SysWhispers3 - AV/EDR Evasion Via Direct System Calls
http://www.kitploit.com/2022/03/syswhispers3-avedr-evasion-via-direct.html

SysWhispers helps with evasion by generating header/ASM files implants can use to make direct system calls. Why on earth didn't I create a PR to SysWhispers2? The reason for SysWhispers3 to be a standalone version are many, but the most important are: SysWhispers3 is the de-facto "fork" used by Inceptor (https://github.com/klezVirus/inceptor), and implements some utils class which are not relevant to the original version of the tool. SysWhispers2 is moving towards supporting NASM compilation (for gcc/mingw), while this version is specifically designed and tested to support MSVC (because Inceptor (https://github.com/klezVirus/inceptor) will stay a Windows-only framework for the near future). SysWhispers3 contains partially implemented features (such as egg-hunting) which would not be sensible to include in the original version of the tool.
Differences with SysWhispers2 The usage is pretty similar to SysWhispers2 (https://github.com/jthuraisamy/SysWhispers2), with the following exceptions: It also supports x86/WoW64 It supports syscalls instruction replacement with an EGG (to be dynamically replaced) It supports direct jumps to syscalls in x86/x64 mode (in WOW64 it's almost standard) It supports direct jumps to random syscalls (borrowing @ElephantSeal's idea (https://twitter.com/ElephantSe4l/status/1488464546746540042)) A better explanation of these features are better outlined i the blog post SysWhispers is dead, long live SysWhispers! (https://klezvirus.github.io/RedTeaming/AV_Evasion/NoSysWhisper/) Introduction Security products, such as AVs and EDRs, usually place hooks in user-mode API functions to analyse a program execution flow, in order to detect potentially malicious activities. SysWhispers2 is a tool designed to generate header/ASM pairs for any system call in the core kernel image (ntoskrnl.exe), which can then be integrated and called directly from C/C++ code, evading user-lands hooks. The tool, however, generates some patters which can be included in signatures, or behaviour which can be detected at runtime. SysWhispers3 is built on top of SysWhispers2, and integrates some helpful features to bypass these forms of detection. Installation git clone https://github.com/klezVirus/SysWhispers3.git C:\> cd SysWhispers3 C:\> python .\syswhispers.py --help">C:\> git clone https://github.com/klezVirus/SysWhispers3.git
C:\> cd SysWhispers3
C:\> python .\syswhispers.py --help
Usage and Examples The help shows all the available commands and features of the tool: python syswhispers.py -h usage: syswhispers.py [-h] [-p PRESET] [-a {x86,x64}] [-m {embedded,egg_hunter,jumper,jumper_randomized}] [-f FUNCTIONS] -o OUT_FILE [--int2eh] [--wow64] [-v] [-d] SysWhispers3 - SysWhispers (https://www.kitploit.com/search/label/SysWhispers) on steroids optional arguments: -h, --help show this help message and exit -p PRESET, --preset PRESET Preset ("all", "common") -a {x86,x64}, --arch {x86,x64} Architecture -c {msvc,mingw,all}, --compiler {msvc,mingw,all} Compiler -m {embedded,egg_hunter,jumper,jumper_randomized}, --method {embedded,egg_hunter,jumper,jumper_randomized} Syscall recovery method -f FUNCTIONS, --functions FUNCTIONS Comma-separated functions -o OUT_FILE, --out-file OUT_FILE Output basename (w/o extension) --int2eh Use the old `int 2eh` instruction in place of `syscall` --wow64 Use Wow64 to run x86 on x64 (only usable with x86 architecture) -v, --verbose Enable debug output -d, --debug Enable syscall debug (insert software breakpoint)'>C:\>python syswhispers.py -h

usage: syswhispers.py [-h] [-p PRESET] [-a {x86,x64}] [-m {embedded,egg_hunter,jumper,jumper_randomized}] [-f FUNCTIONS] -o OUT_FILE [--int2eh] [--wow64] [-v] [-d]

-a {x86,x64}, --arch {x86,x64}
Architecture
-c {msvc,mingw,all}, --compiler {msvc,mingw,all}
Compiler
-m {embedded,egg_hunter,jumper,jumper_randomized}, --method {embedded,egg_hunter,jumper,jumper_randomized}
Syscall recovery method
-f FUNCTIONS, --functions FUNCTIONS
Comma-separated functions
-o OUT_FILE, --out-file OUT_FILE
Output basename (w/o extension)
--int2eh Use the old `int 2eh` instruction in place of `syscall`
--wow64 Use Wow64 to run x86 on x64 (only usable with x86 architecture)
-v, --verbose Enable debug output
-d, --debug Enable syscall debug (insert software breakpoint)
Command Lines Standard SysWhispers, embedded (https://www.kitploit.com/search/label/Embedded) system calls (x64) # Export all functions with compatibility for all supported Windows versions (see example-output/).
py .\syswhispers.py --preset all -o syscalls_all

