HellsGatePPID
HellsGatePPID copied to clipboard
boku7
Assembly HellGate implementation that directly calls Windows System Calls and displays the PPID of the explorer.exe process
trafficstars
Custom HellsGate Implementation
Assembly HellGate implementation that directly calls Windows System Calls and displays the PPID of the explorer.exe process.
- In this screenshot the "NtQuerySystemInformation" & "NtAllocateVirtualMemory" NTDLL.DLL API's are called by direct windows system calls.
- The systemcalls are dynamically discovered at runtime using the HellsGate method.
- Going to build on this and use a custom halos gate method to handle/evade EDR userland hooks.
To Do List
- Obfuscate the strings for that are used for resolving the addresses of the NTDLL symbols
- Or use hashing
- ~Need to fix some bugs when switching from debug to release mode in visual studio's~ (Fixed 05/08/21)
- ~Need to figure out how to properly overload the call to HellDescent()~ (Fixed 05/08/21)
- Clean up the assembly functions, they are messy and could be better (Some cleanup 05/08/21)
- ~Do better checking for the process image name so it doesnt conflict with other processes named explorer~ (Fixed 05/08/21)
- Better error handling (Some better handling 05/08/21)
- ~Make this into a cobalt strike beacon object file~ ( Complete! 06/08/21)
- See HalosGate Processlist Cobalt Strike BOF project! ;)
- Build on this project for process injection / syscall PS
- ~Use halos gate to handle EDR hooks.~ (05/08/21)
- See the updated HalosGate version of this project at: https://github.com/boku7/AsmHalosGate
Credits / References
- Pavel Yosifovich (@zodiacon)
- I learned how to correctly call NtQuerySystemInformation from Pavel's class on pentester academy. Full credits to Pavel for this. (BTW Pavel is an awesome teacher and I 100% recommend).
- Windows Process Injection for Red-Blue Teams - Module 2: NTQuerySystemInformation
- Reenz0h from @SEKTOR7net
- Most of the C techniques I use are from Reenz0h's awesome courses and blogs
- Best classes for malware development out there.
- Creator of the halos gate technique. His work was the motivation for this work.
- https://blog.sektor7.net/#!res/2021/halosgate.md
- https://institute.sektor7.net/
- @smelly__vx & @am0nsec ( Creators/Publishers of the Hells Gate technique )
- Could not have made my implementation of HellsGate without them :)
- Awesome work on this method, really enjoyed working through it myself. Thank you!
- https://github.com/am0nsec/HellsGate
- Link to the Hell's Gate paper: https://vxug.fakedoma.in/papers/VXUG/Exclusive/HellsGate.pdf
boku7