#REMOVE FROM VSTACK CODE#
#REMOVE FROM VSTACK FREE#

#REMOVE FROM VSTACK FREE#

Process Heap Encryption - take an inspiration from this blog post: Hook Heaps and Live Free - which can let you evade Beacon configuration extractors like BeaconEye.

While developing your advanced shellcode loader, you might also want to implement: This is an yet another technique for advanced in-memory evasion that increases your Teams' chances for not getting caught by Anti-Viruses, EDRs and Malware Analysts taking look at your implants.

#REMOVE FROM VSTACK CODE#

Look at the code and its implementation, understand the concept and re-implement the concept within your own Shellcode Loaders that you utilise to deliver your Red Team engagements. (the above image was borrowed from Eli Bendersky's post named Stack frame layout on x86-64) In order to find them on the stack, we need to firstly collect frame pointers, then dereference them for overwriting:

After Sleep is finished, we restore previously saved original function return addresses and execution is resumed.įunction return addresses are scattered all around the thread's stack memory area, pointed to by RBP/EBP register.

Finally a call to ::SleepEx is made to let the Beacon's sleep while waiting for further communication.

We then overwrite last return address on the stack to 0 which effectively should finish the call stack.

As soon as Beacon attempts to sleep, our MySleep callback gets invoked.

The thread should start from our runShellcode function to avoid having Thread's StartAddress point into somewhere unexpected and anomalous (such as ntdll!RtlUserThreadStart+0x21)

Inject and launch shellcode via VirtualAlloc + memcpy + CreateThread.

Hook kernel32!Sleep pointing back to our callback.

Acquire all the necessary function pointers from dbghelp.dll, call SymInitialize.

Why should we care about carefully faking our call stack when there are processes exhibiting traits that we can simply mimic? How it works? As we can see, its call stack pretty much resembles our own in terms of initial call stack frames. The above screenshot shows a thread of unmodified Total Commander 圆4. However the call stack of the spoofed thread may look rather odd at first, a brief examination of my system shown, that there are other threads not unwinding to the above entry points as well: This is because I realised there is a way simpler approach to terminate thread's call stack processal and hide shellcode's related frames by simply writing 0 to the return address of the first frame we control: 💪 Implementation has changedĬurrent implementation differs heavily to what was originally published. Implementation along with my ShellcodeFluctuation brings Offensive Security community sample implementations to catch up on the offering made by commercial C2 products, so that we can do no worse in our Red Team toolings. The idea is to hide references to the shellcode on thread's call stack thus masquerading allocations containing malware's code. This is an example implementation for Thread Stack Spoofing technique aiming to evade Malware Analysts, AVs and EDRs looking for references to shellcode's frames in an examined thread's call stack. This technique allows to bypass thread-based memory examination rules and better hide shellcodes while in-process memory.

Thread Stack Spoofing / Call Stack Spoofing PoCĪ PoC implementation for an advanced in-memory evasion technique that spoofs Thread Call Stack.

Remove from vstack