mirror of
https://github.com/Tylous/SourcePoint
synced 2026-06-06 16:54:33 +00:00
4.11 implementations and made sleepmask modifable
This commit is contained in:
Ed
+68
-4
@@ -35,6 +35,13 @@ type FlagOptions struct {
|
||||
tasks_proxy_max_size string
|
||||
tasks_dns_proxy_max_size string
|
||||
beacongate string
|
||||
eaf_bypass bool
|
||||
rdll_use_syscalls bool
|
||||
copy_pe_header bool
|
||||
rdll_loader string
|
||||
transform_obfuscate string
|
||||
smartinject bool
|
||||
sleep_mask bool
|
||||
}
|
||||
|
||||
type Beacon_Com struct {
|
||||
@@ -68,7 +75,7 @@ type Beacon_SSL struct {
|
||||
var num_Profile int
|
||||
var Post bool
|
||||
|
||||
func GenerateOptions(stage, sleeptime, jitter, useragent, uri, customuri, customuriGET, customuriPOST, beacon_PE, processinject_min_alloc, Post_EX_Process_Name, metadata, injector, Host, Profile, ProfilePath, outFile, custom_cert, cert_password, CDN, CDN_Value, datajitter, Keylogger string, Forwarder bool, tasks_max_size string, tasks_proxy_max_size string, tasks_dns_proxy_max_size string, syscall_method string, httplib string, ThreadSpoof bool, beacongate string) {
|
||||
func GenerateOptions(stage, sleeptime, jitter, useragent, uri, customuri, customuriGET, customuriPOST, beacon_PE, processinject_min_alloc, Post_EX_Process_Name, metadata, injector, Host, Profile, ProfilePath, outFile, custom_cert, cert_password, CDN, CDN_Value, datajitter, Keylogger string, Forwarder bool, tasks_max_size string, tasks_proxy_max_size string, tasks_dns_proxy_max_size string, syscall_method string, httplib string, ThreadSpoof bool, beacongate string, eaf_bypass bool, rdll_use_syscalls bool, copy_pe_header bool, rdll_loader string, transform_obfuscate string, smartinject bool, sleep_mask bool) {
|
||||
Beacon_Com := &Beacon_Com{}
|
||||
Beacon_Stage_p1 := &Beacon_Stage_p1{}
|
||||
Beacon_Stage_p2 := &Beacon_Stage_p2{}
|
||||
@@ -84,7 +91,7 @@ func GenerateOptions(stage, sleeptime, jitter, useragent, uri, customuri, custom
|
||||
HostStageMessage, Beacon_Com.Variables = GenerateComunication(stage, sleeptime, jitter, useragent, datajitter, tasks_max_size, tasks_proxy_max_size, tasks_dns_proxy_max_size, httplib)
|
||||
Beacon_PostEX.Variables = GeneratePostProcessName(Post_EX_Process_Name, Keylogger, ThreadSpoof)
|
||||
Beacon_GETPOST.Variables = GenerateHTTPVaribles(Host, metadata, uri, customuri, customuriGET, customuriPOST, CDN, CDN_Value, Profile, Forwarder)
|
||||
Beacon_Stage_p1.Variables, Beacon_Stage_p2.Variables, syscall_method = GeneratePE(beacon_PE, syscall_method, beacongate)
|
||||
Beacon_Stage_p1.Variables, Beacon_Stage_p2.Variables, syscall_method = GeneratePE(beacon_PE, syscall_method, beacongate, eaf_bypass, rdll_use_syscalls, copy_pe_header, rdll_loader, transform_obfuscate, smartinject, sleep_mask)
|
||||
Process_Inject.Variables = GenerateProcessInject(processinject_min_alloc, injector)
|
||||
Beacon_GETPOST_Profile.Variables, Beacon_SSL.Variables = GenerateProfile(Profile, CDN, CDN_Value, cert_password, custom_cert, ProfilePath, Host)
|
||||
fmt.Println("[*] Building Profile...")
