Question

[KRAFMA]

Hello why you not implemented the :
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
on the TransactedHollowing ?

Cause the actual parent id work but i know a better , is cause Ntcreateprocess ? need createprocess ?

[daem0nc0re]

My PE Injection PoCs use NtCreateProcessEx which allows PPID for 4th parameter, ao InitializeProcThreadAttributeList API and UpdateProcThreadAttribute API are not required.

TangledWinExec/TransactedHollowing/TransactedHollowing/Interop/NativeMethods.cs

Line 116 in 1298c5b

public static extern NTSTATUS NtCreateProcessEx(

Additionally, I do so because I want to use only Nt APIs for PoC whenever possible.

[KRAFMA]

Yes but is for implement block dll : BLOCK_NON_MICROSOFT_BINARIES_ALWAYS_ON

[daem0nc0re]

Thanks for sharing your opinion.
Essentially, the purpose of this repository is not to provide attack tools, but to provide PoCs for research or investigation about process execution techniques.
If the current implementation is inconvenient to investigate the technique, please give me specific examples so I can consider changing it.

[KRAFMA]

i try some solution for Ntcreate and check the integrity process before spoof the ppid for have more target , i update you later
btw
Any your poc can load .net file ? or only for native file ?

[daem0nc0re]

Thanks for your support.

Any your poc can load .net file ? or only for native file ?

I have not tried with .NET file yet.
I've been busy lately and won't have time for a while, sorry.

[KRAFMA]

.net seem not work but i'm sure can fix
btw : https://twitter.com/_RastaMouse/status/1524761507782873088
https://offensivedefence.co.uk/posts/ntcreateuserprocess/ is c++
and atm i use this and his amazing : https://i.gyazo.com/32d08b93537801c64b256693ff16ee81.png

[daem0nc0re]

Thanks for sharing!
I will try to address this issue next week or the week after.

[KRAFMA]

I like your poc so i want try improve a bit :)
Good luck

[daem0nc0re]

I'm happy to hear that!
I will try as soon as possible 💪

[daem0nc0re]

I started from .NET binary issue and added .NET binary support to PE file parser of TransactedHollowing PoC.
But NtCreateProcessEx and NtMapViewOfSection returns NTSTATUS 0x4000000E : {Machine Type Mismatch} for .NET binary.
Do you have any idea?

[KRAFMA]

<3 love you going test

[KRAFMA]

I started from .NET binary issue and added .NET binary support to PE file parser of TransactedHollowing PoC. But NtCreateProcessEx and NtMapViewOfSection returns NTSTATUS 0x4000000E : {Machine Type Mismatch} for .NET binary. Do you have any idea?

Not very but i can investigate

[daem0nc0re]

OK.
I will continue to investigate the .NET issue, but will work on the PPID first.

[daem0nc0re]

Added the feature you requested to my TransactedHollowing PoC.
Check this commit.

[KRAFMA]

Added the feature you requested to my TransactedHollowing PoC. Check this commit.

Love your work !!! good job
i have tested some solutions for try add net support but nothings new from my part