ProcessHider: Post-exploitation tool for hiding processes from monitoring applications

ProcessHider is a post-exploitation tool designed to hide processes from monitoring tools such as Task Manager and Process Explorer, thus preventing the admins from discovering payload’s processes. The tool works on both 32 and 64-bit versions, by self-detecting the OS version and using the right version of the tool.

ProcessHider is available as an EXE file or as a Powershell script.

First, the hider checks whether the OS is 32 bit or 64 bit, and chooses the right version to use. Then, it launches a daemon, which looks for one of the forbidden monitoring tools. When it finds one – it uses DLL injection to launch the payload – which hooks the call to NtQuerySystemInformation – the method the OS tools use to enumerate active processes and deletes each of the processes specified (and the daemon) from the results.

Download

git clone  https://github.com/M00nRise/ProcessHider.git

To build the project, use “build-me.bat” that’s in the root directory. There are two versions of the complete script: EXE and Powershell.

Use

To use the EXE, call the main file, ProcessHider, which is under MainFile, from cmd, using the following options:

• -i – specify process IDs that you want to hide, separated by commas (without space!)
• -n – specify process names that you want to hide, separated by commas (again, no spaces)
• -x – specify monitoring applications you want to avoid, other than defaults (powershell.exe,taskmgr.exe,procexp.exe,procexp64.exe,perfmon.exe)

To use the Powershell, use Powershell\Output\fullScript.ps1, with the same arguments as the exe.

Example usage:

`ProcessHider -i 5454,3672 -n "chrome.exe,notepad.exe" -x "cmd.exe"`

Note: you need to use at least one of -i or -n. The hider will make sure to hide as well.

Copyright (c) 2016, M00nRise

Source: https://github.com/M00nRise/