Dirty Vanity: A New Approach to Code Injection & EDR Bypass
summary
Dirty Vanity claims a reliable EDR bypass by abusing Windows forking: it writes shellcode into a parent process, then triggers a remote fork so execution runs only in the cloned child that the EDR never saw written to. The proof-of-concept uses process reflection, PSS capture snapshot and the RTL entry RTL clone user process, allocates and writes in explorer, then uses native ntdll APIs in the child to launch CMD/MSG; the demo bypasses an EDR and successfully executes the payload.
AI-written summary · about
chapters (17)
- 0:00Start
- 0:45Session Overview
- 1:16Forking Background
- 2:04Origins: The Windows Fork
- 2:42Forking In Windows
- 4:12Credential Defense 101
- 4:39Credential theft via Forking
- 5:56Self Fork API
- 7:36Checking for Remote Forking
- 9:34Remote Fork API
- 14:46Start Routine Protection?
- 17:08Injections & Defense 101
- 21:02Dirty Vanity via Rt1CreateProcess Reflection
- 21:44First Attempt: Reflecting MessageBox
- 31:03Inherit & Forks Recap
- 35:08Summary
- 36:08Takeaways
related talks
29mFrom Zero to Success
40mIn NTDLL I Trust - Process Reimaging and Endpoint Security Solution Bypass
50mWrite Once, Pwn Anywhere
50m.NET Reversing and Exploitation for Cool Kids
41mSimulation Hacking, the Good, Bad and the Ugly
49mLost in Transaction: Process Doppelgänging
40mBeyond Living-Off-the-Land: Why XP Exploits Still Matter
29mRendering Ransomware Detection and EDR Products Blind