Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Specify modules that should not be unhooked #2

Open
wants to merge 2 commits into
base: master
Choose a base branch
from

Conversation

mgeeky
Copy link

@mgeeky mgeeky commented Sep 18, 2021

Hi,

This PR adds functionality to specify modules that should not be unhooked to retain hooks introduced intentionally by our tooling, such as User-Defined Reflective Loader (ref. ElusiveMice ) that wants to patch amsi.dll, wldp.dll in-memory.

Having launched unhook would restore our hooks denying previous intentions. To fix that, this PR adds optional parameters to the unhook command that define modules to be skipped during unhooking.

beacon> help unhook
Synopsis: unhook [[skip-module1] [... [skip-moduleN]]]

Attempt to remove hooks from all DLLs except from modules specified as optional parameters.
Example use:
	beacon> unhook amsi wldp
will not unhook amsi.dll and wldp.dll that might have been intentionally patched by our tooling.

Example run:

beacon> unhook wldp amsi
[*] Running unhook.
    Will skip these modules: wmp.dll, amsi.dll, wldp.dll
[+] host called home, sent: 9475 bytes
[+] received output:
ntdll.dll            <.text>
Unhook is done.

Feel free to ignore changes introduced to make.bat. They include Visual Studio header paths, that possibly we might not want to be included in this repository's base.

Regards,
Mariusz.

…especially useful when hook ETW.dll, WLDP.dll modules ourselves and want to retain our hooks.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
1 participant