|
||||
@@ -322,7 +329,7 @@ func GenerateHTTPVaribles(Host, metadata, uri, customuri, customuriGET, customur
|
||||
return Beacon_GETPOST.Variables
|
||||
}
|
||||
|
||||
func GeneratePE(beacon_PE string, syscall_method string, beacongate string) (map[string]string, map[string]string, string) {
|
||||
func GeneratePE(beacon_PE string, syscall_method string, beacongate string, eaf_bypass bool, rdll_use_syscalls bool, copy_pe_header bool, rdll_loader string, transform_obfuscate string, smartinject bool, sleep_mask bool) (map[string]string, map[string]string, string) {
|
||||
Beacon_Stage_p1 := &Beacon_Stage_p1{}
|
||||
Beacon_Stage_p1.Variables = make(map[string]string)
|
||||
|
||||
@@ -341,11 +348,67 @@ func GeneratePE(beacon_PE string, syscall_method string, beacongate string) (map
|
||||
} else {
|
||||
log.Fatal("Error: Please provide a valid Syscall Method")
|
||||
}
|
||||
|
||||
if rdll_loader == "PrependLoader" {
|
||||
Beacon_Stage_p1.Variables["rdll_loader"] = "PrependLoader"
|
||||
} else if rdll_loader == "StompLoader" {
|
||||
Beacon_Stage_p1.Variables["rdll_loader"] = "StompLoader"
|
||||
} else {
|
||||
log.Fatal("Error: Please provide a valid Rdll Loader option")
|
||||
}
|
||||
// Set default value for eaf_bypass
|
||||
if eaf_bypass == true {
|
||||
Beacon_Stage_p1.Variables["eaf_bypass"] = "true"
|
||||
} else {
|
||||
Beacon_Stage_p1.Variables["eaf_bypass"] = "false"
|
||||
}
|
||||
if rdll_use_syscalls == true {
|
||||
Beacon_Stage_p1.Variables["rdll_use_syscalls"] = "true"
|
||||
} else {
|
||||
Beacon_Stage_p1.Variables["rdll_use_syscalls"] = "false"
|
||||
}
|
||||
if copy_pe_header == true {
|
||||
Beacon_Stage_p1.Variables["copy_pe_header"] = "true"
|
||||
} else {
|
||||
Beacon_Stage_p1.Variables["copy_pe_header"] = "false"
|
||||
}
|
||||
if smartinject == true {
|
||||
Beacon_Stage_p1.Variables["smartinject"] = "true"
|
||||
} else {
|
||||
Beacon_Stage_p1.Variables["smartinject"] = "false"
|
||||
}
|
||||
if sleep_mask == true {
|
||||
Beacon_Stage_p1.Variables["sleep_mask"] = "true"
|
||||
} else {
|
||||
Beacon_Stage_p1.Variables["sleep_mask"] = "false"
|
||||
}
|
||||
gen_number, _ := strconv.Atoi(Utils.GenerateNumer(0, 6))
|
||||
Beacon_Stage_p1.Variables["magic_mz_x64"] = Struct.Magic_PE[gen_number]
|
||||
Beacon_Stage_p1.Variables["magic_pe"] = strings.ToUpper(Utils.GenerateSingleValue(2))
|
||||
|
||||
// Handle transform_obfuscate
|
||||
if transform_obfuscate != "" {
|
||||
// Split the transform_obfuscate string by commas
|
||||
obfuscateMethods := strings.Split(transform_obfuscate, ",")
|
||||
var formattedMethods []string
|
||||
|
||||
for _, method := range obfuscateMethods {
|
||||
method = strings.TrimSpace(method)
|
||||
// Check if the method has a parameter (like rc4 "64")
|
||||
if strings.Contains(method, " ") {
|
||||
// Method with parameter
|
||||
formattedMethods = append(formattedMethods, " "+method+";")
|
||||
} else {
|
||||
// Method without parameter
|
||||
formattedMethods = append(formattedMethods, " "+method+";")
|
||||
}
|
||||
}
|
||||
|
||||
// Join the methods with newlines
|
||||
Beacon_Stage_p1.Variables["transform_obfuscate"] = "transform-obfuscate {\n" + strings.Join(formattedMethods, "\n") + "\n}"
|
||||
} else {
|
||||
Beacon_Stage_p1.Variables["transform_obfuscate"] = ""
