DOCSEARCHbyAlgolia
Submit Docs

EDRSandBlast

repository·master·Indexed 23 days ago

https://github.com/wavestone-cdt/edrsandblast

A security research tool written in C designed to bypass Endpoint Detection and Response (EDR) systems and LSASS protections. It leverages vulnerable signed drivers to perform kernel-mode manipulations—such as removing Kernel Notify Routines, Object Callbacks, and minifilter callbacks—and implements various userland unhooking techniques to evade monitoring.

Tokens
3.9K
Snippets
3
Records
18
Agent score
33%

What's inside EDRSandBlast

  1. Overview of EDRSandBlast

    master

    EDRSandBlast is a C-based tool designed to bypass Endpoint Detection and Response (EDR) systems and LSASS protections. It achieves this by weaponizing vulnerable signed drivers to perform kernel-level manipulations and implementing various userland unhooking techniques to evade monitoring.

    Key capabilities include:

    • Kernel-mode bypasses: Removal of Kernel Notify Routines, Object Callbacks, and minifilter callbacks; deactivation of the Microsoft-Windows-Threat-Intelligence ETW provider.
    • Userland bypasses: Implementation of multiple unhooking techniques to evade userland monitoring.
    • LSASS Protection Bypass: Ability to dump LSASS memory under EDR scrutiny without triggering 'OS Credential Dumping' alerts. This is achieved by combining --usermode and --kernelmode techniques.

  2. How EDRSandBlast bypasses Minifilter callbacks

    master

    EDRs use 'minifilter' drivers to monitor I/O operations (file open, read, write, etc.) via the Windows Filter Manager.

    EDRSandBlast detects filters associated with EDR drivers by browsing internal structures like _FLTP_FRAME, _FLT_VOLUME, _FLT_FILTER, and _FLT_INSTANCE. It identifies callback nodes in _CALLBACK_NODE structures (either via the _FLT_INSTANCE array or _FLT_VOLUME.Callbacks.OperationLists). To bypass monitoring, it unlinks these nodes from their lists, making the EDR temporarily unaware of file operations.

  3. How EDRSandBlast bypasses Kernel Notify Routines

    master

    EDR products use Kernel 'Notify Routines' to monitor system activity like process/thread creation and image loading (exe/DLL). These routines are stored in undocumented kernel-space arrays:

    • PspCreateProcessNotifyRoutine (process creation)
    • PspCreateThreadNotifyRoutine (thread creation)
    • PspLoadImageNotifyRoutine (image loading)

    EDRSandBlast enumerates these arrays and removes callback routines linked to a predefined list of over 1000 supported EDR drivers. This removal is performed using an arbitrary Kernel memory read/write primitive obtained via a vulnerable driver.

  4. Configure user-land unhooking methods

    master

    When using --usermode, you can specify how to remove user-land hooks using --unhook-method <N>:

    • 0: No unhooking (used for direct syscall operations).
    • 1 (Default): Uses NtProtectVirtualMemory in ntdll to remove hooks.
    • 2: Constructs an unmonitored version of NtProtectVirtualMemory using an executable trampoline.
    • 3: Searches for an existing EDR-allocated trampoline to get an unmonitored NtProtectVirtualMemory.
    • 4: Loads an additional version of ntdll into memory and uses its NtProtectVirtualMemory.
    • 5: Allocates shellcode that uses a direct syscall to call NtProtectVirtualMemory.

  5. How EDRSandBlast bypasses ETW Microsoft-Windows-Threat-Intelligence

    master

    The ETW Microsoft-Windows-Threat-Intelligence provider logs malicious API usage (e.g., nt!MiReadWriteVirtualMemory).

    EDRSandBlast disables this provider by patching its ProviderEnableInfo attribute to 0x0 in kernel memory. The tool uses pre-computed offsets for nt!EtwTiLogReadWriteVm and other related structures found in NtoskrnlOffsets.csv.

