search

joshfaust / Alaris

A protective and Low Level Shellcode Loader that defeats modern EDR systems.
https://sevrosecurity.com/2020/10/14/alaris-a-protective-loader/
Apache License 2.0
884 stars 141 forks source link

Process 'MobSync.exe' always suspended #3

Closed WanderingCoder-Omen closed 3 years ago

WanderingCoder-Omen commented 3 years ago

Hi first of all great work. The idea of using direct calls and encrypted shellcode along with process hollowing and PPID spoofing is really cool. However I am facing a few issues. I compiled a fresh copy of the solution on a VM and generated the two exes. However cant get the loader to connect to the listener on localhost. The mobsync.exe process stays suspended. I am also getting a couple of warnings. I've attached a couple of screenshots. Can you identify what I'm doing wrong? Capture No connects :(

2 The warnings

3 OS and machine info

joshfaust commented 3 years ago

Hey,

I've pushed out a new version that may help with this. I think the issue may have been overwriting the shellcode prematurely and I've since added a 10 second buffer between hollow and and overwrite. Currently, I do not have any "Default" shellcode that will run like I did in the last revision. Could you generate some x64 shellcode (CS, Metasploit, etc.) and try?