# Export just the common functions (see below for list).
py .\syswhispers.py --preset common -o syscalls_common

# Export NtProtectVirtualMemory and NtWriteVirtualMemory with compatibility for all versions.
py .\syswhispers.py --functions NtProtectVirtualMemory,NtWriteVirtualMemory -o syscalls_mem SysWhispers3-only samples # Normal SysWhispers, 32-bits mode
py .\syswhispers.py --preset all -o syscalls_all -m jumper --arch x86

# Normal SysWhispers, using WOW64 in 32-bits mode (only specific functions)
py .\syswhispers.py --functions NtProtectVirtualMemory,NtWriteVirtualMemory -o syscalls_mem --arch x86 --wow64

# Egg-Hunting SysWhispers, to bypass the "mark of the sycall" (common function)
py .\syswhispers.py --preset common -o syscalls_common -m jumper

# Jumping/Jumping Randomized SysWhispers, to bypass dynamic RIP validation (all functions) using MinGW as the compiler
py .\syswhispers.py --preset all -o syscalls_all -m jumper -c mingw

Script Output py .\syswhispers.py --preset common --out-file temp\syscalls_common -v . ,--. ,-. . . ,-. . , , |-. o ,-. ,-. ,-. ,-. ,-. __/ `-. | | `-. |/|/ | | | `-. | | |-' | `-. . \ `-' `-| `-' ' ' ' ' ' `-' |-' `-' ' `-' ''' /| | @Jackson_T `-' ' @modexpblog, 2021 Edits by @klezVirus, 2022 SysWhispers3: Why call the kernel when you can whisper? Common functions selected. Complete! Files written to: temp\syscalls_common.h temp\syscalls_common.c temp\syscalls_common_.asm Press a key to continue... ">PS C:\Projects\SysWhispers2> py .\syswhispers.py --preset common --out-file temp\syscalls_common -v

. ,--.
,-. . . ,-. . , , |-. o ,-. ,-. ,-. ,-. ,-. __/
`-. | | `-. |/|/ | | | `-. | | |-' | `-. . \
`-' `-| `-' ' ' ' ' ' `-' |-' `-' ' `-' '''
/| | @Jackson_T
`-' ' @modexpblog, 2021

Edits by @klezVirus, 2022
SysWhispers3: Why call the kernel when you can whisper?


Common functions selected.

Complete! Files written to:
temp\syscalls_common.h
temp\syscalls_common.c
temp\syscalls_common_.asm
Press a key to continue...

Importing into Visual Studio Copy the generated H/C/ASM files into the project folder. In Visual Studio, go to Project → Build Customizations... and enable MASM. In the Solution Explorer, add the .h and .c/.asm files to the project as header and source files, respectively. Go to the properties of the ASM file, and set the Item Type to Microsoft Macro Assembler. Compiling outside of Visual Studio Windows Makefile for 64 bits: Makefile.msvc OPTIONS = -Zp8 -c -nologo -Gy -Os -O1 -GR- -EHa -Oi -GS-

LIBS = libvcruntime.lib libcmt.lib ucrt.lib kernel32.lib

program:
ML64 /c syscalls-asm.x64.asm /link /NODEFAULTLIB /RELEASE /MACHINE:X64
cl.exe $(OPTIONS) syscalls.c program.c
link.exe /OUT:program.x64.exe -nologo $(LIBS) /MACHINE:X64 -subsystem:console -nodefaultlib syscalls-asm.x64.obj syscalls.obj program.obj
Makefile for 32 bits: Makefile.msvc OPTIONS = -Zp8 -c -nologo -Gy -Os -O1 -GR- -EHa -Oi -GS-
LIBS = libvcruntime.lib libcmt.lib ucrt.lib kernel32.lib

program:
ML /c syscalls-asm.x86.asm /link /NODEFAULTLIB /RELEASE /MACHINE:X86
cl.exe $(OPTIONS) syscalls.c program.c
link.exe /OUT:program.x86.exe -nologo $(LIBS) /MACHINE:X86 -subsystem:console -nodefaultlib syscalls-asm.x86.obj syscalls.obj program.obj
Compile with nmake: nmake -f Makefile.msvc
Linux Makefile for both 64 and 32 bits: Makefile.mingw CC_x64 := x86_64-w64-mingw32-gcc
CC_x86 := i686-w64-mingw32-gcc
OPTIONS := -masm=intel -Wall

