4. The executioner's toolkit (practical section). Continuation.
4.4. SysWhispers3: Behind the Scenes of Automation
Let’s understandwhat SysWhispers3 actually generates in order not to be just a user’scode.
After launching the script with the parameter--preset common, we get two key files: syscalalls.h and syscalls.c.Take a look at syscals.c:
Critical comments onthe code:
Conclusion:SysWhispers3 is a great start, but it needs to be finalized forproduction. Especially in terms of obfuscation and SSN search.
4.5. DInvoke: Power and flexibility C#
DInvoke is not justa library for syscal, it is a whole arsenal for memory operations.Let’s look at the key points.
Dynamic call throughdelegates (without P/Invoke):
Strengths ofDInvoke:
Example of ManualMapwith Dinvoke:
Important: ManualMapleaves characteristic traces in memory (for example, unaligned memoryregions with PAGE_EXECUTE_READWRITE rights). Advanced EDR (forexample, Elastic Endpoint) detect it through memory daps.
4.6. Own solutions: why and how
When you write yourtool from scratch, you control every byte. Let’s look at the keycomponents.
A. Search for the basic address of ntdll.dllvia PEB (without WinAPI):
B. Parsing PE andsearching for hash exports (not to shine lines):
V. Extracting SSNthrough Halo's Gate (UPD):
Mr. Shellcodegeneration with syscall straight on the fly:
Sometimes itis necessary to have shellcode itself using direct syscal. For this,you can generate code into memory.
Important: This codeis easily detected by signatures (e.g. B8 ???? ??? ?????? 0F 05 C3).You need to obfuscate: add NOPs, change the order of instructions,use equivalent instructions.
5. We prepare the soil: how to make it work in real life.Continuation.
5.5. The Problem of Arguments: Encryption and Disguise
When you callNtAlloccateVirtualMemory with PAGE_EXECUTE_READWRITE and MEM_COMMIT |MEM_RESERVE, it is a red flag. The solution is to divide theoperation and use less suspicious flags at every stage.
Exampleof a divided memory allocation:
This creates threesyscalle instead of one, but each of them looks less suspicious.
5.6. Working with Handle: Theft and Duplication
Direct syscall oftenrequire the transmission of the process or flow. UsingGetCurrentProcess() or OpenProcess with PROCESS_ALL_ACCESS issuspicious.
A. Theft of the Legitimate Process:
Manyprocesses have open management to other processes (for example,svchost.exe often has a duty to lsass.exe with limited rights). Youcan find and copy such a team.
B. Creation of theminimum necessary rights:
Instead of PROCESS_ALL_ACCESS, usespecific rights:
5.7. Departure fromthe detect on the chain of calls
EDR analyze syscallesequences. For example, the NtAllocateVirtalatureMemory ->NtWritVirtualMemory -> NtCreateThreadEx chain is classic for theinjector.
Oceanic chain:
Modification oforder: For example, first create the flow in a suspended state, thenwrite in memory, then resume.
6. Assembly of Frankenstein: from the sisocle to Shellcode.Deepening.
6.1. Reflexive DLL loading via direct syscal
Reflexive loading iswhen DLL loads itself without the help of LoadLibary. It’s moredifficult, but completely hidden from EDR.
Step-by-stepalgorithm:
Problems:
6.2. APC injection via NtQueueApThread
The alternative tothe flow is the use of APC (APC (APC). It could be less noticeable.
Features:
I want to add aboutSignatures in Memory. Modern EDRs not only look for sequences ofinstructions, but also analyze memory metadata. For example, if yourlynch code is right in the code of the line of the "kernel32.dl"or "CreateThread" strings, they will be found even if youdo not use WinAPI.
Decision: Equip all strings simple XORat the compilation stage, and in the tentime to decipher in thestack:
C:
Now that we have aworking toolkit, let’s talk about how EDR learns to detect directsyscal, and how to stay one step ahead. It’s a cat-and-mouse game,and we’re the mice with PhDs in x64 architecture.
4.4. SysWhispers3: Behind the Scenes of Automation
Let’s understandwhat SysWhispers3 actually generates in order not to be just a user’scode.
After launching the script with the parameter--preset common, we get two key files: syscalalls.h and syscalls.c.Take a look at syscals.c:
Critical comments onthe code:
- GetSyscalNumber uses PEB to search for threadll.dll. It’s better than GetModulehandle, but still leaves marks in memory (search by name of the module). More optimal is to hardcode the basic address of nddll (it is often permanent for one version of the OS) or to receive it through NtQueryInformation Project with the ProcessModuleInformation class.
- ExtractSNFromFunction is a simplified Hell's Gate. In reality, SysWhispers3 uses a more complex logic similar to Halo’s Gate, looking for syscall and moving up the code.
- Caching SSN is good, but a static variable in a function can be a problem for multithreading. It is better to put the cache into the global structure with synchronization.
