itaymigdal / partyloader

Threadless shellcode injection tool

About

Project is still WIP

Currently only Pool Party injection variant 7 is implemented. I plan to add more features like stomping, and some more threadless injection techniques like ThreadlessInject, EPI, and DllNotificationInjection.

Installation

Built with Nim 1.6.12.

nimble install winim nimprotect supersnappy argparse

Usage

Use only for 64 bit

Usage:
   [options] shellcode_file

Arguments:
  shellcode_file   Raw shellcode file to load

Options:
  -h, --help
  -n, --process-name=PROCESS_NAME
                             Process name to inject (default: explorer.exe)
  -w, --wait-for-process     Wait for the target process to start (default: exit if target process isn't found)
  -f, --format=FORMAT        Loader format Possible values: [exe, dll] (default: exe)
  -e, --export=EXPORT        DLL export name (relevant only for Dll format) (default: DllRegisterServer)
  -p, --split                Split and hide the payload blob in loader (takes long to compile!)
  -t, --sleep=SLEEP          Number of seconds to sleep before injection (default: 0)
  -g, --anti-debug=ANTI_DEBUG
                             Action to perform upon debugger detection Possible values: [none, die, troll] (default: none)
  -k, --key=KEY              RC4 key to [en/de]crypt the payload (supplied as a command line argument to the loader) (default: )
  -v, --veh                  Injection will occur within VEH

Credits

1. My friend and Ex-coworker _0xDeku for the great Pool Party research

partyloader's Issues

Feature request nimless nim

Love the tool and I am a big fan of using the thread pool injection method. I do however see that the common theme of using NIM it's being detected by AV at the nim runtime. A really good talk about this was done at BSIDESKC and would be cool to implement this as it does circumvent the severity and in some cases all AV detection. I firmly believe all the other functions you have will prove to be evasive against top tier EDRs.

https://www.youtube.com/watch?v=EXX3HmCG3pw

https://github.com/m4ul3r/writing_nimless