Remote Thread Execution in System Process using NtCreateThreadEx for Vista & Windows 7

Remote Thread Execution in System Process using NtCreateThreadEx for Vista & Windows 7 | ClubHACK Magazine Skip to Main Content Area ClubHACKAbout UsTeamPartnersContributorsAuthorsArchives Contact UsSubscribeRSSAdvertise  HomeTech GyanLegal GyanTool GyanMom's GuideSpecial FeatureMatriux VibhagPosterDownloadsDownload PDF Home Remote Thread Execution in System Process using NtCreateThreadEx for Vista & Windows 7

Windows provides API function called, CreateRemoteThread Ref 2 which allows any process to execute thread in the context of remote process. This method has been mainly used to inject DLL into remote process, this technique is popularly known as 'DLL Injection'. Especially malware programs exploited this mechanism to evade their detection by injecting their DLL into legitimate processes such as Explorer.exe, Winlogon.exe etc. 

Vista & Session Separation 

This DLL Injection technique using CreateRemoteThread technique has worked flawlessly till Vista without any limitations. However since Vista onwards things have changed with the introduction of 'Session Separation'Ref 3. This was one of the many defenses introduced in Vista towards securing the system. 'Session Separation' ensured that core system processes including services always run in session 0 while all user process's run in different sessions. As a result any process running in user session failed to inject DLL into system process as CreateRemoteThread did not work across session boundaries. 

This is clearly evident from the MSDN documentation of CreateRemoteThread Ref 2 function... 

"Terminal Services isolates each terminal session by design. Therefore, CreateRemoteThread fails if the target process is in a different session than the calling process."

About NtCreateThreadEx Function

With the failure of CreateRemoteThread, there was a need for universal solution for remote thread execution on Vista and Windows 7 platform. Then comes the function, NtCreateThreadEx Ref 1, the undocumented function which provides complete solution for executing remote thread across session boundaries. It allows any process to inject DLL into any other process irrespective of the session in which it is running as long as it has sufficient privileges.  

Here is the prototype of NtCreateThreadEx function [undocumented]   

typedef NTSTATUS (WINAPI *LPFUN_NtCreateThreadEx) ( OUT PHANDLE hThread, IN ACCESS_MASK DesiredAccess, IN LPVOID ObjectAttributes, IN HANDLE ProcessHandle, IN LPTHREAD_START_ROUTINE lpStartAddress, IN LPVOID lpParameter, IN BOOL CreateSuspended, IN ULONG StackZeroBits, IN ULONG SizeOfStackCommit, IN ULONG SizeOfStackReserve, OUT LPVOID lpBytesBuffer);

This function is almost similar to CreateRemoteThread function except the last parameter which takes unknown buffer structure. Here is the definition of that buffer structure parameter...    

//Buffer argument passed to NtCreateThreadEx function struct NtCreateThreadExBuffer{ ULONG Size; ULONG Unknown1; ULONG Unknown2; PULONG Unknown3; ULONG Unknown4; ULONG Unknown5; ULONG Unknown6; PULONG Unknown7; ULONG Unknown8;};

This information is derived based on reverse engineering work. Hence meanings and importance of internal fields of this buffer structure is not clear.

Executing Remote Thread into System Process using NtCreateThreadEx

FunctionThe steps involved in the execution of the remote thread using NtCreateThreadEx is almost similar to that of CreateRemoteThread function. Hence the traditional steps such as allocating memory, copying the thread code into remote process are not repeated here. For detailed steps you can refer to article, "Three Ways to Inject Your Code into Another Process"  Ref 4.

Before we begin, we need to load NtCreateThreadEx function from Ntdll.dll as shown below.

HMODULE modNtDll = GetModuleHandle("ntdll.dll"); if( !modNtDll ){    printf("\n failed to get module handle for ntdll.dll, Error=0x%.8x", GetLastError());    return;}LPFUN_NtCreateThreadEx funNtCreateThreadEx = (LPFUN_NtCreateThreadEx) GetProcAddress(modNtDll, "NtCreateThreadEx");if( !funNtCreateThreadEx ){   printf("\n failed to get funtion address from ntdll.dll, Error=0x%.8x", GetLastError());   return;} 

Now setup the buffer structure which is passed as last parameter to NtCreateThreadEx function. 

