search

waldo-irc / JYang

MIT License
14 stars 9 forks source link

Dynamically Resolved Syscalls #2

Open felixguerrero12 opened 3 years ago

felixguerrero12 commented 3 years ago

This user story has been created to remove the command execution via user land and dynamically enumerate the Windows System Call tables to do code execution.

The Shad0w C2 code below does not fully do it correctly and would require a bit more effort to be operational. Proof of concept in Shad0w C2: https://github.com/bats3c/shad0w/commit/846546da9af81450f6bfb1ea0a5bf042d83c767a https://github.com/bats3c/shad0w/blob/846546da9af81450f6bfb1ea0a5bf042d83c767a/beacon/src/syscalls.c

The goals for this user story:

  1. Remove the dependency of user land command execution
  2. Walk the PEB and Enumerate the EAT.

Advantages:

  1. Support a wide-range of operating system.