mirror of
https://github.com/matthieu-hackwitharts/Win32_Offensive_Cheatsheet
synced 2026-06-08 15:46:38 +00:00
Merge pull request #1 from Artur2/add-another-hells-gate-example
Add another example below obsolete of Hells Gate
This commit is contained in:
@@ -508,6 +508,8 @@ Code sample : // to add
|
||||
|
||||
To avoid using hardcoded syscalls, Hell's Gate (Hells Gates ?) retrieve them dynamically by parsing EAT (compare memory bytes to syscall opcodes). The original Poc has been made by the great VX-Underground team, and can be found here : https://papers.vx-underground.org/papers/Windows/Evasion%20-%20Systems%20Call%20and%20Memory%20Evasion/Dynamically%20Retrieving%20SYSCALLs%20-%20Hells%20Gate.7z
|
||||
|
||||
Another one example : https://github.com/am0nsec/HellsGate
|
||||
|
||||
## Heavens Gate
|
||||
|
||||
Use Wow64 to inject 64 bits payload in 32 bits loader. Can be useful to bypass some AV/EDRs because Wow64 will avoid you to be catch in userland.
|
||||
|
||||
Reference in New Issue
Block a user