VULN REPORT
/
shellcode
/
ID: 260
Windows/x64 NtCreateThreadEx - Stealthy Thread Injection (EDR Bypass)
Summary
This entry details a vulnerability found in the target system. The exploit was published on 2026-07-21 and has garnered 1 views from the community. It is classified under the shellcode category. Users are advised to review the source code in the Detail tab for technical specifics.
exploit_260.txt
Modern Evasion - Windows x64 - NtCreateThreadEx
Windows/x64 NtCreateThreadEx - CreateRemoteThread'e Gelismis Alternatif
CreateRemoteThread yuksek profilli Win32 API olup cog EDR hooklayarak tespit eder. NtCreateThreadEx undocumented NTAPI fonksiyonudur ve bazi hook mekanizmalarini atlatir.
NtCreateThreadEx Prototype
typedef NTSTATUS (NTAPI *pNtCreateThreadEx)(
OUT PHANDLE ThreadHandle,
IN ACCESS_MASK DesiredAccess,
IN LPVOID ObjectAttributes,
IN HANDLE ProcessHandle,
IN LPVOID StartAddress,
IN LPVOID Parameter,
IN ULONG Flags,
IN SIZE_T StackZeroBits,
IN SIZE_T SizeOfStackCommit,
IN SIZE_T SizeOfStackReserve,
OUT LPVOID BytesBuffer
);
// Kullanim:
HMODULE ntdll = GetModuleHandleA("ntdll.dll");
pNtCreateThreadEx NtCTE = (pNtCreateThreadEx)
GetProcAddress(ntdll, "NtCreateThreadEx");
Direkt Syscall Yontemi
EDR'ler genellikle ntdll.dll fonksiyonlarini hooklar.
Syscall numarasini ntdll PE'sinden okuyup manuel
syscall ile bu hooklar devre disi kalir.
Araclar:
- Hell's Gate (jthuraisamy)
- Halo's Gate (byt3bl33d3r)
- SysWhispers2/3
- RecycledGate
Entry Stats
Views
1
Downloads
0
Comments
0