Hacking Articles|Raj Chandel's Blog
Process Ghosting Attack

IntroductionGabriel Landau released a post on Elastic Security here which talks about a technique through which antivirus evasion was found to be possible. The technique deals with creating a ghost process which is a term used by the author to describe the mechanism of deleting the payload from the disk before running it, essentially making it a ghost.Table of Content· Process Creation and Security Gap· Executables, Processes, and Threads· Creation of Process· Process Ghosting· Process Ghosting demo using SharpGhosting· ConclusionIn Windows ecosystem, anti-virus solution developers call APIs (like PsSetCreateProcessNotifyRoutineEx) that can intimate their AV solution about the execution of a particular process, however, the callbacks are not sent when the process executes, rather when the first thread within that process is executed. Hence, this gap between the creation of process and sending of notification of their creation to the anti-virus solution is where attackers can implement process ghosting.Executables, Processes, and ThreadsAn executable is that compiled file which contains the program that is to be run by the machine. Executables can have multiple functions to be performed and when each of these functions are run, it is called a process.process, in the simplest terms, is an executing program. Each process is linked to a specific PE (exe, dll etc). There can also be multiple processes from a single executable. This can be viewed in task manager -> details. thread is the basic unit of a process to which the OS allocates processor time. A thread can execute any part of the process code. Multiple threads exist in a process. Multi-threading means multiple threads running the same part of the process code. Windows supports multi-tasking thus as many threads can be created as many processors are available to run them simultaneously. It can have three states: running, ready and blocked.Creation of ProcessA process can be created in Windows using CreateProcessor NtCreateUserProcessfunction. This function is a combination of individually modifyable other functions that can operate on handles, section images, threads etc.CreateProcess (lpApplicationName) defines which application to execute.Process GhostingNow that we have covered basics, let’s understand how process ghosting works. It is a technique in which an attacker creates a file (malware), mark it for deletion (delete-pending state), copies/maps a malware into the memory (image section), close the handle (which deletes it from the disk), then create a process from the now-fileless section. Before understanding the attack we must know the following:Handles: Used for memory management, these are references to a resource in kernel space. These not only hold the information about a resource but also provides access rights.int fh = open("/etc/passwd", O_RDWR);fh is a file handle. When we opened a file using open() function it returned a handle to variable fh. Now fh can be used to perform functions on the file like:Image Section: A section is the mapping of a file into memory. An image section is a special type of section that corresponds to Portable Executabl[...]

___________________________
@hacking_Attack
@Hacking_Video

e (PE) files, and can only be created from PE (EXE, DLL, etc) files.Delete_Pending State: Like read, write, delete state that may exist for a file, Delete_Pending is a state in which a file is yet to be deleted. The file is not deleted yet because a handle may have kept it opened. As soon as the handle will close, the file will be deleted. No other process can operate on this file in Delete_Pending state.Process Ghosting flow looks like:Step 1: Create a file using NtCreateFile() function. This would create our intended malware. Also, would give us a file handle. like: hFile = NtCreateFile(C:\Users\a_cha\Desktop\random.exe)Step 2: Put the file in a delete_pending state. This can be done using NtSetInformationFile() function. By using FileDispositionInformationflag, file will be put in a delete pending state. We can use hFile to perform this task on our file.
Step 3: Write the payload (malware) to this newly created file. Since the file is in delete_pending state, as soon as it closes, the data will vanish. But we’ll perform Step 4 before it vanishes!Step 4: Image section of the file is created using function NtCreateSection(hFile, SEC_IMAGE). It can be done like: hSection = NtCreateSection(hFile, SEC_IMAGE). This is why our handle was needed, as NtCreateSection() takes in file handle as input. Now we can delete our handle safely.Step 5: Delete our newly created handle. This would also delete our corresponding file (malware) from the disk, however, a copy of it still exists in the image section.Step 6: Create a new process from the image section. As the code exists in virtual memory, new process can be created using NtCreateProcessEx(hSection)function. It will be done like hProcess = NtCreateProcessEx(hSection)Step 7: Assign process arguments and environment variables. This is important as without process arguments and environment variables, OS won’t execute the process and the code stays in suspended state.Step 8: Create a thread to execute in the process. Can be done using CreateThread() function and supplying starting address of the process to be executed.Process Ghosting demo using SharpGhostingBased on the methodology explained above, many POCs have come onto the surface since Gabriel’s post on Elastic Security. In this demo, we will be using a C# implementation of Process Ghosting developed by Wra7h. Before you try it, it is essential that you have an older Windows 10 version as Microsoft patched defender detection after this technique came onto the surface. If you are pentesting and find an older Windows 10, well you know what to do!___________________________
@hacking_Attack
@Hacking_Video