|
||||
}
|
||||
|
||||
if beacon_PE == "" {
|
||||
PE_Num, _ := strconv.Atoi(Utils.GenerateNumer(0, 30))
|
||||
Beacon_Stage_p2.Variables["pe"] = Struct.Peclone_list[PE_Num]
|
||||
@@ -412,6 +475,7 @@ func GenerateProcessInject(processinject_min_alloc, injector string) map[string]
|
||||
}
|
||||
}
|
||||
Process_Inject.Variables["ThreadStartNum"] = Utils.GenerateNumer(500, 2500)
|
||||
Process_Inject.Variables["ThreadStartNumv2"] = Utils.GenerateNumer(500, 2500)
|
||||
if injector == "NtMapViewOfSection" {
|
||||
Process_Inject.Variables["injector"] = injector
|
||||
} else if injector == "VirtualAllocEx" {
|
||||
|
||||
+13
-5
@@ -3,17 +3,17 @@ Host: "acme-email.com"
|
||||
Keystore:
|
||||
Password:
|
||||
Metadata: "netbios"
|
||||
Injector: "VirtualAllocEx"
|
||||
Injector: "NtMapViewOfSection"
|
||||
Outfile: "acme.profile"
|
||||
PE_Clone: 20
|
||||
PE_Clone: 23
|
||||
Profile: 2
|
||||
Allocation: 5312
|
||||
Jitter: 30
|
||||
Debug: true
|
||||
Sleep: 35
|
||||
Uri: 3
|
||||
Useragent: "Mac"
|
||||
Post-EX Processname: 11
|
||||
Useragent: "Win10Edge"
|
||||
Post-EX Processname: 8
|
||||
Datajitter: 40
|
||||
Keylogger: "SetWindowsHookEx"
|
||||
Customuri:
|
||||
@@ -29,4 +29,12 @@ CustomuriPOST:
|
||||
Forwarder: False
|
||||
TasksMaxSize:
|
||||
TasksProxyMaxSize:
|
||||
TasksDnsProxyMaxSize:
|
||||
TasksDnsProxyMaxSize:
|
||||
EafBypass: True
|
||||
RdllUseSyscalls: True
|
||||
CopyPEHeader: True
|
||||
RdllLoader: "PrependLoader"
|
||||
TransformObfuscate: "lznt1,xor \"32\""
|
||||
SmartInject: False
|
||||
BeaconGate: "All"
|
||||
SleepMask: False
|
||||
+35
-2
@@ -44,6 +44,13 @@ type FlagOptions struct {
|
||||
threadspoof bool
|
||||
Yaml string
|
||||
beacongate string
|
||||
eaf_bypass bool
|
||||
rdll_use_syscalls bool
|
||||
copy_pe_header bool
|
||||
rdll_loader string
|
||||
transform_obfuscate string
|
||||
smartinject bool
|
||||
sleep_mask bool
|
||||
}
|
||||
|
||||
type conf struct {
|
||||
@@ -79,6 +86,13 @@ type conf struct {
|
||||
Httplib string `yaml:"Httplib"`
|
||||
Threadspoof bool `yaml:"ThreadSpoof"`
|
||||
BeaconGate string `yaml:"BeaconGate"`
|
||||
EafBypass bool `yaml:"EafBypass"`
|
||||
RdllUseSyscalls bool `yaml:"RdllUseSyscalls"`
|
||||
Copy_PE_Header bool `yaml:"CopyPEHeader"`
|
||||
RdllLoader string `yaml:"RdllLoader"`
|
||||
TransformObfuscate string `yaml:"TransformObfuscate"`
|
||||
SmartInject bool `yaml:"SmartInject"`
|
||||
SleepMask bool `yaml:"SleepMask"`
|
||||
}
|
||||
|
||||
func (c *conf) getConf(yamlfile string) *conf {
|
||||
@@ -201,8 +215,20 @@ func options() *FlagOptions {
|
||||
threadspoof := flag.Bool("ThreadSpoof", true, "Sets post-ex DLLs to spawn threads with a spoofed start address. These are generated randomly")
|
||||
Yaml := flag.String("Yaml", "", "Path to the Yaml config file")
|
||||
beacongate := flag.String("BeaconGate", "", "Specify beacon gate options (All, Comms, Core, Cleanup) or specific APIs")
|
||||
eaf_bypass := flag.Bool("EafBypass", false, "Enable EAF Bypass")
|
||||
rdll_use_syscalls := flag.Bool("RdllUseSyscalls", false, "Use Syscalls for Rdll")
|
||||
copy_pe_header := flag.Bool("CopyPEHeader", false, "Copy PE Header")
|
||||
rdll_loader := flag.String("RdllLoader", "PrependLoader", "Rdll Loader Options PrependLoader or StompLoader (Older method)")
