timwhitez starred BokuLoader

2022-7-7 14:11:58 Author: github.com(查看原文) 阅读量:25 收藏
main
Switch branches/tags

1 branch 0 tags

Code

This branch is up to date with boku7/BokuLoader:main.

Contribute
  • This branch is not ahead of the upstream boku7:main.

    No new commits yet. Enjoy your day!

Latest commit

+ Stomp MZ Magic Bytes
+ Find-Self EggHunter
+ PE Header Obfuscation
+ PE String Replacement
+ Prepend ASM Instructions

93d086f

Git stats

Files

Permalink

Failed to load latest commit information.

Type

Name

Latest commit message

Commit time

Cobalt Strike User-Defined Reflective Loader written in Assembly & C for advanced evasion capabilities.

Project Contributors: Bobby Cooke @0xBoku & Santiago Pecin @s4ntiago_p

Features

  • Stomp MZ Magic Bytes
  • Find-Self EggHunter
  • Direct NT Syscalls via HellsGate & HalosGate
  • PE Header Obfuscation
  • PE String Replacement
  • NOHEADERCOPY - Loader will not copy headers over to beacon. Decommits the first memory page which would normally hold the headers
  • NoRWX - The Reflective loader writes beacon with Read & Write permissions and after resolving Beacons Import Table & Relocations, changes the .TEXT code section of Beacon to Read & Execute permissions
  • XGetProcAddress for resolving symbols
  • 100k UDRL Size
  • Caesar Cipher for string obfuscation
  • Prepend ASM Instructions

Usage

  1. Start your Cobalt Strike Team Server with or without a profile.
  2. Unless you only generate RAW payloads, set the stagesize to 412256 on build.sh in the artifact kit.
  3. Load the dist-template/artifact.cna Aggressor script.
  4. Go to your Cobalt Strike GUI and import the BokuLoader.cna Aggressor script.
  5. Generate your x64 payload (Attacks -> Packages -> Windows Executable (S))
  • Does not support x86 option. The x86 bin is the original Reflective Loader object file.
  1. Use the Script Console to make sure that the beacon created successfully with this User-Defined Reflective Loader
  • If successful, the output in the Script Console will look like this:

Build

  1. Run the make command after installling required dependencies
# Install brew on macOS if you need it (https://brew.sh/)
/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
# Install Ming using Brew
brew install mingw-w64
# Clone this Reflective DLL project from this github repo
git clone https://github.com/boku7/BokuLoader.git
# Compile the BokuLoader Object file
cd BokuLoader/
make
  1. Follow "Usage" instructions

Credits / References

Reflective Loader

HalosGate SysCaller

  • Reenz0h from @SEKTOR7net
    • Most of the C techniques I use are from Reenz0h's awesome courses and blogs
    • Best classes for malware development out there.
    • Creator of the halos gate technique. His work was the motivation for this work.
    • Sektor7 HalosGate Blog

HellsGate Syscaller

Cobalt Strike User Defined Reflective Loader

Great Resource for learning Intel ASM

ETW and AMSI Bypass

Implementing ASM in C Code with GCC

Cobalt Strike C2 Profile Generator


文章来源: https://github.com/xforcered/BokuLoader
如有侵权请联系:admin#unsafe.sh