  6. How EDRSandBlast bypasses Object Callbacks

    master

    EDR products use nt!ObRegisterCallbacks to be notified of handle generation (e.g., OpenProcess, OpenThread, DuplicateHandle). These registrations are stored in a CallbackList double-linked list within the _OBJECT_TYPE structure for Processes, Threads, or Desktops.

    EDRSandBlast implements three techniques to disable these callbacks:

    1. Using the Enabled field of OB_CALLBACK_ENTRY (Default): Browses the CallbackList in PsProcessType and PsThreadType. It identifies EDR-related callbacks by checking if PreOperation or PostOperation functions belong to an EDR driver, then toggles the Enabled flag to FALSE. It performs safety checks on Enabled, Operations, and ObjectType to avoid crashes.
    2. Unlinking the CallbackList: Makes the Flink and Blink pointers of the CallbackList point to the LIST_ENTRY itself, effectively emptying the list. This is more robust against kernel changes but affects all object callbacks, not just EDRs.
    3. Disabling object callbacks altogether: Flips the SupportsObjectCallbacks bit in the TypeInfo field of the _OBJECT_TYPE structure. This is high-risk as it may trigger a 0x109 Bug Check (PatchGuard) if not performed quickly enough.

  7. How EDRSandBlast bypasses Userland Hooking

    master

    EDRs inject DLLs into processes to place 'hooks' at the start of monitored functions (e.g., ntdll.dll syscalls). EDRSandBlast detects these by comparing the in-memory DLL with the version on disk (after applying relocations).

    It provides several bypass techniques:

    • Unhooking: Changes page permissions (e.g., RX -> RWX), overwrites the hook with original bytes from the disk version, and restores permissions. This is the base technique used to showcase others.
    • Custom Trampoline: Recovers original bytes, assembles a jmp instruction to skip the hook, and stores this in new executable memory. This avoids erasing the hook, bypassing integrity checks.
    • EDR's own Trampoline: Searches memory for the trampoline the EDR itself created to execute original instructions after the hook, then calls that directly.
    • Duplicate DLL: Loads a second copy of ntdll.dll from a different location to access unhooked functions.
    • Direct Syscalls: Reimplements syscalls in assembly to bypass ntdll.dll entirely. EDRSandBlast uses this to safely execute NtProtectVirtualMemory to perform unhooking.

  8. Implement support for a new vulnerable driver

    master

    To add support for a new driver to provide the kernel read/write primitive, implement the following three functions in the source code:

    1. ReadMemoryPrimitive_DRIVERNAME(SIZE_T Size, DWORD64 Address, PVOID Buffer): Copies Size bytes from kernel address Address to userland buffer Buffer.
    2. WriteMemoryPrimitive_DRIVERNAME(SIZE_T Size, DWORD64 Address, PVOID Buffer): Copies Size bytes from userland buffer Buffer to kernel address Address.
    3. CloseDriverHandle_DRIVERNAME(): Ensures all handles to the driver are closed.

    Update KernelMemoryPrimitives.h to define the driver selection and map the primitives.

    #define RTCore 0
#define DBUtil 1
// Select the driver to use with the following #define
#define VULN_DRIVER RTCore

#if VULN_DRIVER == RTCore
#define DEFAULT_DRIVER_FILE TEXT("RTCore64.sys")
#define CloseDriverHandle CloseDriverHandle_RTCore
#define ReadMemoryPrimitive ReadMemoryPrimitive_RTCore
#define WriteMemoryPrimitive WriteMemoryPrimitive_RTCore
#elif VULN_DRIVER == DBUtil
#define DEFAULT_DRIVER_FILE TEXT("DBUtil_2_3.sys")
#define CloseDriverHandle CloseDriverHandle_DBUtil
#define ReadMemoryPrimitive ReadMemoryPrimitive_DBUtil
#define WriteMemoryPrimitive WriteMemoryPrimitive_DBUtil
#endif

  9. Prepare vulnerable drivers for BYOVD

    master

    EDRSandblast uses vulnerable drivers to perform kernel memory read/write operations. You must provide a copy of a supported vulnerable driver for kernel operations to work. The driver used is determined at compilation time via #define VULN_DRIVER <driver name> in includes/KernelMemoryPrimitive.h (defaults to gdrv.sys).

