You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
My recent exploration into C2 frameworks led me to BishopFox's [Sliver](https://github.com/BishopFox/sliver). While its capabilities are impressive, I quickly encountered a common challenge: Windows Defender's swift detection of beacon payloads on my Windows VM. In order to enhance my evasion skills, this post details my process in leveraging [DInvoke](https://github.com/Kara-4search/DInvoke_shellcodeload_CSharp/tree/main) and [FilelessPELoader](https://github.com/SaadAhla/FilelessPELoader) for building my own Sliver stager, complemented by practical obfuscation strategies.
13
+
My recent exploration into C2 frameworks led me to BishopFox's [Sliver](https://github.com/BishopFox/sliver) project. While its capabilities are impressive, I quickly encountered a common challenge: Windows Defender's swift detection of beacon payloads on my Windows VM. In order to enhance my red teaming skills, I decided to dig into leveraging [DInvoke](https://github.com/Kara-4search/DInvoke_shellcodeload_CSharp/tree/main), [FilelessPELoader](https://github.com/SaadAhla/FilelessPELoader)and several evasion techniques for building my own Sliver shellcode loader.
14
14
15
-
## Shellcode Loader
16
-
A shellcode loader is a small piece of executable code designed toload and execute a larger payload (the actual shellcode) into a target process's memory. Think of it as the initial delivery mechanism. Shellcode loaders are crucial for techniques like process injection, allowing attackers to run arbitrary code within a legitimate process, often bypassing traditional security controls that focus on executable files on disk.
15
+
## What is a shellcode loader?
16
+
A shellcode loader is a small piece of executable code designed to, as its name would suggest, load and execute shellcode (being a larger payload) into a target process's memory. Think of it as the initial delivery mechanism. Shellcode loaders are often go along with techniques like process injection, allowing attackers to run arbitrary code within a legitimate process, that bypass traditional security controls focused on executable files on disk.
17
17
18
-
This loader will act as a **stage 1** payload (stager). Its primary purpose is to establish communication with a command and control (C2) server and download the larger, more feature-rich **stage 2** payload. The stage 2 payload is the main malicious code that we as an attacker intend to execute on the target system, which in our case is a Sliver beacon.
18
+
The loader will act as a **Stage 1** payload (a.k.a. stagers). Its primary purpose is to establish communication with a command and control (C2) or payload server and download the larger, more feature-rich **Stage 2** payload. The second stage payload is the main malicious code that we as an attacker intend to execute on the target system. For this blog post our final payload will be a Sliver beacon.
19
19
20
20
The goal is to create a stager with the following properties:
21
-
1. Natively supported by Windows.
22
-
2. Bypass common defenses found on modern operating systems.
23
-
3. Use commonly whitelisted protocols in order to bypass firewall rules and fit in with normal traffic.
21
+
1. Natively supported by Windows without too much dependencies.
22
+
2. Bypass common defenses found on modern operating systems (e.g. signature checks).
23
+
3. Use commonly whitelisted protocols in order to bypass firewall rules and fit in with normal traffic (e.g. web traffic).
24
24
25
25
## Sliver Setup
26
26
27
-
!!!info Note
27
+
!!!info
28
28
For more information on installing and using Sliver, see the [official wiki](https://sliver.sh/docs?name=Linux+Install+Script).
29
29
!!!
30
30
31
-
From Sliver v1.5 you can make extensive customizations to the HTTP C2 traffic generated by the server and implant by modifying the HTTP C2 configuration file, which by default is located at `~/.sliver/configs/http-c2.json`. To be able to blend in more with normal traffic, we can make modifications to this file.
31
+
From Sliver v1.5 you can make extensive customizations to the HTTP C2 traffic generated by the server and implant by modifying the HTTP C2 configuration file, which by default is located at `~/.sliver/configs/http-c2.json`. To be able to blend in more with normal traffic, I made some minor modifications to this file.
32
32
33
33
Next, we can generate our HTTPS beacon shellcode with basic obfuscation features enabled.
34
34
@@ -43,9 +43,9 @@ $ sudo ./sliver-server_linux
43
43
[*] Implant saved to /tmp/rev.bin
44
44
```
45
45
46
-
This command will save the shellcode for our Sliver beacon in `/tmp/rev.bin`. If you don't want to generate the shellcode within Sliver, we can also generate an executable directly and use an mTLS listener.
