base on Threadless Module Stomping In Rust with some features (In memory of those murdered in the Nova party massacre) # NovaLdr :fleur_de_lis: > NovaLdr is a Threadless Module Stomping written in Rust, designed as a learning project while exploring the world of malware development. It uses advanced techniques like indirect syscalls and string encryption to achieve its functionalities. This project is not intended to be a complete or polished product but rather a journey into the technical aspects of malware, showcasing various techniques and features. # Features Overview :bulb: * **Indirect Sycalls** * **String encryption** * **Shellcode encryption**: simple XOR and converting the Shellcode bytes into MAC address * **Threadless Execution** * Threadless inject: Writes a trampoline into a specified function within a given DLL and redirects it to load another DLL. * JMPThreadHijack: Hijack a thread without calling SetThreadContext. Still needs improvement because I'm lazy and haven't implemented the whole thing well enough to maintain the original functionality of the thread. Just a quick and dirty PoC (Beware of payload execution control. Browsers tend to execute the payload multiple times) * **Module Unlink** * Overwrites the DOS header magic bytes. * Clears the DLL base addresses from the target process. * Eliminates DLL name strings from the target process. * Unlinks a module from the module list * **Spawning Process**: spawning suspended process with **NtCreateUserProcess** and Spoofing the PPID and Setting the process to Block DLL * **Ntdll Unhooking**: Remote and local Ntdll Unhooking using Parun's Fart technique * **No GetModuleHandleA & GetProcAddress**: Custome Function that using NT functions * **Sleep Encrypt**: custom sleep function that encrypts the stack during its sleep duration using a separate thread. * **HWBP**: In process Patchless AMSI + ETW Bypass with HWBP on all threads. # Usage: :hammer_and_wrench: * Generate Shellcode file: `msfvenom -p windows/x64/messagebox TITLE=NovaLdr TEXT='In memory of all those murdered in the Nova party massacre 7.10.2023' ICON=WARNING EXITFUNC=thread -b '\xff\x00\x0b' -f raw -e none -o Nova_MSG.bin` * Encrypt the shellcode file and convert it to MAC address format `python bin2mac.py Nova_MSG.bin > nova_msg.txt` * Copy the content of the output file and paste it to the main.rs file * Compile the program just run the file `compile.bat` # Disclaimer :loudspeaker: NovaLdr is intended for educational and research purposes only. The author is not responsible for any misuse or damage caused by this program. Always seek permission before testing it against any target. # Contributing :chart_with_upwards_trend: As this project is a learning journey, contributions, suggestions, and enhancements are welcome to make NovaLdr a valuable resource for learning malware development in Rust. # Resources & Credit :round_pushpin: - [masking-malicious-memory-artifacts-part-ii-insights-from-moneta](https://www.cyberark.com/resources/threat-research-blog/masking-malicious-memory-artifacts-part-ii-insights-from-moneta) - [masking-malicious-memory-artifacts-part-iii-bypassing-defensive-scanners](https://www.cyberark.com/resources/threat-research-blog/masking-malicious-memory-artifacts-part-iii-bypassing-defensive-scanners) - [alternative-process-injection](https://www.netero1010-securitylab.com/evasion/alternative-process-injection) - [custom_getmodulehandle_getprocaddress](https://blog.atsika.ninja/posts/custom_getmodulehandle_getprocaddress) - [nim-noload-dll-hollowing](https://tishina.in/execution/nim-noload-dll-hollowing) - [Malwear-Sweet](https://github.com/0prrr/Malwear-Sweet) - [dll-unlinking](https://blog.christophetd.fr/dll-unlinking/) - [operating-into-EDRs-blindspot](https://www.naksyn.com/edr%20evasion/2022/09/01/operating-into-EDRs-blindspot.html) - [Hidding