MITRE ATT&CK™ Process Injection: Asynchronous Procedure Call - Technique T1055.004
Theory
This page explores APC (Asynchronous Procedure Call) Shellcode Execution technique with the undocumented Native API, NtTestAlert, to execute shellcode within a local process.
An APC (Asynchronous Procedure Call) is a function that executes asynchronously in the context of a specific thread. Windows provides the NtQueueApcThread function, which allows an APC routine to be added to a thread’s APC queue. The function will execute when the thread enters an alertable state.
Conditions for Execution
For an APC to be executed, the target thread must enter an alertable state. This can be achieved through functions like:
SleepEx()
WaitForSingleObjectEx()
WaitForMultipleObjectsEx()
SignalObjectAndWait()
However NtTestAlert can be used during APC injection to:
Activate a thread’s alertable state.
Prompt the execution of queued APCs to execute our shellcode.
Execution Flow
Memory Allocation: Allocate memory using NtAllocateVirtualMemory.
Shellcode Injection: Write shellcode to the allocated memory via NtWriteVirtualMemory.
Memory Protection Change: Modify the memory protection to executable with NtProtectVirtualMemory.
Queue APC Function: Use NtQueueApcThread to queue the shellcode for execution.
Trigger APC Execution: Force the thread into an alertable state using NtTestAlert, which executes the shellcode.
Practice
The following code implements this technique:
We can compile it from linux using following command
