Need to properly understand properly how NtMapViewOfSection works. Because the PoC writes shellcode to the local process’ mapped view with RW permissions, but creates a thread on a target process with a mapped view with RX permissions (to which nothing is explicitly written). I need to investigate how writing a shellcode in a locally mapped view affects a mapped view on a remote process. Creating a thread only makes sense when there is executable permissions. Perhaps this is some kind of “shared pool” mechanism.
Working
Create a new memory section with RWX permissions using NtCreateSection.
Map a view of the section into the local process with RW permissions using NtMapViewOfSection.
Get a handle to the target process using OpenProcess.
Map a view of the section into the target process with RX permissions using NtMapViewOfSection.
Copy the shellcode to local process’ view mapped by us using memcpy. This will reflect in the target process’ view
Create a remote thread in the target process using CreateRemoteThread to execute the shellcode.