Hacking Articles Tips Tricks Videos Tutorials
Photo
Dark Reading: Attacks/Breaches
SASE Market Worth $5.9B by 2028 — Report by MarketsandMarkets™
SASE Market Worth $5.9B by 2028 — Report by MarketsandMarkets™
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
What is ethical hacking and penetration testing? Get paid to hack
https://cdn-images-1.medium.com/max/1217/1*Z3HWyceGEXc1nOuJVMoD3Q.jpeg
Did you know you can get paid to hack computers? Ethical hacking involves legally breaking into computers to test an organization’s…
Continue reading on Dev Learning Daily »
What is ethical hacking and penetration testing? Get paid to hack
https://cdn-images-1.medium.com/max/1217/1*Z3HWyceGEXc1nOuJVMoD3Q.jpeg
Did you know you can get paid to hack computers? Ethical hacking involves legally breaking into computers to test an organization’s…
Continue reading on Dev Learning Daily »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Understanding Myszkowski Transposition Cipher: A Comprehensive Guide | 2023
https://cdn-images-1.medium.com/max/700/0*vuChw_9QwD5pnQB1.png
Exploring the Features, Encryption and Decryption Processes, and Use Cases of Myszkowski Transposition Cipher | Karthikeyan Nagaraj
Continue reading on Medium »
Understanding Myszkowski Transposition Cipher: A Comprehensive Guide | 2023
https://cdn-images-1.medium.com/max/700/0*vuChw_9QwD5pnQB1.png
Exploring the Features, Encryption and Decryption Processes, and Use Cases of Myszkowski Transposition Cipher | Karthikeyan Nagaraj
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
As cores dos times e seus significados: Times de Transição(Purple, Orange e Green team)
https://cdn-images-1.medium.com/max/1400/0*-xBmeOquYg25p3au
Para além do Red e do Blue Team, que tiveram suas características descritas nos posts “As cores dos times e seus significados: RED TEAM” e…
Continue reading on Medium »
As cores dos times e seus significados: Times de Transição(Purple, Orange e Green team)
https://cdn-images-1.medium.com/max/1400/0*-xBmeOquYg25p3au
Para além do Red e do Blue Team, que tiveram suas características descritas nos posts “As cores dos times e seus significados: RED TEAM” e…
Continue reading on Medium »
SilentMoonwalk - PoC Implementation Of A Fully Dynamic Call Stack Spoofer
http://www.kitploit.com/2023/04/silentmoonwalk-poc-implementation-of.html
http://www.kitploit.com/2023/04/silentmoonwalk-poc-implementation-of.html
PoC Implementation of a fully dynamic call stack spoofer TL;DR SilentMoonwalk is a PoC implementation of a fully dynamic call stack spoofer, implementing a technique to remove the original caller from the call stack, using ROP to desynchronize unwinding from control flow.
Authors This PoC is the result of a joint research done on the topic of stack spoofing. The authors of the research are: KlezVirus (https://twitter.com/KlezVirus) Waldo-IRC (https://twitter.com/waldoirc) Trickster0 (https://twitter.com/trickster012) I want to stress that this work would have been impossible without the work of Waldo-IRC (https://twitter.com/waldoirc) and Trickster0 (https://twitter.com/trickster012), which both contributed to the early stages of the PoC, and to the research behind the PoC. Overview This repository demonstrates a PoC implementation to spoof the call stack when calling arbitrary Windows APIs. This attempt was inspired by this Twitter thread (https://twitter.com/_Kudaes_/status/1594753842310434816), and this Twitter thread (https://twitter.com/namazso/status/1442314742488567808), where sensei namazso (https://twitter.com/namazso) showed and suggested to extend the stack unwinding approach with a ROP chain to both desynchronize the unwinding from real control flow and restore the original stack afterwards. This PoC attempts to do something similar to the above, and uses a desync stack to completely hide the original call stack, also removing the EXE image base from it. Upon return, a ROP gadget is invoked to restore the original stack. In the code, this process is repeated 10 times in a loop, using different frames at each iteration, to prove stability. Supported Modes The tool currently supports 2 modes, where one is actually a wrong patch to a non-working pop RBP frame identified, which operates by shifting the current RSP and adding two fake frames to the call stack. As it operates using synthetic frames, I refer to this mode as "SYNTHETIC". When selecting the frame that unwinds by popping the RBP register from the stack, the tool might select an unsuitable frame, ending up in an abruptly cut call stack, as observable below.
Authors This PoC is the result of a joint research done on the topic of stack spoofing. The authors of the research are: KlezVirus (https://twitter.com/KlezVirus) Waldo-IRC (https://twitter.com/waldoirc) Trickster0 (https://twitter.com/trickster012) I want to stress that this work would have been impossible without the work of Waldo-IRC (https://twitter.com/waldoirc) and Trickster0 (https://twitter.com/trickster012), which both contributed to the early stages of the PoC, and to the research behind the PoC. Overview This repository demonstrates a PoC implementation to spoof the call stack when calling arbitrary Windows APIs. This attempt was inspired by this Twitter thread (https://twitter.com/_Kudaes_/status/1594753842310434816), and this Twitter thread (https://twitter.com/namazso/status/1442314742488567808), where sensei namazso (https://twitter.com/namazso) showed and suggested to extend the stack unwinding approach with a ROP chain to both desynchronize the unwinding from real control flow and restore the original stack afterwards. This PoC attempts to do something similar to the above, and uses a desync stack to completely hide the original call stack, also removing the EXE image base from it. Upon return, a ROP gadget is invoked to restore the original stack. In the code, this process is repeated 10 times in a loop, using different frames at each iteration, to prove stability. Supported Modes The tool currently supports 2 modes, where one is actually a wrong patch to a non-working pop RBP frame identified, which operates by shifting the current RSP and adding two fake frames to the call stack. As it operates using synthetic frames, I refer to this mode as "SYNTHETIC". When selecting the frame that unwinds by popping the RBP register from the stack, the tool might select an unsuitable frame, ending up in an abruptly cut call stack, as observable below.
Synthetic Call Stack Mode A silly solution to the problem would be to create two fake frames and link them back to the cut call stack. This would create a sort of apparently legit call stack, even without a suitable frame which unwinds calling POP RBP, but: You would lose the advantage of the desync technique The stack would be still unwindable The resulting call stack could seem legit just on the first glance, but it would probably not pass a strict check The result of the _synthetic spoof can be observed in the image below:
Figure 1: Windows 10 (https://www.kitploit.com/search/label/Windows%2010) - Apparently Legit, non unwoundable call stack whereby the EXE module was completely removed (calling no parameters function getchar) Note: This operation mode is disabled by default. To enable this mode, change the CALLSTACK_TYPE to 1 Desync Stack Mode This mode is the right solution to the above problem, whereby the non-suitable frame is simply replaced by another, suitable one.