kasturixbm5/staged-dll-injection-smb-

This is a proof-of-concept demonstration of staged DLL injection on Windows, written in C and built for red team certification study (CRTO). It was developed in an isolated lab environment and comes with a disclaimer that it is intended only for educational use and authorized security research, not for use against systems without explicit written permission. The technique works in two parts. The first part is a stager program that accepts a target Windows process ID as input. It opens a handle to that process, allocates a region of memory inside it, then instructs the process to load a DLL file from a remote SMB file share. SMB is the Windows file-sharing protocol used within corporate networks, so this approach is designed to work in Active Directory environments where machines can reach each other over SMB. The second part is the DLL itself, which contains an embedded shellcode payload. When Windows loads the DLL into the target process, the DLL's entry point fires automatically and executes the payload inside that process. The shellcode is generated separately using a standard security research tool called msfvenom, which produces a reverse TCP connection payload that calls back to a listener on the attacker's machine. The README walks through each step: generating the shellcode, embedding it in the DLL source code, compiling both files, hosting the DLL on an SMB server, setting up the listener, and running the stager against a live process ID. The techniques demonstrated include remote thread injection, DLL entry point abuse, shellcode embedding in C, and remote payload staging over a network share. The project was tested on Windows 10 with a command-and-control listener running on Kali Linux.