JustC2 Docs
JustC2 Docs
Comenzar
Comenzar

Injection-BOF

Injection-BOF provides multiple shellcode injection techniques into remote processes. From classic section-based techniques to advanced PoolParty techniques that abuse Windows Thread Pool internals for EDR evasion.

Compatible agents: Beacon, Gopher, Kharon | Platform: Windows

inject-cfg

Configures default parameters for injection operations. These values apply to other injection commands when not explicitly specified.

inject-cfg

Allows setting defaults such as memory allocation type, page protections, and other options that affect injection behavior.

Use case: Run before an injection campaign to establish optimal parameters for the target environment. Useful when performing multiple injections with the same configuration.

inject-sec

Injects shellcode into a remote process using the memory section-based technique (NtCreateSection/NtMapViewOfSection). This technique creates a shared memory section between the agent process and the target process.

inject-sec <pid> <shellcode>
ArgumentRequiredDescription
pidYesTarget process ID
shellcodeYesShellcode to inject (file path or inline data)

Examples:

# Inject shellcode into process PID 3456
inject-sec 3456 /tmp/beacon_x64.bin

# Inject into an explorer.exe process
inject-sec 1892 /tmp/payload.bin

Use cases:

  • Migrate an agent to another process for persistence or evasion.
  • Deploy an additional agent in a process with a different security context.
  • Simpler and more direct technique when advanced EDR evasion is not required.

How it works:

  1. Creates a shared memory section with NtCreateSection.
  2. Maps the section into the local process with write permissions.
  3. Writes the shellcode into the locally mapped section.
  4. Maps the section into the remote process with execute permissions.
  5. Creates a remote thread that executes the shellcode.

inject-poolparty

Advanced injection that abuses Windows Thread Pool internal mechanisms. Offers 8 different techniques, each with varying levels of evasion and compatibility. These techniques are highly evasive against most EDR solutions.

inject-poolparty <pid> <technique> <shellcode>
ArgumentRequiredDescription
pidYesTarget process ID
techniqueYesTechnique number (1-8)
shellcodeYesShellcode to inject

Available techniques

#NameMechanismDescription
1Worker FactoryTP_WORKInserts a work item into the target process’s thread pool queue. Most reliable technique.
2TimerTP_TIMERAbuses thread pool timers to execute shellcode when the timer fires.
3WaitTP_WAITRegisters a wait callback in the thread pool that executes the shellcode.
4IO CompletionTP_IOUses IO completion ports to trigger shellcode execution.
5ALPCTP_ALPCAbuses Advanced Local Procedure Call ports of the thread pool.
6JobTP_JOBUses Job objects to trigger execution.
7DirectTP_DIRECTDirect insertion into the thread pool queue. Fast but more detectable.
8Alt TimerNtAssociateWaitCompletionPacketVariant using NtAssociateWaitCompletionPacket for stealthier execution.

Examples:

# Inject with Worker Factory technique (most reliable)
inject-poolparty 4520 1 /tmp/beacon.bin

# Inject with ALPC technique (stealthiest)
inject-poolparty 4520 5 /tmp/beacon.bin

# Inject with alternative Timer technique
inject-poolparty 3112 8 /tmp/payload.bin

Technique selection guide:

PriorityTechniqueWhen to use
High1 (Worker Factory)First choice, most stable and reliable
High5 (ALPC)When maximum evasion is needed
Medium2 (Timer)Solid alternative if 1 and 5 fail
Medium8 (Alt Timer)Variant for environments with advanced EDR
Low3-4, 6-7Use if primary techniques are detected

Use cases:

  • Environments with advanced EDR where traditional injection techniques are detected.
  • Agent migration to a long-lived process (explorer.exe, svchost.exe).
  • Stealthy deployment of additional payloads.

Note: PoolParty techniques work best with processes that have an active thread pool. Processes like explorer.exe, svchost.exe, and Windows services are the best candidates.

inject-32to64

Injects 64-bit shellcode from a 32-bit process (WoW64 transition). Solves the common problem of when the agent is running in a 32-bit process but needs to interact with native 64-bit processes.

inject-32to64 <pid> <shellcode>
ArgumentRequiredDescription
pidYesTarget 64-bit process ID
shellcodeYes64-bit shellcode to inject

Examples:

# Inject an x64 beacon from an x86 process
inject-32to64 2340 /tmp/beacon_x64.bin

Use cases:

  • The initial agent ran in a 32-bit process (such as a legacy application or x86 Office macro).
  • You need to migrate to a 64-bit process to access 64-bit APIs and memory.
  • Operations that require a 64-bit context (LSASS dumping, 64-bit registry access).

GUI integration

Injection-BOF integrates with the JustC2 graphical interface process browser. Right-clicking a process in the Process Browser displays the option to inject directly, providing a visual interface for selecting the target process without needing to know the PID manually.

  1. Use findobj module (Process-BOF) to find candidate processes.
  2. Configure injection with inject-cfg if needed.
  3. For environments without EDR or with basic EDR: use inject-sec.
  4. For environments with advanced EDR: use inject-poolparty with technique 1 or 5.
  5. If you’re in a 32-bit process and need to inject into 64-bit: use inject-32to64.
  6. Verify successful injection with process conn (Process-BOF) to confirm the new agent’s connections.
Prev
Process-BOF
Next
Postex-BOF