frkngksl/NimicStack
GitHub: frkngksl/NimicStack
NimicStack 是调用堆栈欺骗技术的纯 Nim 实现，通过伪造合法程序的调用栈来规避 EDR 检测。
Stars: 95 | Forks: 4
# NimicStack
NimicStack 是调用堆栈欺骗（Call Stack Spoofing）技术的纯 Nim 实现，旨在模拟合法程序。整个项目基于 [WithSecure Labs 分享的 PoC](https://labs.withsecure.com/blog/spoofing-call-stacks-to-confuse-edrs/)
# 编译
你可以使用以下命令直接编译源代码：
`nim c -d=mingw --app=console --cpu=amd64 -o:NimicStack.exe .\Main.nim`
如果遇到“cannot open file”错误，你还应该安装所需的依赖项：
`nimble install ptr_math winim`
# 用法
与参考项目一样，在打开 LSASS 进程时，NimicStack 可以模拟三种示例调用堆栈：WMI、RPC 和 Svchost。
`.\NimicStack.exe <--wmi, --rpc, --svchost>`
模拟 WMI 调用堆栈的示例输出：
```
PS C:\Users\test\Desktop\NimicStack> .\NimicStack.exe --wmi
███╗ ██╗██╗███╗ ███╗██╗ ██████╗███████╗████████╗ █████╗ ██████╗██╗ ██╗
████╗ ██║██║████╗ ████║██║██╔════╝██╔════╝╚══██╔══╝██╔══██╗██╔════╝██║ ██╔╝
██╔██╗ ██║██║██╔████╔██║██║██║ ███████╗ ██║ ███████║██║ █████╔╝
██║╚██╗██║██║██║╚██╔╝██║██║██║ ╚════██║ ██║ ██╔══██║██║ ██╔═██╗
██║ ╚████║██║██║ ╚═╝ ██║██║╚██████╗███████║ ██║ ██║ ██║╚██████╗██║ ██╗
╚═╝ ╚═══╝╚═╝╚═╝ ╚═╝╚═╝ ╚═════╝╚══════╝ ╚═╝ ╚═╝ ╚═╝ ╚═════╝╚═╝ ╚═╝
@R0h1rr1m
[+] wmi frame is selected!
[+] Required libraries were imported for return address calculation!
[+] SeDebugPrivilege is enabled!
[+] Fake Call Stack was created!
[+] Trying to find LSASS pid...
[+] LSASS pid found!: 756
[+] Registers were set for NtOpenProcess call!
[+] VEH callback was set for the suspended thread!
[+] Thread is resuming...
[+] VEH callback was called!
[+] Redirecting thread to RtlExitUserThread...
[+] Spoof is successful! Handle is 356
[+] You can check the spoofed call stack from Sysmon!
```
以及此调用的 Sysmon 输出：
# 参考
- https://labs.withsecure.com/blog/spoofing-call-stacks-to-confuse-edrs/
- https://github.com/countercept/CallStackSpoofer
# 免责声明
仅用于授权的安全测试。在未经明确许可的情况下针对系统滥用此工具是非法的。
# 参考
- https://labs.withsecure.com/blog/spoofing-call-stacks-to-confuse-edrs/
- https://github.com/countercept/CallStackSpoofer
# 免责声明
仅用于授权的安全测试。在未经明确许可的情况下针对系统滥用此工具是非法的。标签：Gophish, Nim语言, PE 加载器, 免杀技术, 暴力破解检测, 端点可见性, 调用栈伪造