admin/hasherezade-process_ghosting

mirror of https://github.com/hasherezade/process_ghosting synced 2026-06-08 14:35:33 +00:00

T

hasherezade 1b2c607902 [BUGFIX] Fixed printing info

2024-03-11 11:22:59 -07:00

[NOBIN] Added image

2021-06-18 14:04:13 +02:00

.appveyor.yml

Update .appveyor.yml

2022-01-25 20:47:46 +01:00

CMakeLists.txt

[NOBIN] CMake version 3.0

2022-01-25 20:52:49 +01:00

LICENSE

Added MIT license (Issue #10 )

2022-04-05 14:19:59 +02:00

main.cpp

[BUGFIX] Fixed printing info

2024-03-11 11:22:59 -07:00

ntddk.h

[REFACT] Updated ntddk

2021-08-31 05:03:14 +02:00

ntdll_types.h

[INIT] First working version

2021-06-16 03:00:19 +02:00

ntdll_undoc.cpp

[INIT] First working version

2021-06-16 03:00:19 +02:00

ntdll_undoc.h

[FEATURE] Added NtCurrentPeb to ntdll_undoc

2021-09-03 11:15:29 +02:00

pe_hdrs_helper.cpp

[INIT] First working version

2021-06-16 03:00:19 +02:00

pe_hdrs_helper.h

[INIT] First working version

2021-06-16 03:00:19 +02:00

process_env.cpp

[FEATURE] Pass desktop info from current process

2021-09-03 11:24:23 +02:00

process_env.h

[INIT] First working version

2021-06-16 03:00:19 +02:00

README.md

Update README.md

2021-06-18 14:07:14 +02:00

util.cpp

[INIT] First working version

2021-06-16 03:00:19 +02:00

util.h

[INIT] First working version

2021-06-16 03:00:19 +02:00

README.md

Process Ghosting

This is my implementation of the technique presented by Gabriel Landau:
https://www.elastic.co/blog/process-ghosting-a-new-executable-image-tampering-attack

Characteristics:

Memory artifacts as in Process Doppelgänging
Payload mapped as MEM_IMAGE (unnamed: not linked to any file)
Sections mapped with original access rights (no RWX)
Payload connected to PEB as the main module
Remote injection supported (but only into a newly created process)
Process is created from an unnamed module (GetProcessImageFileName returns empty string)

WARNING:
The 32bit version works on 32bit system only.