Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Owner: User #71473
List of ideas for fun and interesting ways to kill/crash a process (WreckingCrew)
WreckingCrew
| Concept | Status | Name |
|---|---|---|
| Inject a thread that calls ExitProcess | DONE | ExitRemoteProcess_LTWR |
| Inject a thread that calls sprint_s from msvcrt with a bogus pointer for the format string | DONE | CrashRemoteProcess_KAOS |
| Inject a stub function that calls CreateProcessW with a constant string for lpCommandLine | Concept phase | CrashRemoteProcess_EMPR |
Inject a stub or DLL that divides by zero |
Concept phase |
CrashRemoteProcess_DKNS |
| Inject a stub or DLLDynamic Link Library that dereferences a NULL pointer | Concept phase |
CrashRemoteProcess_ZMUS |
| Inject a stub or DLLDynamic Link Library that double frees a buffer | Concept phase |
CrashRemoteProcess_XDTH |
| Inject a stub or DLLDynamic Link Library that walks through the Process looking for writable pages and fills them with garbage | Concept phase |
CrashRemoteProcess_KFKA |
| Inject a stub or DLLDynamic Link Library that walks through the handle table of a process and does bad things to the handles – like close them out from under the process if this is even possible | Concept phase |
CrashRemoteProcess_SEPH |
| Suspend all of the threads in a process and leave them like that, then inject one thread that pegs the CPU for each core on the box. Do this to enough processes and fun will ensue? Or maybe just overwrite the process with garbage and resume all the threads. |
Concept phase | CrashRemoteProcess_ULTM |
| Inject a thread that calls CharUpperA from user32 with a bogus pointer | DONE | CrashRemoteProcess_DGLD |
Fun things to do with these:
- Kill pesky processes in unit tests that don't want to die normally
- Knockover PSPs
- Troll people
- CA
POC Tools:
WreckingCrewPlayground: Starts notepad and calls ExitRemoteProcess, then starts it again and calls CrashRemoteProcess_KAOS
WarheadsToForeheads: Enumerates every possible PIDProcess ID on the system and attempts to call ExitRemoteProcess, then CrashRemoteProcess_KAOS if that fails. If run as a normal user, will only kill basic user processes, but may repeatedly kill processes that restart if they get a higher PIDProcess ID than the currently enumerated pid. Crashes the system if run as SYSTEM.
AdNauseum: If run as a non-SYSTEM user, infinitely kills explorer.exe, which is mildly annoying. If run as SYSTEM, infinitely kills dwm.exe, which destabilizes the UIUser Interface to the point that moving the mouse and/or clicking on things at just the wrong time crashes Winlogon. Lots of fun
KillItWithFire: (Concept) Simple tool (Injectable DLLDynamic Link Library or EXE) that targets a specific pre-configured process name or takes a PIDProcess ID or name via the commandline and knocks it over using as many techniques as it takes. RedShirt on crack.