    Supported drivers and their SHA256 hashes:

    Supported driverSHA256
    GDRV.sys31f4cfb4c71da44120752721103a16512444c13c2ac2d857a7e6f13cb679b427
    RTCore64.sys01aa278b07b58dc46c84bd0b1b5c8e9ee4e62ea0bf7a695862444af32e87f1fd
    DBUtil_2_3.sys0296e2ce999e67c76352613a718e11516fe1b0efc3ffdb8918fc999dd76a73a5

  10. Use EDRSandblast CLI

    master

    EDRSandblast is a command-line tool used to audit or bypass EDR protections. The basic syntax is:

    EDRSandblast.exe [-h | --help] [-v | --verbose] <action> [options]

    Available Actions:

    • audit: Displays user-land hooks and/or Kernel callbacks without taking action.
    • dump: Dumps a specified process (defaults to LSASS) to a file.
    • cmd: Opens a cmd.exe prompt.
    • credguard: Patches LSASS memory to enable Wdigest cleartext password caching (no kernel actions required).
    • firewall: Adds Windows firewall rules to block network access for EDR processes/services.
    • load_unsigned_driver: Loads an unsigned driver by bypassing Driver Signature Enforcement (DSE). Warning: Experimental; requires KDP to be absent/disabled.
    Usage: EDRSandblast.exe [-h | --help] [-v | --verbose] <audit | dump | cmd | credguard | firewall | load_unsigned_driver>
[--usermode] [--unhook-method <N>] [--direct-syscalls] [--add-dll <dll name or path>]*
[--kernelmode] [--dont-unload-driver] [--no-restore]
    [--nt-offsets <NtoskrnlOffsets.csv>] [--fltmgr-offsets <FltmgrOffsets.csv>] [--wdigest-offsets <WdigestOffsets.csv>] [--ci-offsets <CiOffsets.csv>] [--internet]
    [--vuln-driver <RTCore64.sys>] [--vuln-service <SERVICE_NAME>]
    [--unsigned-driver <evil.sys>] [--unsigned-service <SERVICE_NAME>]
    [--no-kdp]
[-o | --dump-output <DUMP_FILE>]

  11. Extract offsets using ExtractOffsets.py

    master

    The ExtractOffsets.py script is used to download and extract offsets for ntoskrnl or wdigest. It is tested on Windows.

    Installation:

    pip.exe install -m .\requirements.txt

    Usage: ExtractOffsets.py [-h] -i INPUT [-o OUTPUT] [-d] mode

    Arguments:

    • mode: Positional argument. Use ntoskrnl or wdigest.
    • -i, --input <INPUT>: Single file or directory containing ntoskrnl.exe or wdigest.dll to extract offsets from. In download mode, the PE from MS symbols servers is placed here.
    • -o, --output <OUTPUT>: CSV file to write offsets to (defaults to NtoskrnlOffsets.csv or WdigestOffsets.csv).
    • -d, --download: Flag to download the PE from Microsoft servers using versions from winbindex.m417z.com.
    # Installation of Python dependencies
pip.exe install -m .\requirements.txt

# Script usage
ExtractOffsets.py [-h] -i INPUT [-o OUTPUT] [-d] mode

  12. Retrieve kernel offsets manually or automatically

    master

    EDRSandBlast requires exact offsets for ntoskrnl.exe and wdigest.dll to avoid system crashes (BSOD).

    Manual Retrieval

    Use the ExtractOffsets.py Python script. It requires radare2 and r2pipe to download and parse symbols from PDB files. The extracted offsets are stored in CSV files.

    Automatic Retrieval

    Run EDRSandBlast with the --internet flag. The tool will:

    1. Download required .pdb files from the Microsoft Symbol Server.
    2. Extract the required offsets.
    3. Update the existing .csv files.

    Note: Using --internet introduces OpSec risk as .pdb files are downloaded and dropped on disk.