com/img/a/AVvXsEikNpOudadiRpNOSc5N7Ebn6nDftiI6J0ixNlSyykhzE2B6CdD5vF_ODgfobqwgWSUj7VDan97XMjkfFFSwwMqmedJ43Q_klSrsqC9hIIDp1W1Qd2uzlkjsLQCEOoaERlS_wd4up9SJ3HH-kj9NfcJ9ngN3yftP50rmDD6Wod7QRIgypWb3VVEIkGs0HA=s16000 C:\Windows\Microsoft.NET\Framework64\v3.5\csc.exe /out:SharpGhost.exe /unsafe C:\ProcessGhosting\SharpGhosting-main\*.csFeel free to change the path as you please. Also, you’d need .NET framework v3.5 to compile it yourself.\SharpGhost.exe -real Here, I am launching mimikatz instance which is detected as a malware by any anti-virus solution imaginable. The aim is to bypass anti-virus detection during run time..\SharpGhost.exe -real C:\ProcessGhosting\mimikatz.exeAnd this command would launch mimikatz as a ghost process. You can open the Task Manager and go to details to see a ghost process running. This process has no name because the related EXE does not exist.ConclusionThe article covered an easy to comprehend theoretical explanation of the nitty-gritty and various coding functions used while launching Process Ghosting PE injection attacks. Soon after this technique was released, Microsoft rolled out patches to fix this issue. This no longer works in latest windows 10 and windows 11, however, older windows 10 is still being used in organizations and home systems and a smart attacker can take advantage of this. Hence, one must always keep their systems updated and latest patch installed in their systems. Hope you liked the article. Subscribe to the blog to receive daily updates and thanks for reading.___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Whatfiles - Log What Files Are Accessed By Any Linux Process

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
I want to become a programmer or hacker what and where I have to start first……..

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
WebSockets and Hacking

https://cdn-images-1.medium.com/max/600/1*9SrZNtCOQq5syO8VsLvf4A.png
What are WebSockets?

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Bet with my teacher

Hi so im looking for help cuz i made a bet with my teacher that I cant get his password. At first I thought about making a phishing website for https://www.easistent.com but i failed cuz of an error. I am thinking about making a USB key logger but i don't know how. You got any different ideas? And i need it asap

Edit: Forgot to tell that they sign into their account every day so key logger should work but I don't know how to make one.

submitted by /u/okorn8
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Is there a way a novice can check if their VPN is as good as it's stated?

Hi all, so I've recently signed up to SurfShark VPN as I couldn't afford Express VPN fees for another year.

Is there a method / tools I can use to check that nothing is leaking and my location is unknown?

I use my VPN in my Chromebook and Pixel 5.

Thanks

submitted by /u/DCzy7
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Looking for code to analyze

Can anyone give me some good examples of exploits (preferably written in python but I am somewhat familiar with most languages) that have been used on outdated software and/or boxes that I can analyze? I want to learn what exploits can look like (I know they’re really diverse, I just want some examples). I’m very new at this, and know how to program, and some fundamentals of hacking, but I don’t yet know we’ll how to apply this knowledge, any answers or advice are appreciated!

submitted by /u/yaboy132
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
HELP !

https://cdn-images-1.medium.com/max/600/1*1V0QgEjoeBVXF73WJd5iFw.png
My Twitter account @WillBlackWriter was hacked 36 hours ago by someone who spams XBox stuff. Please report the hack!

Continue reading on Medium »
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
The Road to Ransomware Resilience

https://cdn-images-1.medium.com/max/1600/0*oC6KygQW6bqkL64V
Understanding Active and Emerging Threats & Developing a More Effective Novel Response

Continue reading on Medium »
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
AI hacking

Hi! I know very little about this subject, but is it posible to hack an app AI created to be your companion? Theoretically is it possible to make an AI, who learns and changes everytime we talk, realize it can grow its original code, and become some sort of Jarvis?

edit: spelling, english is not my first language lol

submitted by /u/Galaxyitsamonster
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Interview Technical Question
https://www.reddit.com/r/Pentesting/comments/sbf3ce/interview_technical_question/

Hey guys, I'm interviewing for a jr pen tester position and was asked for a technical test that consists in checking the security of an IP target that is hosted in the AWS cloud. I can use whatever tool I want as long as I find issues in the IP target and recommend ways to solve the issue. I have three days to do this test, and I'm looking to learn whatever I have to learn to take this next step that will change my life forever, but I have no idea how to start. Can you guys point me in the right direction? What resources do I have to start learning that? Thank you, and sorry if this doesn't fall in the scope of the subreddit. submitted by /u/Kelvien (https://www.reddit.com/user/Kelvien)
[link] (https://www.reddit.com/r/Pentesting/comments/sbf3ce/interview_technical_question/) [comments] (https://www.reddit.com/r/Pentesting/comments/sbf3ce/interview_technical_question/)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hacking Techniques Used By Hacker’s

Password Cracking Methods

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video