Windows-based CLI susceptible to process injection attack

The fresh hacking technique could hide malware in legitimate apps

Hacking

Hackers could exploit a fresh process injection technique to conceal malware in a Windows-based CLI app

Rotem Kerner, a security researcher with cybersecurity firm enSilo, discovered and dubbed the technique "Ctrl-Inject". It abuses the Windows "CtrlRoutine" function, a function that provides the mechanism for handling Ctrl signals in console application.

Ctrl-Inject basically causes malicious threads to spawn inside the processes of legitimate CLI apps, which then allows malicious code to be run. 

Every time a user (or a process) sends Ctrl + C (or Break) signal to a console-based process (such as cmd.exe or powershell.exe), a system process called csrss.exe will invoke the function CtrlRoutine in a new thread on the targeted process.

"Essentially, in this process injection technique, we inject our code to the target process, but we never invoke it directly, that is, we never call CreateRemoteThread ourselves or alter execution flow using SetThreadContext. Instead, we are making csrss.exe invoke it for us which is far less suspicious since this a normal behaviour," said Kerner.

Among the applications that hackers could abuse are cmd.exe or powershell.exe, commonly found in most Windows systems. Normally, app processes can't be tampered with as Windows uses security protections such as Control Flow Guard and pointer encoding to verify such processes.

However, Kerner said in a blog post detailing the technical aspects of the flaw, that it was possible to bypass such protections.

Kerner said that a hacker could use the same function to create their own thread in a legitimate CLI app's process and run malware code. He said the main advantage of this technique over classic thread injection technique is that the remote thread is created by a trusted windows process, csrss.exe, which makes it much stealthier.

"The disadvantage is that it's limited to console application," he added.

Featured Resources

The definitive guide to warehouse efficiency

Get your free guide to creating efficiencies in the warehouse

Free download

The total economic impact™ of Datto

Cost savings and business benefits of using Datto Integrated Solutions

Download now

Three-step guide to modern customer experience

Support the critical role CX plays in your business

Free download

Ransomware report

The global state of the channel

Download now

Most Popular

How to find RAM speed, size and type
Laptops

How to find RAM speed, size and type

17 Sep 2021
What are the pros and cons of AI?
machine learning

What are the pros and cons of AI?

8 Sep 2021
Best MDM solutions 2020
mobile device management (MDM)

Best MDM solutions 2020

17 Sep 2021