admin/mgeeky-ThreadStackSpoofer
1
0
Fork 0
mirror of https://github.com/mgeeky/ThreadStackSpoofer synced 2026-06-06 16:14:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

readme

Browse Source
This commit is contained in:
Mariusz B. / mgeeky
2021-09-29 15:33:22 +02:00
parent 332eaf711c
commit 25153d7944
1 changed files with 2 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+2 -5
View File
@@ -7,12 +7,9 @@ A PoC implementation for an advanced in-memory evasion technique that spoofs Thr
This is an example implementation for _Thread Stack Spoofing_ technique aiming to evade Malware Analysts, AVs and EDRs looking for references to shellcode's frames in an examined thread's call stack.
The idea is to walk back thread's call stack and overwrite return addresses in subsequent function frames thus masquerading allocations containing malware's code.
An implementation may differ, however the idea is roughly similar to what [MDSec's Nighthawk C2](https://www.mdsec.co.uk/nighthawk/) offers for its agents.
Especially demonstrated in this video:
An implementation may differ, however the idea is roughly similar to what commercial C2 frameworks offer for its agents.
[Nighthawk - Thread Stack Spoofing](https://vimeo.com/581861665)
This implementation along with my [ShellcodeFluctuation](https://github.com/mgeeky/ShellcodeFluctuation) brings Offensive Security community sample implementations to catch up on the offering made by commercial C2 products, so that we can do no worse in our Red Team toolings. 💪
Implementation along with my [ShellcodeFluctuation](https://github.com/mgeeky/ShellcodeFluctuation) brings Offensive Security community sample implementations to catch up on the offering made by commercial C2 products, so that we can do no worse in our Red Team toolings. 💪
## How it works?