MassDriver

Proxying sensitive API calls from shellcode to artifact for CET compatible clean call stacks.

Companion PoC for my blog post: Stop Being Weird — Life After Call Stack Spoofing Under CET.

Building

MinGW does not have a way to set the CET compatibility flag so you will need llvm-mingw to build with CET.

Builds with ./payload/testDll.c as its payload by default, which calls LoadLibraryA and Sleep so you can inspect the call stack.

• Place your copy of libtcg.x64.zip in ./tcg/
• Place your Crystal Palace dist/ directory into ./tcg/dist
• make poc

Cobalt Strike

• Load rawDll.cna and generate payload with Payloads->Stageless Payload Generator
• Output to ./bin/payload.dll
• make cs