KitPloit - PenTest Tools!

Acheron - Indirect Syscalls For AV/EDR Evasion In Go Assembly

Acheron is a library inspired by SysWhisper3/FreshyCalls/RecycledGate, with most of the functionality implemented in Go assembly.

acheron package can be used to add indirect syscall capabilities to your Golang tradecraft, to bypass AV/EDRs that makes use of usermode hooks and instrumentation callbacks to detect anomalous syscalls that don't return to ntdll.dll, when the call transition back from kernel->userland.

Main Features

• No dependencies
• Pure Go and Go assembly implementation
• Custom string encryption/hashing function support to counter static analysis

How it works

The following steps are performed when creating a new syscall proxy instance:

1. Walk the PEB to retrieve the base address of in-memory ntdll.dll
2. Parse the exports directory to retrieve the address of each exported function
3. Calculate the system service number for each Zw* function
4. Enumerate unhooked/clean syscall;ret gadgets in ntdll.dll, to be used as trampolines
5. Creates the proxy instance, which can be used to make indirect (or direct) syscalls

Quickstart

Integrating acheron into your offsec tools is pretty easy. You can install the package with:

go get -u github.com/f1zm0/acheron

Then just need to call acheron.New() to create a syscall proxy instance and use acheron.Syscall() to make an indirect syscall for Nt* APIs.

Minimal example:

package main

import (
    "fmt"
    "unsafe"

    "github.com/f1zm0/acheron"
)

func main() {
    var (
        baseAddr uintptr
        hSelf = uintptr(0xffffffffffffffff)
    )

    // creates Acheron instance, resolves SSNs, collects clean trampolines in ntdll.dlll, etc.
    ach, err := acheron.New()
    if err != nil {
        panic(err)
    }

    // indirect syscall for NtAllocateVirtualMemory
    s1 := ach.HashString("NtAllocateVirtualMemory")
    if retcode, err := ach.Syscall(
        s1,                                     // function name hash
        hSelf,                                  // arg1: _In_     HANDLE ProcessHandle,
        uintptr(unsafe.Pointer(&baseAddr)),     // arg2: _Inout_  PVOID *BaseAddress,
        uintptr(unsafe.Pointer(nil)),           // arg3: _In_     ULONG_PTR ZeroBits,
        0x1000,                                    // arg4: _Inout_  PSIZE_T RegionSize,
        windows.MEM_COMMIT|windows.MEM_RESERVE, // arg5: _In_     ULONG AllocationType,
        windows.PAGE_EXECUTE_READWRITE,         // arg6: _In_     ULONG Protect
    ); err != nil {
        panic(err)
    }
    fmt.Printf(
        "allocated memory with NtAllocateVirtualMemory (status: 0x%x)\n",
        retcode,
    )

    // ...
}

Examples

The following examples are included in the repository:

Other projects that use acheron:

• hades

Contributing

Contributions are welcome! Below are some of the things that it would be nice to have in the future:

• 32-bit support
• Other resolver types (e.g. HalosGate/TartarusGate)
• More examples

If you have any suggestions or ideas, feel free to open an issue or a PR.

References

• Golang UK Conference 2016 - Michael Munday - Dropping Down Go Functions in Assembly
• https://github.com/am0nsec/HellsGate
• https://sektor7.net/#!res/2021/halosgate.md
• https://github.com/trickster0/TartarusGate
• https://github.com/klezVirus/SysWhispers3
• https://github.com/crummie5/FreshyCalls
• https://github.com/boku7/AsmHalosGate
• https://github.com/thefLink/RecycledGate
• https://github.com/C-Sto/BananaPhone
• https://winternl.com/detecting-manual-syscalls-from-user-mode/
• https://www.usenix.org/legacy/events/vee06/full_papers/p154-bhansali.pdf
• https://redops.at/en/blog/direct-syscalls-a-journey-from-high-to-low

Additional Notes

The name is a reference to the Acheron river in Greek mythology, which is the river where souls of the dead are carried to the underworld.

Note
This project uses semantic versioning. Minor and patch releases should not break compatibility with previous versions. Major releases will only be used for major changes that break compatibility with previous versions.

Warning
This project has been created for educational purposes only. Don't use it to on systems you don't own. The developer of this project is not responsible for any damage caused by the improper usage of the library.

License

This project is licensed under the MIT License - see the LICENSE file for details

KitPloit - PenTest Tools!

Hades - Go Shellcode Loader That Combines Multiple Evasion Techniques

Hades is a proof of concept loader that combines several evasion technques with the aim of bypassing the defensive mechanisms commonly used by modern AV/EDRs.

Usage

The easiest way, is probably building the project on Linux using make.

git clone https://github.com/f1zm0/hades && cd hades
make

Then you can bring the executable to a x64 Windows host and run it with .\hades.exe [options].

PS > .\hades.exe -h

  '||'  '||'     |     '||''|.   '||''''|   .|'''.|
   ||    ||     |||     ||   ||   ||  .     ||..  '
   ||''''||    |  ||    ||    ||  ||''|      ''|||.
   ||    ||   .''''|.   ||    ||  ||       .     '||
  .||.  .||. .|.  .||. .||...|'  .||.....| |'....|'

          version: dev [11/01/23] :: @f1zm0

Usage:
  hades -f <filepath> [-t selfthread|remotethread|queueuserapc]

Options:
  -f, --file <str>        shellcode file path (.bin)
  -t, --technique <str>   injection technique [selfthread, remotethread, queueuserapc]

Example:

Inject shellcode that spawms calc.exe with queueuserapc technique:

.\hades.exe -f calc.bin -t queueuserapc

Showcase

User-mode hooking bypass with syscall RVA sorting (NtQueueApcThread hooked with frida-trace and custom handler)

Instrumentation callback bypass with indirect syscalls (injected DLL is from syscall-detect by jackullrich)

Additional Notes

Direct syscall version

In the latest release, direct syscall capabilities have been replaced by indirect syscalls provided by acheron. If for some reason you want to use the previous version of the loader that used direct syscalls, you need to explicitly pass the direct_syscalls tag to the compiler, which will figure out what files needs to be included and excluded from the build.

GOOS=windows GOARCH=amd64 go build -ldflags "-s -w" -tags='direct_syscalls' -o dist/hades_directsys.exe cmd/hades/main.go

Disclaimers

Warning
This project has been created for educational purposes only, to experiment with malware dev in Go, and learn more about the unsafe package and the weird Go Assembly syntax. Don't use it to on systems you don't own. The developer of this project is not responsible for any damage caused by the improper use of this tool.

Credits

Shoutout to the following people that shared their knowledge and code that inspired this tool:

• @smelly__vx and @am0nsec creators of Hell's Gate
• @modexp's excellent blog post Bypassing User-Mode Hooks and syscall invocation in C
• @ElephantSe4l creator of FreshyCalls
• @C_Sto creator of BananaPhone
• @winternl for this blog post on Hooking Nirvana and instrumentation callback to detect suspicious syscalls from user-mode.

License

This project is licensed under the GPLv3 License - see the LICENSE file for details