Download from: https://github.com/jmprsp/ProcessFailures
As presented in RECON 2016 by James Forshaw. He demonstrated that he is able to overwrite an application’s physical file while it is still running as a process. According to his presentation, NtCreateUserProcess returns a file handle when it is called. The file handle can be used to overwrite the running process His POC is in the form of C#/Powershell. I simply converted it to C/Executable.
To demonstrate that it really work, I used an executable that simply popup a message box; named demo.pdf. You can see the hexadecimal of the binary file in the HxD GUI below. On executing Overwrite.exe, demo.pdf will be created as a process and while it is still running, Overwrite.exe will then overwrite demo.pdf with an actual pdf file (Process Failure modes – Final.pdf).
Usage of the program is as follows: Overwrite.exe [Full path to executable] [input file]
As we can see from the above screenshot, demo.pdf is executed as a process but HxD has already reflected the new bytes in Demo.pdf. We can also observe that demo.pdf file size has changed to 3MB from 165KB proving that this trick did indeed work.
From a RE point of view, we should keep a look out on the CREATE_INFO’s AdditionalFileAccess mask and the usage of undocumented API as shown below.