Pentest Tools

Published on April 27th, 2017 📆 | 7626 Views ⚑

0

InfectPE – Inject Custom Code into PE File

iSpeech.org

• You can test your security products.
• Use in a phishing campaign.
• Learn how PE injection works.
• ...and so on.

Download
Windows x86 binary - Hardcoded MessageBoxA x-code, only for demos.

Dependencies:
vc_redist.x86 - Microsoft Visual C++ Redistributable

Usage

.\InfectPE.exe .\input.exe .\out.exe code

X-code is injected into code section, this method is more stealthy, but sometimes there is no enough space in the code section.

.\InfectPE.exe .\input.exe .\out.exe largest

X-code is injected into a section with the largest number of zeros, using this method you can inject bigger x-code. This method modifies characteristics of the section and is a bit more suspicious.

.\InfectPE.exe .\input.exe .\out.exe resize

Expand the size of code section and inject x-code. This technique, like "code" one, is less suspicious, also you can inject much bigger x-code.
In the patched file, ASLR and NX are disabled, for the more technical information you can analyze VS project.

Demo
"code" and "largest" techniques.

"resize" technique.