Queue a new procedure call in the process thread
    • QueueUserAPC()
  • Force the alert to the kernel
    • NtTestAlert()
Copy link