Malware Development
  • Golang Malware Development
  • Malware Development In Golang - Introduction
    • Golang Programming Intro
      • 1. Preparing the Go Environment
      • 2. Hello World
      • 3. Calling MessageBox winAPI from GO
      • 4. Shellcode Runner
  • Code Injection Techniques
    • Shellcode Injection
      • 1. Classic Shellcode Injection
      • 2. Process Hollowing
      • 3. QueueUserAPC
    • DLL Injection
      • 1. Dll Injection
      • 2. Reflective DLL Injection
  • Payloads
    • Payloads
      • 1. Basic DLL using Golang
      • 2. Malicious DLL using Golang
      • 3. Malicious XLL using Golang
    • Shellcode development
      • 1. Keystone Engine
      • 2. Windows x64 Shellcode Development intro
      • 3. Transforming DLLs into Shellcode
  • Evasion
    • AV Bypass
      • 1. Introduction
      • 2. Remove the shellcode from the payload
      • 3. Delay Execution
        • 1. time.Sleep() 1/2
        • 2. time.Sleep() 2/2
        • 3. Custom Sleep function
      • 4. XOR Encryption
      • 5. AMSI Bypass
    • EDR Bypass
      • 1. Setting up a testing environment
      • 2. Userland Hooks
        • 1. What are userland hooks?
        • 2. Load a fresh copy of the dll from disk
        • 3. Programmatically detect ntdll hooks
        • 4. Direct and Indirect Syscalls (shellcode runner)
      • 3. VPN abuse for Endpoint Protection Evasion
        • 1. Global Protect Abuse 1/2
        • 2. Global Protect Abuse 2/2
Powered by GitBook
On this page
  • Malicious implementation
  • EDR Implementation

Was this helpful?

  1. Evasion
  2. EDR Bypass
  3. 2. Userland Hooks

1. What are userland hooks?

#EDREvasion #UserlandHooks

Last updated 1 year ago

Was this helpful?

Userland hooks are a technique used to intercept and modify the execution of a function in user mode. This can be used for a variety of purposes, such as monitoring and debugging applications, or injecting malicious code into a running process.

Malicious attackers use this technique to inject malicious code and legitimate software use hooking for debugging and monitoring.

Malicious implementation

is a dll that can be injected in the mstsc.exe (RPD client) process to identify the target host, username and password. It achieves that by hooking 3 functions:

To hook these functions the developed by Microsoft is used. It uses a technique called Inline Hooking. Inline Hooking involves inserting code into the application's code at the entry point of the function that you want to hook. This code will then call your hook function in order to extract the host, username and password before continuing with the execution of the original function.

The user logging to the remote system will have no way of knowing that this action took place unless it's picked up by an AV solution installed on the endpoint.

The extracted information are then written to disk.

EDR Implementation

EDR solutions use the same techniques to determine if a function is used for a malicious purpose. The same pattern is following:

  • Inject an EDRVendor.dll in the newly created process

  • Install inline hooks on frequently abused functions.

  • Determine if the function is abused for malicious purpose, and if not continue execution of the original function

Let's see how an unhooked function from ntdll looks like in memory.

function without hooks
0:015> u ntdll!NtAdjustPrivilegesToken
ntdll!NtAdjustPrivilegesToken:
00007ffa`a898f560 4c8bd1          mov     r10,rcx
00007ffa`a898f563 b841000000      mov     eax,41h
00007ffa`a898f568 f604250803fe7f01 test    byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1
00007ffa`a898f570 7503            jne     ntdll!NtAdjustPrivilegesToken+0x15 (00007ffa`a898f575)
00007ffa`a898f572 0f05            syscall
00007ffa`a898f574 c3              ret
00007ffa`a898f575 cd2e            int     2Eh
00007ffa`a898f577 c3              ret

Without going into too much detail this is how an unhooked function looks like in a debugger.

Let's see how the exact same function looks like on a host with an EDR installed.

Hooked function
0:007> u ntdll!NtAdjustPrivilegesToken
ntdll!NtAdjustPrivilegesToken:
00007ff9`b062f460 e9932957bd      jmp     00007ff9`6dba1df8
00007ff9`b062f465 cc              int     3
00007ff9`b062f466 cc              int     3
00007ff9`b062f467 cc              int     3
00007ff9`b062f468 f604250803fe7f01 test    byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1
00007ff9`b062f470 7503            jne     ntdll!NtAdjustPrivilegesToken+0x15 (00007ff9`b062f475)
00007ff9`b062f472 0f05            syscall
00007ff9`b062f474 c3              ret

We can see that on the hooked function on line 3 there is a jmp instruction to an address. This essentially is how a hook looks like. The destination address will do some processing on behalf of the EDR to identify if there is any malicious intend.

In the upcoming blogs we will explore how we can bypass these hooks.

RdpThief
CredIsMarshaledCredentialW
CryptProtectMemory
SspiPrepareForCredRead
detours package