Module from the HashTable](http://www.ivanlef0u.tuxfamily.org/?p=365) - [module-pebldr-hiding-all-4-methods](http://www.rohitab.com/discuss/topic/41944-module-pebldr-hiding-all-4-methods/) - [NtCreateUserProcess](https://offensivedefence.co.uk/posts/ntcreateuserprocess/) - [Defcon31](https://github.com/OtterHacker/Conferences/tree/main/Defcon31) - [process-injection-evading-edr-in-2023](https://vanmieghem.io/process-injection-evading-edr-in-2023/) - [StackMask](https://github.com/WKL-Sec/StackMask) - [Patchless Amsi Bypass](https://gist.github.com/CCob/fe3b63d80890fafeca982f76c8a3efdf) - [PatchlessHook](https://github.com/ScriptIdiot/sleepmask_PatchlessHook) - [import_dll_injection](https://www.x86matthew.com/view_post?id=import_dll_injection) :pushpin: (will be added later) # POC  # PE-SIEVE  ", Assign "at most 3 tags" to the expected json: {"id":"3956","tags":[]} "only from the tags list I provide: [{"id":77,"name":"3d"},{"id":89,"name":"agent"},{"id":17,"name":"ai"},{"id":54,"name":"algorithm"},{"id":24,"name":"api"},{"id":44,"name":"authentication"},{"id":3,"name":"aws"},{"id":27,"name":"backend"},{"id":60,"name":"benchmark"},{"id":72,"name":"best-practices"},{"id":39,"name":"bitcoin"},{"id":37,"name":"blockchain"},{"id":1,"name":"blog"},{"id":45,"name":"bundler"},{"id":58,"name":"cache"},{"id":21,"name":"chat"},{"id":49,"name":"cicd"},{"id":4,"name":"cli"},{"id":64,"name":"cloud-native"},{"id":48,"name":"cms"},{"id":61,"name":"compiler"},{"id":68,"name":"containerization"},{"id":92,"name":"crm"},{"id":34,"name":"data"},{"id":47,"name":"database"},{"id":8,"name":"declarative-gui "},{"id":9,"name":"deploy-tool"},{"id":53,"name":"desktop-app"},{"id":6,"name":"dev-exp-lib"},{"id":59,"name":"dev-tool"},{"id":13,"name":"ecommerce"},{"id":26,"name":"editor"},{"id":66,"name":"emulator"},{"id":62,"name":"filesystem"},{"id":80,"name":"finance"},{"id":15,"name":"firmware"},{"id":73,"name":"for-fun"},{"id":2,"name":"framework"},{"id":11,"name":"frontend"},{"id":22,"name":"game"},{"id":81,"name":"game-engine "},{"id":23,"name":"graphql"},{"id":84,"name":"gui"},{"id":91,"name":"http"},{"id":5,"name":"http-client"},{"id":51,"name":"iac"},{"id":30,"name":"ide"},{"id":78,"name":"iot"},{"id":40,"name":"json"},{"id":83,"name":"julian"},{"id":38,"name":"k8s"},{"id":31,"name":"language"},{"id":10,"name":"learning-resource"},{"id":33,"name":"lib"},{"id":41,"name":"linter"},{"id":28,"name":"lms"},{"id":16,"name":"logging"},{"id":76,"name":"low-code"},{"id":90,"name":"message-queue"},{"id":42,"name":"mobile-app"},{"id":18,"name":"monitoring"},{"id":36,"name":"networking"},{"id":7,"name":"node-version"},{"id":55,"name":"nosql"},{"id":57,"name":"observability"},{"id":46,"name":"orm"},{"id":52,"name":"os"},{"id":14,"name":"parser"},{"id":74,"name":"react"},{"id":82,"name":"real-time"},{"id":56,"name":"robot"},{"id":65,"name":"runtime"},{"id":32,"name":"sdk"},{"id":71,"name":"search"},{"id":63,"name":"secrets"},{"id":25,"name":"security"},{"id":85,"name":"server"},{"id":86,"name":"serverless"},{"id":70,"name":"storage"},{"id":75,"name":"system-design"},{"id":79,"name":"terminal"},{"id":29,"name":"testing"},{"id":12,"name":"ui"},{"id":50,"name":"ux"},{"id":88,"name":"video"},{"id":20,"name":"web-app"},{"id":35,"name":"web-server"},{"id":43,"name":"webassembly"},{"id":69,"name":"workflow"},{"id":87,"name":"yaml"}]" returns me the "expected json"