MythicAgents / Apollo

A .NET Framework 4.0 Windows Agent
BSD 3-Clause "New" or "Revised" License
434 stars 90 forks source link

Syscall Injection Techniques #78

Closed djhohnstein closed 2 years ago

djhohnstein commented 2 years ago

This PR slight restructures the Injection project and introduces a new injection technique, Syscall_x64.NtCreateThreadEx. This is based off the work of @jackullrich in his Universal Syscall project here:

https://github.com/jackullrich/universal-syscall-64/

@SolomonSklash's article also was the foundation for this work:

https://www.solomonsklash.io/syscalls-for-shellcode-injection.html

Closes #77