sRDI & API Hooking: Detours | GhostHook | Password Manager Steler

New to Maldev? Start with our Maldev 101 - foundational series before diving in: https://www.rbtsec.com/blog/category/... https://www.rbtsec.com/blog/api-hooki... In this demo, we flip API hooking on its head, the same E9 JMP trampoline that AV and EDR use to watch you can be used offensively to steal credentials straight out of a running process. We walk through GhostHook (a.k.a. Pekenux): a fileless infostealer that hooks the master password dialog in Password Safe (pwsafe.exe) using Microsoft Detours, captures the plaintext credential in memory, and beacons it to a C2 via WinHTTP POST, entirely without dropping a DLL on disk. Follow Us: Discord:   / discord   LinkedIn:   / rbtsecurity   Twitter:   / rbtsecurity   Facebook:   / rbtsecur1ty   GitHub: https://github.com/rbtsecurity/ Work With Us: Want to see what this looks like deployed against your AV/EDR and infrastructure?, book a session: https://calendar.google.com/calendar/... or get in touch: https://www.rbtsec.com/contact-us/ Educational Disclaimer: All content is intended for educational purposes only, to promote ethical hacking and security research. #RBTSecurity #Maldev #ProcessInjection #srdi #passwordmanager #redteam #CredentialHarvesting #MicrosoftDetours #WindowsInternals #OffensiveSecurity #AVBypass #FunctionHooking #C2