|
||||
transform_obfuscate := flag.String("TransformObfuscate", "", `Transform obfuscate options (comma-separated list):
|
||||
[*] lznt1
|
||||
[*] rc4 "64"
|
||||
[*] xor "32"
|
||||
[*] base64
|
||||
Example: "lznt1,rc4 \"64\",xor \"32\",base64"`)
|
||||
smartinject := flag.Bool("SmartInject", false, "Enable Smart Inject")
|
||||
sleep_mask := flag.Bool("SleepMask", true, "Enable Sleep Mask")
|
||||
flag.Parse()
|
||||
return &FlagOptions{stage: *stage, sleeptime: *sleeptime, jitter: *jitter, useragent: *useragent, uri: *uri, customuri: *customuri, customuriGET: *customuriGET, customuriPOST: *customuriPOST, beacon_PE: *beacon_PE, processinject_min_alloc: *processinject_min_alloc, Post_EX_Process_Name: *Post_EX_Process_Name, metadata: *metadata, injector: *injector, Host: *Host, Profile: *Profile, ProfilePath: *ProfilePath, outFile: *outFile, custom_cert: *custom_cert, cert_password: *cert_password, CDN: *CDN, CDN_Value: *CDN_Value, Yaml: *Yaml, Datajitter: *Datajitter, Keylogger: *Keylogger, Forwarder: *Forwarder, tasks_max_size: *tasks_max_size, tasks_proxy_max_size: *tasks_proxy_max_size, tasks_dns_proxy_max_size: *tasks_dns_proxy_max_size, syscall_method: *syscall_method, httplib: *httplib, threadspoof: *threadspoof, beacongate: *beacongate}
|
||||
return &FlagOptions{stage: *stage, sleeptime: *sleeptime, jitter: *jitter, useragent: *useragent, uri: *uri, customuri: *customuri, customuriGET: *customuriGET, customuriPOST: *customuriPOST, beacon_PE: *beacon_PE, processinject_min_alloc: *processinject_min_alloc, Post_EX_Process_Name: *Post_EX_Process_Name, metadata: *metadata, injector: *injector, Host: *Host, Profile: *Profile, ProfilePath: *ProfilePath, outFile: *outFile, custom_cert: *custom_cert, cert_password: *cert_password, CDN: *CDN, CDN_Value: *CDN_Value, Yaml: *Yaml, Datajitter: *Datajitter, Keylogger: *Keylogger, Forwarder: *Forwarder, tasks_max_size: *tasks_max_size, tasks_proxy_max_size: *tasks_proxy_max_size, tasks_dns_proxy_max_size: *tasks_dns_proxy_max_size, syscall_method: *syscall_method, httplib: *httplib, threadspoof: *threadspoof, beacongate: *beacongate, eaf_bypass: *eaf_bypass, rdll_use_syscalls: *rdll_use_syscalls, copy_pe_header: *copy_pe_header, rdll_loader: *rdll_loader, transform_obfuscate: *transform_obfuscate, smartinject: *smartinject, sleep_mask: *sleep_mask}
|
||||
|
||||
}
|
||||
|
||||
@@ -253,7 +279,14 @@ func main() {
|
||||
opt.httplib = c.Httplib
|
||||
opt.threadspoof = c.Threadspoof
|
||||
opt.beacongate = c.BeaconGate
|
||||
opt.eaf_bypass = c.EafBypass
|
||||
opt.rdll_use_syscalls = c.RdllUseSyscalls
|
||||
opt.copy_pe_header = c.Copy_PE_Header
|
||||
opt.rdll_loader = c.RdllLoader
|
||||
opt.transform_obfuscate = c.TransformObfuscate
|
||||
opt.smartinject = c.SmartInject
|
||||
}
|
||||
|
||||
if opt.outFile == "" {
|
||||
log.Fatal("Error: Please provide a file name to save the profile into")
|
||||
}
|
||||
@@ -267,5 +300,5 @@ func main() {
|
||||
log.Fatal("Error: When using CustomuriGET/CustomuriPOST, both must be sepecified")
|
||||
}
|
||||
fmt.Println(c.TasksMaxSize)
|
||||
