MythicAgents / Apollo

A .NET Framework 4.0 Windows Agent
BSD 3-Clause "New" or "Revised" License
434 stars 90 forks source link

Sacrificial Process Hot-Patch for PPID+Block Dlls #54

Closed djhohnstein closed 2 years ago

djhohnstein commented 2 years ago

This hotpatch is meant as a quick-fix to some bugs I introduced with the latest PPID/Block DLLs release. Unfortunately, there were some unforeseen consequences about using the StartupInfoEx structure and thevarious CreateProcess calls. Those nuances had to be painstakingly teased out, and in the process I had to discover the boundaries of ppid spoofing. This PR introduces significant guard rails in order to provide some stability.