Conclusion:SysWhispers3 is a great start, but it needs to be finalized forproduction. Especially in terms of obfuscation and SSN search.
4.5. DInvoke: Power and flexibility C#
DInvoke is not justa library for syscal, it is a whole arsenal for memory operations.Let’s look at the key points.
Dynamic call throughdelegates (without P/Invoke):
Strengths ofDInvoke:
- ManualMap : Download DLL directly from memory (a technique known as reflect DLL injection) without using LoadLiberry.
- OverloadOverload: Fake hucks to bypass calls (e.g., challenge NtWriteVirtualMemory via ZwWriteVirtualMemory with other parameters).
- Parsing PE files: Utilities to work with PE headlines, which is useful for manual mapping.
Example of ManualMapwith Dinvoke:
Important: ManualMapleaves characteristic traces in memory (for example, unaligned memoryregions with PAGE_EXECUTE_READWRITE rights). Advanced EDR (forexample, Elastic Endpoint) detect it through memory daps.
4.6. Own solutions: why and how
When you write yourtool from scratch, you control every byte. Let’s look at the keycomponents.
A. Search for the basic address of ntdll.dllvia PEB (without WinAPI):
B. Parsing PE andsearching for hash exports (not to shine lines):
V. Extracting SSNthrough Halo's Gate (UPD):
Mr. Shellcodegeneration with syscall straight on the fly:
Sometimes itis necessary to have shellcode itself using direct syscal. For this,you can generate code into memory.
Important: This codeis easily detected by signatures (e.g. B8 ???? ??? ?????? 0F 05 C3).You need to obfuscate: add NOPs, change the order of instructions,use equivalent instructions.
5. We prepare the soil: how to make it work in real life.Continuation.
5.5. The Problem of Arguments: Encryption and Disguise
When you callNtAlloccateVirtualMemory with PAGE_EXECUTE_READWRITE and MEM_COMMIT |MEM_RESERVE, it is a red flag. The solution is to divide theoperation and use less suspicious flags at every stage.
Exampleof a divided memory allocation:
This creates threesyscalle instead of one, but each of them looks less suspicious.
5.6. Working with Handle: Theft and Duplication
Direct syscall oftenrequire the transmission of the process or flow. UsingGetCurrentProcess() or OpenProcess with PROCESS_ALL_ACCESS issuspicious.
A. Theft of the Legitimate Process:
Manyprocesses have open management to other processes (for example,svchost.exe often has a duty to lsass.exe with limited rights). Youcan find and copy such a team.
B. Creation of theminimum necessary rights:
Instead of PROCESS_ALL_ACCESS, usespecific rights:
- PROCESS_VM_OPERATION for Memory Release
- PROCESS_VM_WRITE for memory recording
- PROCESS_VM_READ memory reading
- PROCESS_CREATE_THREAD to create flow
5.7. Departure fromthe detect on the chain of calls
EDR analyze syscallesequences. For example, the NtAllocateVirtalatureMemory ->NtWritVirtualMemory -> NtCreateThreadEx chain is classic for theinjector.
Oceanic chain:
- Adding garbage challenges: Call legitimate syscal between critical operations.
Modification oforder: For example, first create the flow in a suspended state, thenwrite in memory, then resume.
- Use alternative methods: Instead of NtCreateThreadEx use NtQueueApThread or RtlCreateUserThread.
6. Assembly of Frankenstein: from the sisocle to Shellcode.Deepening.
6.1. Reflexive DLL loading via direct syscal
Reflexive loading iswhen DLL loads itself without the help of LoadLibary. It’s moredifficult, but completely hidden from EDR.
Step-by-stepalgorithm:
Problems:
- ReflectiveLoader should be self-sufficient: not to use imports, work only through direct syscal.
- It is necessary to process relocations, imports, TLS-gallbacks.
- Modern EDR detect reflexion on anomalies in memory (unrotated regions, mixed rights).
6.2. APC injection via NtQueueApThread
The alternative tothe flow is the use of APC (APC (APC). It could be less noticeable.
Features:
- The flow should be in the alertable state (for example, calling SleepEx, WaitForSingleObjectEx, etc.).
- If the flow is busy, the APC may not be performed for a long time.
- You can use NtTestAlert to enforce APC.
I want to add aboutSignatures in Memory. Modern EDRs not only look for sequences ofinstructions, but also analyze memory metadata. For example, if yourlynch code is right in the code of the line of the "kernel32.dl"or "CreateThread" strings, they will be found even if youdo not use WinAPI.
Decision: Equip all strings simple XORat the compilation stage, and in the tentime to decipher in thestack:
C:
Now that we have aworking toolkit, let’s talk about how EDR learns to detect directsyscal, and how to stay one step ahead. It’s a cat-and-mouse game,and we’re the mice with PhDs in x64 architecture.
