h-leaker source code (BYPASS FOR BATTLE EYE)

Posts 1–15 of 38 · Page 1 of 3
h-leaker source code (BYPASS FOR BATTLE EYE)
It's time to show you my new project called "HLeaker".
It allows you to use the process handles from services/protected processes like csrss and lsass.

This uses a shellcode to set the handle to inherit status and CreateProcessAsUser to start a child process and inherit the opened handle.

You can use this to steal handles from other processes and use it for your own purposes.

How does it work?
Gets the processid of the process
Enumrates the handles using ServiceEnumHandles
Iterates through the HandleList and set the handle status to inherit using ServiceSetHandleStatus
Starts the child process with the inherited handle as parameter using ServiceStartProcess.

Use Visual Studio 2015 or higher to compile this and make sure you encrypt the shellcodes.

[B]I am not the original creator all credit goes to Schnocker

Virus scans:
Virustotal
Jotti
HLeaker-master_mpgh.net.zip47 KB · 1,949 downloads Clean
//Approved, source only.
Hleaker dont work anymore.
Quote Originally Posted by OriginAIO View Post
It's time to show you my new project called "HLeaker".
It allows you to use the process handles from services/protected processes like csrss and lsass.

This uses a shellcode to set the handle to inherit status and CreateProcessAsUser to start a child process and inherit the opened handle.

You can use this to steal handles from other processes and use it for your own purposes.

How does it work?
Gets the processid of the process
Enumrates the handles using ServiceEnumHandles
Iterates through the HandleList and set the handle status to inherit using ServiceSetHandleStatus
Starts the child process with the inherited handle as parameter using ServiceStartProcess.

Use Visual Studio 2015 or higher to compile this and make sure you encrypt the shellcodes.

[B]I am not the original creator all credit goes to Schnocker

Virus scans:
Virustotal
Jotti
this is the second thread ive seen where u are literally
just copy/pasting someone elses work on this forum from another. are you just doing this for attention? lol
Asian are you going to stop being a skid trying to get rep from pasting stuff you never even did ?
Quote Originally Posted by fx666666 View Post
Asian are you going to stop being a skid trying to get rep from pasting stuff you never even did ?
lol I credit them I'm just sharing Bc pubg thread on mpgh is dead.

- - - Updated - - -

Quote Originally Posted by swaee View Post
this is the second thread ive seen where u are literally
just copy/pasting someone elses work on this forum from another. are you just doing this for attention? lol
Mpgh pubg tread is dead just trying to keep it current I asked OP for permission

- - - Updated - - -

You know unlike eclipse where He is trying to scam people. Who works with nightfallx I try and give out the source code to people who can't find it.

- - - Updated - - -

Quote Originally Posted by VOSSWATER View Post
Hleaker dont work anymore.
Um it does work. You have to change shellcode
Quote Originally Posted by OriginAIO View Post
lol I credit them I'm just sharing Bc pubg thread on mpgh is dead.

- - - Updated - - -



Mpgh pubg tread is dead just trying to keep it current I asked OP for permission

- - - Updated - - -

You know unlike eclipse where He is trying to scam people. Who works with nightfallx I try and give out the source code to people who can't find it.

- - - Updated - - -



Um it does work. You have to change shellcode
Can u aborate on the shellcode? Ive seen some posts about it elsewhere but no one spoke real clearly on it. First of all... Where IS the shell code lol. And then what can it be changed to to still function?
Quote Originally Posted by dman223 View Post
Can u aborate on the shellcode? Ive seen some posts about it elsewhere but no one spoke real clearly on it. First of all... Where IS the shell code lol. And then what can it be changed to to still function?
It's in the source code in the Service file.
Quote Originally Posted by jay1337s View Post
It's in the source code in the Service file.
Thank you. How can i be changed? Isnt it instruction for the entire application? I just dont understand when people say "change it" change it to randomness, or specific codes?

And which one here is it?

What if i just obfuscate everything before compiling?
Screenshot_20171012-071403.jpg213 KB · 460 downloads Screenshot_20171012-071353.jpg253 KB · 150 downloads
Quote Originally Posted by dman223 View Post
Thank you. How can i be changed? Isnt it instruction for the entire application? I just dont understand when people say "change it" change it to randomness, or specific codes?

And which one here is it?

What if i just obfuscate everything before compiling?

I guess you will have to study C/C++, no one will baby feed you (I wish I could).
Quote Originally Posted by jay1337s View Post
I guess you will have to study C/C++, no one will baby feed you (I wish I could).
What about adding junk code randomly between the shell code? Because isnt it detected as a signature, like punkbuster?
Quote Originally Posted by dman223 View Post
What about adding junk code randomly between the shell code? Because isnt it detected as a signature, like punkbuster?
It probably is sigged yes, but you'd have to add tons of stuff I think.
Quote Originally Posted by jay1337s View Post
It probably is sigged yes, but you'd have to add tons of stuff I think.
Not 100% correct adding nops should be good enough.
Quote Originally Posted by OriginAIO View Post
Not 100% correct adding nops should be good enough.
I see, will look that up. Do you have Skype by any chance and wouldn't mind helping a newbie here and then? Started with C a while back and would really appreciate any help.
Quote Originally Posted by jay1337s View Post
I see, will look that up. Do you have Skype by any chance and wouldn't mind helping a newbie here and then? Started with C a while back and would really appreciate any help.
what are nops btw? saw in a post on UC that they do not work.
Posts 1–15 of 38 · Page 1 of 3

Post a Reply

Similar Threads

Tags for this Thread

None

Talk with us