Welcome to our

Cyber Security News Aggregator

.

Cyber Tzar

provide a

cyber security risk management

platform; including automated penetration tests and risk assesments culminating in a "cyber risk score" out of 1,000, just like a credit score.

Acheron - Indirect Syscalls For AV/EDR Evasion In Go Assembly

published on 2023-05-23 12:30:00 UTC by Unknown
Content:


Acheron is a library inspired by SysWhisper3/FreshyCalls/RecycledGate, with most of the functionality implemented in Go assembly.

acheron package can be used to add indirect syscall capabilities to your Golang tradecraft, to bypass AV/EDRs that makes use of usermode hooks and instrumentation callbacks to detect anomalous syscalls that don't return to ntdll.dll, when the call transition back from kernel->userland.


Main Features

  • No dependencies
  • Pure Go and Go assembly implementation
  • Custom string encryption/hashing function support to counter static analysis

How it works

The following steps are performed when creating a new syscall proxy instance:

  1. Walk the PEB to retrieve the base address of in-memory ntdll.dll
  2. Parse the exports directory to retrieve the address of each exported function
  3. Calculate the system service number for each Zw* function
  4. Enumerate unhooked/clean syscall;ret gadgets in ntdll.dll, to be used as trampolines
  5. Creates the proxy instance, which can be used to make indirect (or direct) syscalls

Quickstart

Integrating acheron into your offsec tools is pretty easy. You can install the package with:

go get -u github.com/f1zm0/acheron

Then just need to call acheron.New() to create a syscall proxy instance and use acheron.Syscall() to make an indirect syscall for Nt* APIs.

Minimal example:

package main

import (
"fmt"
"unsafe"

"github.com/f1zm0/acheron"
)

func main() {
var (
baseAddr uintptr
hSelf = uintptr(0xffffffffffffffff)
)

// creates Acheron instance, resolves SSNs, collects clean trampolines in ntdll.dlll, etc.
ach, err := acheron.New()
if err != nil {
panic(err)
}

// indirect syscall for NtAllocateVirtualMemory
s1 := ach.HashString("NtAllocateVirtualMemory")
if retcode, err := ach.Syscall(
s1, // function name hash
hSelf, // arg1: _In_ HANDLE ProcessHandle,
uintptr(unsafe.Pointer(&baseAddr)), // arg2: _Inout_ PVOID *BaseAddress,
uintptr(unsafe.Pointer(nil)), // arg3: _In_ ULONG_PTR ZeroBits,
0x1000, // arg4: _Inout_ PSIZE_T RegionSize,
windows.MEM_COMMIT|windows.MEM_RESERVE, // arg5: _In_ ULONG AllocationType,
windows.PAGE_EXECUTE_READWRITE, // arg6: _In_ ULONG Protect
); err != nil {
panic(err)
}
fmt.Printf(
"allocated memory with NtAllocateVirtualMemory (status: 0x%x)\n",
retcode,
)

// ...
}

Examples

The following examples are included in the repository:

Example Description
sc_inject Extremely simple process injection PoC, with support for both direct and indirect syscalls
process_snapshot Using indirect syscalls to take process snapshots with syscalls
custom_hashfunc Example of custom encoding/hashing function that can be used with acheron

Other projects that use acheron:

Contributing

Contributions are welcome! Below are some of the things that it would be nice to have in the future:

  • 32-bit support
  • Other resolver types (e.g. HalosGate/TartarusGate)
  • More examples

If you have any suggestions or ideas, feel free to open an issue or a PR.

References

Additional Notes

The name is a reference to the Acheron river in Greek mythology, which is the river where souls of the dead are carried to the underworld.

Note
This project uses semantic versioning. Minor and patch releases should not break compatibility with previous versions. Major releases will only be used for major changes that break compatibility with previous versions.

Warning
This project has been created for educational purposes only. Don't use it to on systems you don't own. The developer of this project is not responsible for any damage caused by the improper usage of the library.

License

This project is licensed under the MIT License - see the LICENSE file for details



Article: Acheron - Indirect Syscalls For AV/EDR Evasion In Go Assembly - published over 1 year ago.

https://www.kitploit.com/2023/05/acheron-indirect-syscalls-for-avedr.html   
Published: 2023 05 23 12:30:00
Received: 2023 05 25 13:45:05
Feed: PenTest and Hacking Tools - powered by FeedBurner
Source: PenTest and Hacking Tools - powered by FeedBurner
Category: News
Topic: Security Tooling
Views: 0

Custom HTML Block

Click to Open Code Editor