CVE-2022-0847

CVE-2022-0847 Dirty Pipe Linux Kernel Privilege Escalation Analysis toc This article was first published on Huawei Security's official account, this is the blog version more complete First published link: https://mp.weixin.qq.com/s/6VhWBOzJ7uu80nzFxe5jpg Vulnerability Introduction Vulnerability I...

HellHall

HellsHall - Another Way To Fetch Clean Syscalls HellsHall is a combination of HellsGate and indirect syscalls. How it works First, HellsHall checks whether the syscall address is hooked and tries to retrieve the syscall number by checking the presence of the following bytes: 0x4C, 0x8B, 0xD1, 0xB...

TinyProcessor

TinyProcessor This project replaces syscall numbers & arguments in Tinytracer's .tag output w/ their actual Nt function declarations for better readability. Do note that some functions declarations are not included, so some arguments will not be processed The function declarations I use in this...

UnhookingPatch

UnhookingPatch Bypass EDR Hooks by patching NT API stub, and resolving SSNs and syscall instructions at runtime image How do i convert binary to MAC ? Requirements: 1. macaddress pip install macaddress ./bin2mac.py calc.bin...

D1rkLdr

D1rkLdr Shellcode Loader with Indirect Dynamic syscall Implementation , shellcode in MAC format, API resolving from PEB, Syscall calll and syscall instruction address resolving at run time...

Hunt-Weird-Syscalls

Hunt-Weird-Syscalls This is a ETW based POC to monitor for abnormal syscalls. For now, the syscalls NtOpenThread and NtSetContextThread are monitored to identify IOCs indicating both direct and indirect syscalls. Description This project uses ETW, more precisely kernel based ETW providers, to...

CVE-2022-0185

CVE-2022-0185 Linux Kernel Privilege Escalation Escape toc Vulnerability Overview Vulnerability ID: CVE-2022-0185 CVSS Score: Affected Product: linux kernel - fsconfig syscall Affected Versions: linux kernel 5.1-rc1 5.16.2 Exploitation Requirements: Linux local; requires CAPSYSADMIN capability ca...

SysWhispers2

SysWhispers2 SysWhispers helps with evasion by generating header/ASM files implants can use to make direct system calls. All core syscalls are supported and example generated files available in the example-output/ folder. Difference Between SysWhispers 1 and 2 The usage is almost identical to...

EDRs

EDRs This repo contains information about EDRs that can be useful during red team exercise. patchsyscalldynamically64.c This proof-of-concept is resolving the syscall ID dynamically no need to check the version running on the remote host. To get the information on disk not tampered a call to...

seccomp-tools

Seccomp Tools Powerful tools for seccomp analysis. This project is aimed primarily but not exclusively at analyzing seccomp sandboxes in CTF pwn challenges. Some features are CTF-specific, but they're just as useful for analyzing real-world seccomp filters. Features Dump - Automatically dumps...

strace

strace - the linux syscall tracer This is strace -- a diagnostic, debugging and instructional userspace utility with a traditional command-line interface for Linux. It is used to monitor and tamper with interactions between processes and the Linux kernel, which include system calls, signal...

hades

About Hades is a proof of concept loader that combines several evasion technques with the aim of bypassing the defensive mechanisms commonly used by modern AV/EDRs. Usage The easiest way, is probably building the project on Linux using make. git clone https://github.com/f1zm0/hades && cd hades ma...

RedTeamCCode

RedTeamCCode Red Team C code repo Want to know what is the syscall ID been used by your system getsyscall.exe ntdll.dll NtProtectVirtualMemory ntdll.dll!NtProtectVirtualMemory at 0x00007FFDE568D010 NtProtectVirtualMemory syscall ID 0x00000050 80 CrowdStrike hooked ntdll.dll APIs...

ShellCodeEmulator

Windows shellcode emulation tool based upon unicorn framework. ShellcodeEmulator emulates Windows shellcode with the help of windbg process memory dumps. You can provide shellcode to analyze with any Windows process dump image. The tool will emulate as much as of the userland code using the...

Chrome-App-Bound-Encryption-Decryption

ChromElevator Chrome App-Bound Encryption Decryption 🚀 Overview A post-exploitation tool demonstrating a complete, in-memory bypass of Chromium's App-Bound Encryption ABE. This project utilizes Direct Syscall-based Reflective Process Hollowing to launch a legitimate browser process in a suspended...

goBox

goBox GO sandbox to run untrusted code. goBox uses Ptrace to hook into READ syscalls, giving you the option to accept or deny syscalls before they are executed. Usage Usage of ./gobox: gobox FLAGS command flags: -h Print Usage. -n value A glob pattern for automatically blocking file reads. -y val...

ksentinel

ksentinel - Kernel Syscalls Integrity Monitor Overview ksentinel monitors critical kernel functions and the syscall table for unauthorized modifications. It detects common syscalls that are targeted by most rootkits including ftrace hooks, kprobes, and syscall table hijacking. Features Function...

acheron

About Acheron is a library inspired by SysWhisper3/FreshyCalls/RecycledGate, with most of the functionality implemented in Go assembly. acheron package can be used to add indirect syscall capabilities to your Golang tradecraft, to bypass AV/EDRs that makes use of usermode hooks and instrumentatio...

project-rvbbit

Project RVBBIT: Linux Kernel Rootkit Proof-of-Concept 📖 Overview Project RVBBIT is an educational proof-of-concept demonstrating advanced stealth techniques used by Linux kernel rootkits. It is intended exclusively for cybersecurity research, defensive training, and understanding how modern...

exrop

Exrop Automatic ROP chain generator for x86-64 binaries, powered by Triton symbolic execution. Features Set registers to constants or other registers rdi=0x41414141, rdi=rax Write to memory constant and register-based addresses/values Write strings/bytes to memory Function calls with mixed...