Powerloader and threadHijack is not working on my machine

[zhangpeter1991]

Dear Author,

I tried Powerloader and threadHijack on my Win10 VM, it seems like they are not working. Is it because of the shellcode? or the offset?

[aaaddress1]

HI zhangpeter:

That PoC code of Powerloader is based on x86 Windows, so there're only 32bit memory layout and shellcode in this PoC. But this vector effects 64bit Windows too. Here's a wonderful project support x86/x64: https://github.com/BreakingMalware/PowerLoaderEx

I found MicroSoft have patched threadHijacking Attack on Win10 just in this month. It should be said: MicroSoft add more check in x64bit Windows before calling the shellcode (just like this photo). But this vulnerability still works well on x86bit. However, it seems like this vulnerability still appears on x64bit, just need to use another way to effect the address called by RtlUserThreadStart, and bypass the check.

I'll try to attack this vulnerability again, and look for a good solution to bypass it. Thanks for your attention ;)