407_Inject

Platform: grodno_new_year_2026 | Category: Forensics | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2026-01-10 | Status: Solved Techniques: api_call_analysis, process_enumeration, shellcode_identification, tls_callback_injection

Summary

Task: Analyze API Monitor capture file to identify process injection technique. Solution: Extract data from .apmx64 archive, identify TLS Callback Injection via Win32 API call chain (CreateToolhelp32Snapshot, VirtualAllocEx, WriteProcessMemory, CreateRemoteThread).

407_Inject — grodno_new_year_2026

Description

На компьютере университета мы нашли подозрительный процесс и сохранили его вызовы Win32 API, наш сотрудник безопасности подозревает технику инъекции, найди доказательства в пользу его теории.

(We found a suspicious process on the university computer and saved its Win32 API calls. Our security officer suspects an injection technique and is looking for evidence to support his theory.)

Files

• Inject.apmx64 - API Monitor capture file
• inject.exe.i64 - IDA Pro database ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Analysis

API Monitor File Format

The .apmx64 file is a ZIP archive containing:

• definitions - API definitions
• log/monitoring.txt - monitoring log
• process/0/data - API call data
• process/0/calls - call offsets
• process/0/info - process information

Data Extraction

 bash read-only • copy allowed Copy
unzip Inject.apmx64 -d inject_data/
strings inject_data/process/0/data | less
xxd inject_data/process/0/data | less

Discovered API Calls

Analysis revealed a classic Process Injection chain:

1. CreateToolhelp32Snapshot - creating a snapshot of all processes in the system
2. Process32First/Process32Next - enumerating processes to find the target
3. OpenProcess - opening the target process
4. VirtualAllocEx - allocating memory in the target process
5. WriteProcessMemory - writing shellcode
6. CreateRemoteThread - executing shellcode ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Shellcode Identification

Meterpreter reverse_tcp shellcode was discovered:

• Target address: 192.168.1.3:1337
• Shellcode size: 511 bytes

Injection Technique

Thread Local Storage (TLS) Callback Injection technique was used:

• TLS callbacks execute BEFORE the main() function
• Allows executing malicious code before the main program starts
• Can call ExitProcess() before main() executes

Interactive Part

The task had an interactive component at nc ctf.mf.grsu.by 9058 with 7 questions: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Q1: What process injection technique was used by the attacker? (3 words, 2 spaces)

Answer: Thread Local Storage

TLS callbacks are functions that are called when a DLL is loaded/unloaded or when a thread is created/terminated. They execute before main().

Q2: Which API call was used to create snapshots of all processes and threads in the system?

Answer: CreateToolhelp32Snapshot

Used for enumerating processes and finding the target process for injection.

Q3: What process is trying to find the exe file to inject the payload?

Answer: Notepad.exe ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Found when analyzing strings in API Monitor data.

Q4: What is the PID of the identified process?

Answer: 16224

Found in the OpenProcess call parameters.

Q5: What is the size of the shellcode?

Answer: 511

Size of the Meterpreter reverse_tcp shellcode.

Q6: Which API call was used to execute the embedded payload in the specified process?

Answer: CreateRemoteThread

Classic API for executing code in a remote process.

Q7: The injection method used by the attacker is executed before the main() is called. Which API call is responsible for terminating the program before executing the main() function?

Answer: ExitProcess ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

TLS callbacks can call ExitProcess before main() executes.

Solution

 python read-only • copy allowed Copy
#!/usr/bin/env python3
"""
407_Inject solver - Interactive Q&A
"""

import socket

def solve():
    host = "ctf.mf.grsu.by"
    port = 9058
    
    answers = [
        "Thread Local Storage",      # Q1: injection technique
        "CreateToolhelp32Snapshot",  # Q2: snapshot API
        "Notepad.exe",               # Q3: target process
        "16224",                     # Q4: PID
        "511",                       # Q5: shellcode size
        "CreateRemoteThread",        # Q6: execution API
        "ExitProcess"                # Q7: termination API
    ]
    
    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
        s.connect((host, port))
        
        for i, answer in enumerate(answers):
            # Receive question
            data = s.recv(4096).decode()
            print(f"Q{i+1}: {data}")
            
            # Send answer
            s.send((answer + "\n").encode())
            print(f"A{i+1}: {answer}\n")
        
        # Receive flag
        flag = s.recv(4096).decode()
        print(f"Flag: {flag}")
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

if __name__ == "__main__":
    solve()

References

• MITRE ATT&CK: Process Injection
• TLS Callback Injection
• API Monitor Documentation ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