Windows-based CLI susceptible to process injection attack

Hackers could exploit a fresh process injection technique to conceal malware in a Windows-based CLI app

Rotem Kerner, a security researcher with cybersecurity firm enSilo, discovered and dubbed the technique "Ctrl-Inject". It abuses the Windows "CtrlRoutine" function, a function that provides the mechanism for handling Ctrl signals in console application.

Ctrl-Inject basically causes malicious threads to spawn inside the processes of legitimate CLI apps, which then allows malicious code to be run. 

Every time a user (or a process) sends Ctrl + C (or Break) signal to a console-based process (such as cmd.exe or powershell.exe), a system process called csrss.exe will invoke the function CtrlRoutine in a new thread on the targeted process.

"Essentially, in this process injection technique, we inject our code to the target process, but we never invoke it directly, that is, we never call CreateRemoteThread ourselves or alter execution flow using SetThreadContext. Instead, we are making csrss.exe invoke it for us which is far less suspicious since this a normal behaviour," said Kerner.

Among the applications that hackers could abuse are cmd.exe or powershell.exe, commonly found in most Windows systems. Normally, app processes can't be tampered with as Windows uses security protections such as Control Flow Guard and pointer encoding to verify such processes.

However, Kerner said in a blog post detailing the technical aspects of the flaw, that it was possible to bypass such protections.

Kerner said that a hacker could use the same function to create their own thread in a legitimate CLI app's process and run malware code. He said the main advantage of this technique over classic thread injection technique is that the remote thread is created by a trusted windows process, csrss.exe, which makes it much stealthier.

"The disadvantage is that it's limited to console application," he added.