Loader.GenerateOptions(opt.stage, opt.sleeptime, opt.jitter, opt.useragent, opt.uri, opt.customuri, opt.customuriGET, opt.customuriPOST, opt.beacon_PE, opt.processinject_min_alloc, opt.Post_EX_Process_Name, opt.metadata, opt.injector, opt.Host, opt.Profile, opt.ProfilePath, opt.outFile, opt.custom_cert, opt.cert_password, opt.CDN, opt.CDN_Value, opt.Datajitter, opt.Keylogger, opt.Forwarder, opt.tasks_max_size, opt.tasks_proxy_max_size, opt.tasks_dns_proxy_max_size, opt.syscall_method, opt.httplib, opt.threadspoof, opt.beacongate)
|
||||
Loader.GenerateOptions(opt.stage, opt.sleeptime, opt.jitter, opt.useragent, opt.uri, opt.customuri, opt.customuriGET, opt.customuriPOST, opt.beacon_PE, opt.processinject_min_alloc, opt.Post_EX_Process_Name, opt.metadata, opt.injector, opt.Host, opt.Profile, opt.ProfilePath, opt.outFile, opt.custom_cert, opt.cert_password, opt.CDN, opt.CDN_Value, opt.Datajitter, opt.Keylogger, opt.Forwarder, opt.tasks_max_size, opt.tasks_proxy_max_size, opt.tasks_dns_proxy_max_size, opt.syscall_method, opt.httplib, opt.threadspoof, opt.beacongate, opt.eaf_bypass, opt.rdll_use_syscalls, opt.copy_pe_header, opt.rdll_loader, opt.transform_obfuscate, opt.smartinject, opt.sleep_mask)
|
||||
}
|
||||
|
||||
+9
-3
@@ -573,7 +573,7 @@ header "X-Via" "haproxy-www-w6k7";
|
||||
</div>
|
||||
|
||||
<div id=\"notifications_dismiss_banner\" class=\"banner seafoam_green_bg hidden\">
|
||||
We strongly recommend enabling desktop notifications if you’ll be using Slack on this computer. <span class=\"inline_block no_wrap\">
|
||||
We strongly recommend enabling desktop notifications if you'll be using Slack on this computer. <span class=\"inline_block no_wrap\">
|
||||
<button type=\"button\" class=\"btn_link\" onclick=\"TS.ui.banner.close(); TS.ui.banner.growlsPermissionPrompt();\">Enable notifications</button> •
|
||||
<button type=\"button\" class=\"btn_link\" onclick=\"TS.ui.banner.close()\">Ask me next time</button> •
|
||||
<button type=\"button\" class=\"btn_link\" onclick=\"TS.ui.banner.closeNagAndSetCookie()\">Never ask again on this computer</button>
|
||||
@@ -1321,7 +1321,7 @@ stage {
|
||||
set stomppe "true";
|
||||
set cleanup "true";
|
||||
set userwx "false";
|
||||
set smartinject "true";
|
||||
set smartinject "{{.Variables.smartinject}}";
|
||||
beacon_gate {
|
||||
{{.Variables.beacongate}}
|
||||
}
|
||||
@@ -1333,7 +1333,12 @@ stage {
|
||||
|
||||
#TCP and SMB beacons will obfuscate themselves while they wait for a new connection.
|
||||
#They will also obfuscate themselves while they wait to read information from their parent Beacon.
|
||||
set sleep_mask "true";
|
||||
set sleep_mask {{.Variables.sleep_mask}};
|
||||
set eaf_bypass "{{.Variables.eaf_bypass}}";
|
||||
set rdll_use_syscalls "{{.Variables.rdll_use_syscalls}}";
|
||||
set copy_pe_header "{{.Variables.copy_pe_header}}";
|
||||
set rdll_loader "{{.Variables.rdll_loader}}";
|
||||
{{.Variables.transform_obfuscate}}
|
||||
`
|
||||
}
|
||||
func Beacon_Stage_p2_Stuct() string {
|
||||
@@ -1582,6 +1587,7 @@ process-inject {
|
||||
|
||||
# specify how we execute code in the remote process
|
||||
execute {
|
||||
ObfSetThreadContext "ntdll!TpReleaseCleanupGroupMembers+0x{{.Variables.ThreadStartNumv2}}";
|
||||
CreateThread "ntdll.dll!RtlUserThreadStart+0x{{.Variables.ThreadStartNum}}";
|
||||
NtQueueApcThread-s;
|
||||
SetThreadContext;
|
||||
|
||||
Reference in New Issue
Block a user