QueueUserAPC() + NtTestAlert()
Use the previously documented QueueUserAPC() function to create an APC in the main thread, but then force the kernel to execute that thread.
DWORD QueueUserAPC(
PAPCFUNC pfnAPC,
HANDLE hThread,
ULONG_PTR dwData
);
NTSYSAPI
NTSTATUS
NTAPI
NtTestAlert( );
You can use
NtTestAlert() to empty APC queue for the current thread. If the queue was empty before the call, NtTestAlert() has no effect.- Create a new sacrificial process in a suspended state
CreateProcess(CREATE_SUSPENDED)
- Allocate some memory in the process
VirtualAllocEx()
- Write shell-code to the remote process, or write a DLL to the process
GetProcAddress()LoadLibrary()WriteProcessMemory()
- Queue a new procedure call in the process thread
QueueUserAPC()
- Force the alert to the kernel
NtTestAlert()