Remote Thread Execution in System Process using NtCreateThreadEx for Vista & Windows7

Windows provides API function called, CreateRemoteThread [Reference 2] which allows any process to execute thread in the context of remote process. This method has been mainly used to inject DLL into remote process, the technique popularly known as 'DLL Injection'. Especially malware programs exploited this mechanism to evade their detection by injecting their DLL into legitimate process's such as Explorer.exe, Winlogon.exe etc.

With the failure of CreateRemoteThread, there was need for universal solution for remote thread execution on Vista and Windows 7 platform. Then comes the function, NtCreateThreadEx [Reference 1], the undocumented function which provides complete solution for executing remote thread across session boundaries. It allows any process to inject DLL into any other process irrespective of session in which it is running as long as it has sufficient privileges.

Here is the prototype of NtCreateThreadEx function [undocumented]

typedef NTSTATUS (WINAPI *LPFUN_NtCreateThreadEx)
(
  OUT PHANDLE hThread,
  IN ACCESS_MASK DesiredAccess,
  IN LPVOID ObjectAttributes,
  IN HANDLE ProcessHandle,
  IN LPTHREAD_START_ROUTINE lpStartAddress,
  IN LPVOID lpParameter,
  IN BOOL CreateSuspended,
  IN ULONG StackZeroBits,
  IN ULONG SizeOfStackCommit,
  IN ULONG SizeOfStackReserve,
  OUT LPVOID lpBytesBuffer
);

This function is almost similar to CreateRemoteThread function except the last parameter which takes unknown buffer structure. Here is the definition of that buffer structure parameter...

//Buffer argument passed to NtCreateThreadEx function

struct NtCreateThreadExBuffer
{
  ULONG Size;
  ULONG Unknown1;
  ULONG Unknown2;
  PULONG Unknown3;
  ULONG Unknown4;
  ULONG Unknown5;
  ULONG Unknown6;
  PULONG Unknown7;
  ULONG Unknown8;
};

This information is derived based on reverse engineering work. Hence meanings and importance of internal fields of this buffer structure is not clear.
  
Executing Remote Thread into System Process using NtCreateThreadEx Function
The steps involved in the execution of the remote thread using NtCreateThreadEx is almost similar to that of CreateRemoteThread function. Hence the traditional steps such as allocating memory, copying the thread code into remote process are not repeated here. For detailed steps you can refer to article, "Three Ways to Inject Your Code into Another Process" [Reference 4].

Before we begin, we need to load NtCreateThreadEx function from Ntdll.dll as shown below.

HMODULE modNtDll = GetModuleHandle("ntdll.dll");

if( !modNtDll )
{
   printf("\n failed to get module handle for ntdll.dll, Error=0x%.8x", GetLastError());
   return;
}

LPFUN_NtCreateThreadEx funNtCreateThreadEx =
             (LPFUN_NtCreateThreadEx) GetProcAddress(modNtDll, "NtCreateThreadEx");

if( !funNtCreateThreadEx )
{
   printf("\n failed to get funtion address from ntdll.dll, Error=0x%.8x", GetLastError());
   return;
}

Now setup the buffer structure which is passed as last parameter to NtCreateThreadEx function.

//setup and initialize the buffer
NtCreateThreadExBuffer ntbuffer;

memset (&ntbuffer,0,sizeof(NtCreateThreadExBuffer));
DWORD temp1 = 0;
DWORD temp2 = 0;

ntbuffer.Size = sizeof(NtCreateThreadExBuffer);
ntbuffer.Unknown1 = 0x10003;
ntbuffer.Unknown2 = 0x8;
ntbuffer.Unknown3 = &temp2;
ntbuffer.Unknown4 = 0;
ntbuffer.Unknown5 = 0x10004;
ntbuffer.Unknown6 = 4;
ntbuffer.Unknown7 = &temp1;
ntbuffer.Unknown8 = 0;

Finally execute remote thread 'pRemoteFunction' into remote process using NtCreateThreadEx function. Here one can use 'LoadLibrary' function address instead of 'pRemoteFunction' thread to implement 'DLL Injection' technique.

NTSTATUS status = funNtCreateThreadEx(
                        &hThread,
                        0x1FFFFF,
                        NULL,
                        hProcess,
                        (LPTHREAD_START_ROUTINE) pRemoteFunction,
                        pRemoteParameter,
                        FALSE, //start instantly
                        NULL,
                        NULL,
                        NULL,
                        &ntbuffer
                        );

Now check for the result of NtCreateThreadEx function and then wait for it to execute completely.

 if (hThread == NULL)
{
    printf("\n NtCreateThreadEx failed, Error=0x%.8x", GetLastError());
    return;
}

//Wait for thread to complete....
WaitForSingleObject(hThread, INFINITE);

Finally retrieve the return value from the remote thread function, 'pRemoteFunction' to verify the result of function execution.