# Hades | Go Shellcode Loader That Combines Multiple Evasion Techniques **URL:** \ **Category:** Tools & Scripts\ **Tags:** tools, hacking\ **Created:** [May 24, 2023, 9:35pm UTC](https://onehack.st/t/hades-go-shellcode-loader-that-combines-multiple-evasion-techniques/241557 "2023-05-24T21:35:23Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![PlayBoy83](https://onehack.st/user_avatar/onehack.st/playboy83/32/164314_2.png) [@PlayBoy83](https://onehack.st/u/PlayBoy83)\ **Post date:** [May 24, 2023, 9:35pm UTC](https://onehack.st/t/hades-go-shellcode-loader-that-combines-multiple-evasion-techniques/241557/1 "2023-05-24T21:35:23Z")
![image](https://onehack.st/uploads/default/original/3X/5/f/5fd71e969614125801d7850dd644ec8add89ebfa.jpeg) [![Made with Go](https://camo.githubusercontent.com/a34846bddeef089911611b2b4fbe23cd0510625cb0e1e559056f0acd130a6078/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f4d61646525323077697468253230476f2d3030414444383f6c6f676f3d476f266c6f676f436f6c6f723d7768697465) ](https://github.com/f1zm0/hades/releases)[![Go Reference](https://camo.githubusercontent.com/de18551491152ca3375365ff37ecf93e98699d1af25f08ede29df9850db4fdc3/68747470733a2f2f706b672e676f2e6465762f62616467652f6769746875622e636f6d2f66317a6d302f68616465732e737667)](https://pkg.go.dev/github.com/f1zm0/hades) [![project license](https://camo.githubusercontent.com/7a68129a4a2b163157f3e638963641a3b22f0e975088aa3f67b89d8d170736dd/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c6963656e73652f66317a6d302f68616465733f636f6c6f723d303037643963266c6f676f3d626f6f6b737461636b266c6f676f436f6c6f723d7768697465266c6162656c436f6c6f723d326232633333) ](https://github.com/f1zm0/hades)[![project status](https://camo.githubusercontent.com/444b8c4d18d5be7f17db8bb88dd158af3b3509b872d7e369d1a6c1d5072af6a2/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f5374617475732d506f432d3030376439633f6c6162656c436f6c6f723d326232633333266c6f676f3d6375726c) ](https://github.com/f1zm0/hades#)[![Twitter Follow](https://camo.githubusercontent.com/aeeffbc7d3b334e5875fe374e4551cf6363dff899d9877756f49cde51922a55f/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f547769747465722d3030616365653f6c6f676f3d74776974746572266c6f676f436f6c6f723d7768697465)](https://twitter.com/f1zm0) ## About **Hades** is a proof of concept loader that combines several evasion technques with the aim of bypassing the defensive mechanisms commonly used by modern AV/EDRs. ## Usage The easiest way, is probably building the project on Linux using `make`. git clone [https://github.com/f1zm0/hades](https://github.com/f1zm0/hades) && cd hades make Then you can bring the executable to a x64 Windows host and run it with `.\hades.exe [options]`. ```auto PS > .\hades.exe -h '||' '||' | '||''|. '||''''| .|'''.| || || ||| || || || . ||.. ' ||''''|| | || || || ||''| ''|||. || || .''''|. || || || . '|| .||. .||. .|. .||. .||...|' .||.....| |'....|' version: dev [11/01/23] :: @f1zm0 Usage: hades -f [-t selfthread|remotethread|queueuserapc] Options: -f, --file shellcode file path (.bin) -t, --technique injection technique [selfthread, remotethread, queueuserapc] ``` ### Example: Inject shellcode that spawms `calc.exe` with [queueuserapc](https://docs.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-queueuserapc) technique: ```auto .\hades.exe -f calc.bin -t queueuserapc ``` ## Showcase User-mode hooking bypass with syscall RVA sorting (`NtQueueApcThread` hooked with [frida-trace](https://frida.re/) and [custom handler](https://github.com/f1zm0/hades/blob/main/scripts/NtQueueApcThread.js)) [![NtQueueApcThread Frida interceptor](https://github.com/f1zm0/hades/raw/main/.github/images/frida-poc.gif)](https://github.com/f1zm0/hades/blob/main/.github/images/frida-poc.gif) Instrumentation callback bypass with indirect syscalls (injected DLL is from [syscall-detect](https://github.com/jackullrich/syscall-detect) by [jackullrich](https://twitter.com/winternl_t)) [![syscall-detect bypass](https://github.com/f1zm0/hades/raw/main/.github/images/syscall-detect-poc.gif)](https://github.com/f1zm0/hades/blob/main/.github/images/syscall-detect-poc.gif) ## Additional Notes ### Direct syscall version In the latest release, direct syscall capabilities have been replaced by indirect syscalls provided by [acheron](https://github.com/f1zm0/acheron). If for some reason you want to use the previous version of the loader that used direct syscalls, you need to explicitly pass the `direct_syscalls` tag to the compiler, which will figure out what files needs to be included and excluded from the build. GOOS=windows GOARCH=amd64 go build -ldflags “-s -w” -tags=‘direct\_syscalls’ -o dist/hades\_directsys.exe cmd/hades/main.go ### Disclaimers > Warning > This project has been created for educational purposes only, to experiment with malware dev in Go, and learn more about the [unsafe](https://pkg.go.dev/unsafe) package and the weird [Go Assembly](https://go.dev/doc/asm) syntax. Don’t use it to on systems you don’t own. The developer of this project is not responsible for any damage caused by the improper use of this tool. ## Credits Shoutout to the following people that shared their knowledge and code that inspired this tool: - [@smelly\_\_vx](https://twitter.com/smelly_vx) and [@am0nsec](https://twitter.com/am0nsec) creators of [Hell’s Gate](https://github.com/am0nsec/HellsGate) - [@modexp](https://twitter.com/modexpblog)’s excellent blog post [Bypassing User-Mode Hooks and syscall invocation in C](https://www.mdsec.co.uk/2020/12/bypassing-user-mode-hooks-and-direct-invocation-of-system-calls-for-red-teams/) - [@ElephantSe4l](https://twitter.com/elephantse4l) creator of [FreshyCalls](https://github.com/crummie5/FreshyCalls) - [@C\_Sto](https://twitter.com/c__sto) creator of [BananaPhone](https://github.com/C-Sto/BananaPhone) - [@winternl](https://twitter.com/winternl_t) for [this blog post](https://winternl.com/detecting-manual-syscalls-from-user-mode/) on Hooking Nirvana and instrumentation callback to detect suspicious syscalls from user-mode. ## License This project is licensed under the GPLv3 License - see the [LICENSE](https://github.com/f1zm0/hades/blob/main/LICENSE) file for details ## GitHub: > **[GitHub - f1zm0/hades: Go shellcode loader that combines multiple evasion...](https://github.com/f1zm0/hades)** > > Go shellcode loader that combines multiple evasion techniques