program:
$(CC_x64) syscalls.c program.c -o program.x64.exe $(OPTIONS)
$(CC_x86) syscalls.c program.c -o program.x86.exe $(OPTIONS)
Compile with make: make -f Makefile.mingw
Caveats and Limitations The Egg-Hunter functionality is not implemented within this tool, it is in Inceptor (https://github.com/klezVirus/inceptor). System calls from the graphical subsystem (win32k.sys) are not supported. Tested on Visual Studio 2019/2022 with Windows 10 (https://www.kitploit.com/search/label/Windows%2010) SDK. Support for NASM is not guaranteed. Support for GCC and MinGW is not guaranteed. Troubleshooting From SysWhispers2 Type redefinitions errors: a project may not compile if typedefs in syscalls.h have already been defined. Ensure that only required functions are included (i.e. --preset all is rarely necessary). If a typedef is already defined in another used header, then it could be removed from syscalls.h. New With --verbose, it is possible to enable troubleshooting (https://www.kitploit.com/search/label/Troubleshooting) output during code generation. With --debug, the tool will insert a software breakpoint in the syscall stub, to ease the debugging (https://www.kitploit.com/search/label/Debugging) in WinDbg. If you get a error A2084:constant value too large during compilation, regenerates the stubs. Credits SysWhispers2 Developed by @Jackson_T (https://twitter.com/Jackson_T) and @modexpblog (https://twitter.com/modexpblog), but builds upon the work of many others: @FoxHex0ne (https://twitter.com/FoxHex0ne) for cataloguing many function prototypes and typedefs in a machine-readable format. @PetrBenes (https://twitter.com/PetrBenes), NTInternals.net team (https://undocumented.ntinternals.net/), and MSDN (https://docs.microsoft.com/en-us/windows/) for additional prototypes and typedefs. @Cn33liz (https://twitter.com/Cneelis) for the initial Dumpert (https://github.com/outflanknl/Dumpert) POC implementation. SysWhispers2 (x86/WOW64) @rooster (https://github.com/mai1zhi2) for creating a sample x86/WOW64 compatible fork. Others @ElephantSe4l (https://mobile.twitter.com/elephantse4l) for the idea about randomizing the jumps to the syscalls. @S4ntiagoP (https://twitter.com/s4ntiago_p) for the incredible work on nanodump (https://github.com/helpsystems/nanodump), which gave me tons of ideas. Licence As the original, this project is also licensed under the Apache License 2.0.

Download SysWhispers3 (https://github.com/klezVirus/SysWhispers3)

Dark Reading: Attacks/Breaches
How Do I Demonstrate the ROI of My Security Program?

Security teams must shift away from saying no, align security initiatives to business goals, and report metrics in a way business leaders can understand.

Dark Reading: Attacks/Breaches
Here's How Fast Ransomware Encrypts Files

New analysis shows how long it takes for each of the top 10 ransomware families to encrypt 100,000 files.

Dark Reading: Attacks/Breaches
WiCyS Members Now Have Access to Cyber Defense Challenge Through Target

Target's cybersecurity team has designed a Cyber Defense Challenge exclusively for members of Women in CyberSecurity (WiCyS).

Dark Reading: Attacks/Breaches
Indictment of Russian National Offers Glimpse Into Methodical Targeting of Energy Firm

Evgeny Viktorovich Gladkikh tried to cause catastrophic damage to Saudi oil refinery in 2017 via the Triton/Trisis malware, the US has alleged.

Hacking on Medium
Did you no. how hacker’s find vulnerable website using google ?

Don’t think more gays. They're using Google, Dorking involves using specific modifiers to search data. Searching the entire Web, users can…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
What Good Is School in the Internet Age?

https://cdn-images-1.medium.com/max/1920/1*cHpFTHcKqJBL6YDgzBV1uQ.jpeg
Adapting to the reality that all human knowledge is in every pocket

Continue reading on Geek Culture »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Symfonos:2 Vulnhub Walkthrough

https://cdn-images-1.medium.com/max/895/0*W2yF0QKNBAz_5J7C
Bugünkü yazımızda Vulnhub üzrinde bulunan ve orta seviye olan Symfonos2 makinesinin çözümünü paylaşıyor olacağız.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Browser in the Browser (BITB), la nueva técnica de phishing que puede hacerlo indetectable.

https://cdn-images-1.medium.com/max/1198/0*ftB_iRWgkhfdwx_l
PUBLICADO EN 25 MARZO, 2022POR EHACKING

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Supporting Student Innovation at HackMerced VII

https://cdn-images-1.medium.com/max/1200/1*2G6Pn1K-SVGwNGZGUUSKfg.png
Developer events and hackathons are making a comeback in 2022! Relive the fun and learn more about the winners.

Continue reading on Lob Developers »

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
SysWhispers3 - AV/EDR Evasion Via Direct System Calls

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
what's the best free/paid course to learn bash scripting from scrap ?

I am looking for good course on bash scripting and so far i am unable to find one , if anyone know any good free/ paid course which is really good , please share with me ... Have a beautiful day !

submitted by /u/1Harmandeep
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Is it illegal to access an app's images and source code for non-profit, non-malicious goals?

I'm part of a competitive community centered around teamgames in a mobile game, and currently trying to make a discord bot to automate some of the most tedious processes we usually perform on game screenshots.

I would like to be able to create images similar to those in game, both as a more familiar output for players and to generate arbitrary labeled images to train a classification IA on.

I have contacted the game's community manager, who shared me an incomplete google drive of weirdly scaled images and told me he'd ask the devs about the map-generating algorithm but I shouldn't expect an answer. About the missing images from the drive, he explained that was what the devs had given him and he didn't have any better. That was half a year ago, and I haven't heard from him yet. Overall, it looks to me like there is no opposition to me having those images and code, but they are not very well organized nor willing to bother.

Under these circumstances, is it illegal for me to try and obtain the app's images and source code?

Also, morally, if I were to make my bot and give the users an option to give me some money, like the other discord bots, would it be right to take money for work that is partly not mine?

submitted by /u/a1b2c3d4e5f6g8
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video