//setup and initialize the bufferNtCreateThreadExBuffer ntbuffer; memset (&ntbuffer,0,sizeof(NtCreateThreadExBuffer));DWORD temp1 = 0;DWORD temp2 = 0; ntbuffer.Size = sizeof(NtCreateThreadExBuffer);ntbuffer.Unknown1 = 0x10003;ntbuffer.Unknown2 = 0x8;ntbuffer.Unknown3 = &temp2;ntbuffer.Unknown4 = 0;ntbuffer.Unknown5 = 0x10004;ntbuffer.Unknown6 = 4;ntbuffer.Unknown7 = &temp1;ntbuffer.Unknown8 = 0;

Finally execute remote thread 'pRemoteFunction' into remote process using NtCreateThreadEx function. Here one can use 'LoadLibrary' function address instead of 'pRemoteFunction' thread to implement 'DLL Injection' technique.

NTSTATUS status = funNtCreateThreadEx( &hThread, 0x1FFFFF, NULL, hProcess, (LPTHREAD_START_ROUTINE) pRemoteParameter, pRemoteParameter, FALSE, //start instantly NULL, NULL, NULL, &ntbuffer);Now check for the result of NtCreateThreadEx function and then wait for it to execute completely. if (hThread == NULL){    printf("\n NtCreateThreadEx failed, Error=0x%.8x", GetLastError());    return;}//Wait for thread to complete....WaitForSingleObject(hThread, INFINITE);  

Finally retrieve the return value from the remote thread function, 'pRemoteFunction' to verify the result of function execution.

//Check the return code from remote thread function int dwExitCode;if( GetExitCodeThread(hThread, (DWORD*) &dwExitCode) ){     printf("\n Remote thread returned with status = %d", dwExitCode);} CloseHandle(hThread);

The steps illustrated above are almost similar except that here NtCreateThreadEx is used instead of CreateRemoteThread for creating thread in the context of remote process

Limitations of NtCreateThreadEx Method

Though NtCreateThreadEx provides universal solution on Vista/Win 7 platform for remote thread execution, it is risky to use in the production code as it is an undocumented function. As things may change with new version and suppor packs, enough testing is necessary before putting it into production especially when injecting code into system critical process such as LSASS.EXE, CSRSS.EXE.

Another limitation is that it cannot be used in earlier platforms before Vista, such as Windows XP because NtCreateThreadEx function is available only Vista onwards. However developers can easily tune their code to dynamically use CreateRemoteThread function on XP and NtCreateThreadEx for Vista/Windows 7.

Alternative Techniques 

Another way to inject DLL into system process is to write the service process (which will run in session 0) and then issue the command from user process to that service to inject DLL into any system process using the CreateRemoteThread function.
 
This technique will work for any system process running in session 0. But it will fail to execute thread into any other process running in session other than 0. 
 
Though it is a clumsy way of doing the work, it still holds good solution to inject thread into system process only.

Conclusion

This article provides practical implementation of using NtCreateThreadEx function to execute remote thread into any process on Vista/Windows 7 platform. Though it is undocumented function, it provides universal solution for executing code in any process across session boundaries imposed by Vista/Windows 7.

ReferencesNtCreateThreadEx FunctionMSDN Documentation of CreateRemoteThread FunctionImpact of Session 0 Isolation on ServicesThree ways to inject code into remote processAbout The AuthorNagareshwar is a security professional with the unbeaten passion towards Computer Security, mainly involved in Reverse Engineering, Security Research and developing Security Tools. He holds engineering degree in Computer Science from National Institute of Technology of Karnataka, Surathkal (KREC), India. He has professional experience of around 6+ years spanning across Novell & Citrix where he has worked on security and application virtualization technologies.

 

 

Microsoft VistaMicrosoft WindowstechGyanTerminal ServicesWindows 7 Add new comment Author  CHMag Collector's Edition Vol II