46
+
This command will save the shellcode for our Sliver beacon in `/tmp/rev.bin`. If you don't want to generate the shellcode within Sliver, we can also generate an executable (default) and use an mTLS listener.
47
47
48
-
48
+
49
49
50
50
In order to better evade detection, we can convert the executable to a `.bin` file with [Donut](https://github.com/TheWover/donut). Donut is a tool focused on creating binary shellcodes that can be executed in memory. Its primary strength lies in its ability to convert executables (.exe), dynamic-link libraries (.dll), .NET assemblies, VBScript, and JScript into shellcode. This shellcode can then be injected into a running process, allowing for fileless execution of malicious payloads. I'll use Donut with the `-b 1` flag to not add AMSI bypass and the `-e 3` flag for encryption.
The idea is that our stager will grab this binary file and execute it in memory. We can use an existing PE Loader to perform Process Injection into a target process by downloading/invoking remotely hosted shellcode. However, as a learning experience I wanted to create my own loaders.
69
+
The idea is that our final stager will grab this binary shellcode file and execute it in memory. There are plenty of existing PE loaders to perform Process Injection into a target process. However, as a learning experience I wanted to create my own loaders.
72
70
73
71
## Method 1: DInvoke Stager (.NET)
74
72
Lately, we've seen a growing trend where security tools are being developed in C# or adapted from PowerShell scripts. An advantage of C# is its capability to directly interact with the Windows operating system's core functions, known as the Win32 API. This low-level interaction is similar to what's possible with C or C++ programs.
@@ -137,7 +135,7 @@ We can now compile the project to x64 architecture in release mode by going to `
137
135
### AV Check
138
136
With our loader ready, we can verify if our file is not getting detected as malicious by running [ThreatCheck](https://github.com/rasta-mouse/ThreatCheck) or [DefenderCheck](https://github.com/matterpreter/DefenderCheck).
The generated files `cipher.bin` and `key.bin` can be passed to our loader as arguments. In the next section we will have a look at how we can make use of our loaders.
177
175
176
+
## Method 3: Custom Encrypted Stager
177
+
Sliver has built-in support for custom stagers making use of encryption and compression when serving stages. First we need to setup our profile, listener, and stage listener with the following command:
By making some modifications to their [Encrypted Stage Example](https://sliver.sh/docs?name=Stagers) code, we can add additional functionality to inject our shellcode into a running process by using a techniques called **Process Hollowing**.
189
+
190
+
!!!info
191
+
Process hollowing is a technique to execute code under the guise of a legitimate process. It works by creating a new process in a suspended state, typically a benign system executable like `svchost.exe`, and then unmapping or "hollowing out" its original memory. We can then inject our own malicious code into this memory space and resume the process, making it appear as though the legitimate process is running.
192
+
!!!
193
+
194
+
Just as before, we can use InvisibilityCloak on the project from [Cyb3rDudu](https://github.com/Cyb3rDudu/SliverLoader/tree/main). This project makes use of the Sliver encrypted stager incorporating AMSI bypass, process injection, hollowing and much more. We can compile the project in `Release Mode` and convert the DLL to raw bytes.
Convert the raw bytes to Base64 with a [CyberChef recipe](https://gchq.github.io/CyberChef/#recipe=From_Decimal('Line%20feed',false)To_Base64('A-Za-z0-9%2B/%3D')).
This script is a PowerShell loader that is hosted on our server, intented to be downloaded and executed once an attacker gains code execution. The script will load the stager into memory via reflection and performs the `DownloadAndExecute` operation of the agent from the staging server.
225
+
178
226
## Sliver in Action
179
227
Moving to our attack machine, we run our Python HTTP server where our shellcode is located.
Our PowerShell loader can be hosted on a webserver as a normal file. On the victim, the following command executes the download and staging of the agent which will result in an incoming session in sliver.
Since we now have an active beacon on our target, we can even go a step further and escalate privileges on the host.
212
271
Use one of the beacons and run `sa-whoami` (installed via armory). This will run a `whoami /all` in a more safe way.
@@ -268,7 +327,7 @@ The above UAC Bypass creates an elevated `ICMLuaUtil COM` object and calls its S
268
327
This will launch another beacon process running as Administrator. With these privileges we can try to dump all credentials from LSASS. To stay stealthy, let's use [SharpSAMDump](https://github.com/jojonas/SharpSAMDump).
0 commit comments