Thread-less Payload Execution

Avoiding the use of threads will help us minimize our artifacts as EDRs may subscribe to callbacks which can make thread creation visible at a kernel level.

For extra stealthiness, we may want to not use threads and find other ways to execute our payload.

Function Pointer Execution

This technique will use a function pointer to execute our payload, we will simply create a function pointer assigned to the address of our shellcode, and then proceed to call the function pointer thus calling our shellcode.

int (*func)();
func = (int (*)()) (void*)shellcode;
(int)(*func)();

This will make our payload run in the process's main thread instead of a new thread being spawned via createthread.

Callbacks

callbacks are functions that are called through a function pointer. If we pass a function pointer to our shellcode to a function that a requires a callback function as it's parameter, it will then instead execute our shellcode. This can be used to pass our shellcode instead of our function pointer.

An example of this is EnumFonts

EnumFonts(GetDC(0), (LPCWSTR)0, (FONTENUMPROC)(char *)shellcode, 0);

an extensive list of such functions you can abuse for shellcode execution can be found here:

GitHub - ChaitanyaHaritash/Callback_Shellcode_Injection: POCs for Shellcode Injection via CallbacksGitHub

Fibers

Fibers allow an app to schedule its own thread of execution rather than priority based scheduling. These are basically light weightthreads, and are invisble to the kernel due to the fact that they are implemented in kernel32.

To use fibers, we must call ConvertThreadToFiber, which will convert the thread running into a running fiber. We can then make additional fibers with the CreateFiber function.

To abuse this for shellcode execution we will:

1. Convert the main thread into a fiber

2. allocate shellcode

3. create a new fiber that points to our shellcode

4. schedule the new fiber that point to our schedule

5. the fiber gets scheduled and our shellcode runs

void * fMain = ConvertThreadToFiber(NULL);
void * lShellcode = VirtualAlloc(0, sizeof shellcode, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
void * shellcodeFiber = CreateFiber(NULL, (LPFIBER_START_ROUTINE)lShellcode, NULL);
SwitchToFiber(shellcodeFiber);