From 586bbc8d0f47d41ea5a31424240fdfa645e12253 Mon Sep 17 00:00:00 2001 From: Ed <59506742+0xflagplz@users.noreply.github.com> Date: Fri, 11 Apr 2025 07:56:52 -0700 Subject: [PATCH] 4.11 implementations and made sleepmask modifable --- Loader/Loader.go | 72 +++++++++++++++++++++++++++++++++++++++++++++--- Sample.yaml | 18 ++++++++---- SourcePoint.go | 37 +++++++++++++++++++++++-- Struct/Struct.go | 12 ++++++-- 4 files changed, 125 insertions(+), 14 deletions(-) diff --git a/Loader/Loader.go b/Loader/Loader.go index 3fde350..acfa206 100644 --- a/Loader/Loader.go +++ b/Loader/Loader.go @@ -35,6 +35,13 @@ type FlagOptions struct { tasks_proxy_max_size string tasks_dns_proxy_max_size string beacongate string + eaf_bypass bool + rdll_use_syscalls bool + copy_pe_header bool + rdll_loader string + transform_obfuscate string + smartinject bool + sleep_mask bool } type Beacon_Com struct { @@ -68,7 +75,7 @@ type Beacon_SSL struct { var num_Profile int var Post bool -func GenerateOptions(stage, sleeptime, jitter, useragent, uri, customuri, customuriGET, customuriPOST, beacon_PE, processinject_min_alloc, Post_EX_Process_Name, metadata, injector, Host, Profile, ProfilePath, outFile, custom_cert, cert_password, CDN, CDN_Value, datajitter, Keylogger string, Forwarder bool, tasks_max_size string, tasks_proxy_max_size string, tasks_dns_proxy_max_size string, syscall_method string, httplib string, ThreadSpoof bool, beacongate string) { +func GenerateOptions(stage, sleeptime, jitter, useragent, uri, customuri, customuriGET, customuriPOST, beacon_PE, processinject_min_alloc, Post_EX_Process_Name, metadata, injector, Host, Profile, ProfilePath, outFile, custom_cert, cert_password, CDN, CDN_Value, datajitter, Keylogger string, Forwarder bool, tasks_max_size string, tasks_proxy_max_size string, tasks_dns_proxy_max_size string, syscall_method string, httplib string, ThreadSpoof bool, beacongate string, eaf_bypass bool, rdll_use_syscalls bool, copy_pe_header bool, rdll_loader string, transform_obfuscate string, smartinject bool, sleep_mask bool) { Beacon_Com := &Beacon_Com{} Beacon_Stage_p1 := &Beacon_Stage_p1{} Beacon_Stage_p2 := &Beacon_Stage_p2{} @@ -84,7 +91,7 @@ func GenerateOptions(stage, sleeptime, jitter, useragent, uri, customuri, custom HostStageMessage, Beacon_Com.Variables = GenerateComunication(stage, sleeptime, jitter, useragent, datajitter, tasks_max_size, tasks_proxy_max_size, tasks_dns_proxy_max_size, httplib) Beacon_PostEX.Variables = GeneratePostProcessName(Post_EX_Process_Name, Keylogger, ThreadSpoof) Beacon_GETPOST.Variables = GenerateHTTPVaribles(Host, metadata, uri, customuri, customuriGET, customuriPOST, CDN, CDN_Value, Profile, Forwarder) - Beacon_Stage_p1.Variables, Beacon_Stage_p2.Variables, syscall_method = GeneratePE(beacon_PE, syscall_method, beacongate) + Beacon_Stage_p1.Variables, Beacon_Stage_p2.Variables, syscall_method = GeneratePE(beacon_PE, syscall_method, beacongate, eaf_bypass, rdll_use_syscalls, copy_pe_header, rdll_loader, transform_obfuscate, smartinject, sleep_mask) Process_Inject.Variables = GenerateProcessInject(processinject_min_alloc, injector) Beacon_GETPOST_Profile.Variables, Beacon_SSL.Variables = GenerateProfile(Profile, CDN, CDN_Value, cert_password, custom_cert, ProfilePath, Host) fmt.Println("[*] Building Profile...") @@ -322,7 +329,7 @@ func GenerateHTTPVaribles(Host, metadata, uri, customuri, customuriGET, customur return Beacon_GETPOST.Variables } -func GeneratePE(beacon_PE string, syscall_method string, beacongate string) (map[string]string, map[string]string, string) { +func GeneratePE(beacon_PE string, syscall_method string, beacongate string, eaf_bypass bool, rdll_use_syscalls bool, copy_pe_header bool, rdll_loader string, transform_obfuscate string, smartinject bool, sleep_mask bool) (map[string]string, map[string]string, string) { Beacon_Stage_p1 := &Beacon_Stage_p1{} Beacon_Stage_p1.Variables = make(map[string]string) @@ -341,11 +348,67 @@ func GeneratePE(beacon_PE string, syscall_method string, beacongate string) (map } else { log.Fatal("Error: Please provide a valid Syscall Method") } - + if rdll_loader == "PrependLoader" { + Beacon_Stage_p1.Variables["rdll_loader"] = "PrependLoader" + } else if rdll_loader == "StompLoader" { + Beacon_Stage_p1.Variables["rdll_loader"] = "StompLoader" + } else { + log.Fatal("Error: Please provide a valid Rdll Loader option") + } + // Set default value for eaf_bypass + if eaf_bypass == true { + Beacon_Stage_p1.Variables["eaf_bypass"] = "true" + } else { + Beacon_Stage_p1.Variables["eaf_bypass"] = "false" + } + if rdll_use_syscalls == true { + Beacon_Stage_p1.Variables["rdll_use_syscalls"] = "true" + } else { + Beacon_Stage_p1.Variables["rdll_use_syscalls"] = "false" + } + if copy_pe_header == true { + Beacon_Stage_p1.Variables["copy_pe_header"] = "true" + } else { + Beacon_Stage_p1.Variables["copy_pe_header"] = "false" + } + if smartinject == true { + Beacon_Stage_p1.Variables["smartinject"] = "true" + } else { + Beacon_Stage_p1.Variables["smartinject"] = "false" + } + if sleep_mask == true { + Beacon_Stage_p1.Variables["sleep_mask"] = "true" + } else { + Beacon_Stage_p1.Variables["sleep_mask"] = "false" + } gen_number, _ := strconv.Atoi(Utils.GenerateNumer(0, 6)) Beacon_Stage_p1.Variables["magic_mz_x64"] = Struct.Magic_PE[gen_number] Beacon_Stage_p1.Variables["magic_pe"] = strings.ToUpper(Utils.GenerateSingleValue(2)) + // Handle transform_obfuscate + if transform_obfuscate != "" { + // Split the transform_obfuscate string by commas + obfuscateMethods := strings.Split(transform_obfuscate, ",") + var formattedMethods []string + + for _, method := range obfuscateMethods { + method = strings.TrimSpace(method) + // Check if the method has a parameter (like rc4 "64") + if strings.Contains(method, " ") { + // Method with parameter + formattedMethods = append(formattedMethods, " "+method+";") + } else { + // Method without parameter + formattedMethods = append(formattedMethods, " "+method+";") + } + } + + // Join the methods with newlines + Beacon_Stage_p1.Variables["transform_obfuscate"] = "transform-obfuscate {\n" + strings.Join(formattedMethods, "\n") + "\n}" + } else { + Beacon_Stage_p1.Variables["transform_obfuscate"] = "" + } + if beacon_PE == "" { PE_Num, _ := strconv.Atoi(Utils.GenerateNumer(0, 30)) Beacon_Stage_p2.Variables["pe"] = Struct.Peclone_list[PE_Num] @@ -412,6 +475,7 @@ func GenerateProcessInject(processinject_min_alloc, injector string) map[string] } } Process_Inject.Variables["ThreadStartNum"] = Utils.GenerateNumer(500, 2500) + Process_Inject.Variables["ThreadStartNumv2"] = Utils.GenerateNumer(500, 2500) if injector == "NtMapViewOfSection" { Process_Inject.Variables["injector"] = injector } else if injector == "VirtualAllocEx" { diff --git a/Sample.yaml b/Sample.yaml index c82e4e4..f0ddb46 100644 --- a/Sample.yaml +++ b/Sample.yaml @@ -3,17 +3,17 @@ Host: "acme-email.com" Keystore: Password: Metadata: "netbios" -Injector: "VirtualAllocEx" +Injector: "NtMapViewOfSection" Outfile: "acme.profile" -PE_Clone: 20 +PE_Clone: 23 Profile: 2 Allocation: 5312 Jitter: 30 Debug: true Sleep: 35 Uri: 3 -Useragent: "Mac" -Post-EX Processname: 11 +Useragent: "Win10Edge" +Post-EX Processname: 8 Datajitter: 40 Keylogger: "SetWindowsHookEx" Customuri: @@ -29,4 +29,12 @@ CustomuriPOST: Forwarder: False TasksMaxSize: TasksProxyMaxSize: -TasksDnsProxyMaxSize: \ No newline at end of file +TasksDnsProxyMaxSize: +EafBypass: True +RdllUseSyscalls: True +CopyPEHeader: True +RdllLoader: "PrependLoader" +TransformObfuscate: "lznt1,xor \"32\"" +SmartInject: False +BeaconGate: "All" +SleepMask: False \ No newline at end of file diff --git a/SourcePoint.go b/SourcePoint.go index 248ed26..3d05dd3 100644 --- a/SourcePoint.go +++ b/SourcePoint.go @@ -44,6 +44,13 @@ type FlagOptions struct { threadspoof bool Yaml string beacongate string + eaf_bypass bool + rdll_use_syscalls bool + copy_pe_header bool + rdll_loader string + transform_obfuscate string + smartinject bool + sleep_mask bool } type conf struct { @@ -79,6 +86,13 @@ type conf struct { Httplib string `yaml:"Httplib"` Threadspoof bool `yaml:"ThreadSpoof"` BeaconGate string `yaml:"BeaconGate"` + EafBypass bool `yaml:"EafBypass"` + RdllUseSyscalls bool `yaml:"RdllUseSyscalls"` + Copy_PE_Header bool `yaml:"CopyPEHeader"` + RdllLoader string `yaml:"RdllLoader"` + TransformObfuscate string `yaml:"TransformObfuscate"` + SmartInject bool `yaml:"SmartInject"` + SleepMask bool `yaml:"SleepMask"` } func (c *conf) getConf(yamlfile string) *conf { @@ -201,8 +215,20 @@ func options() *FlagOptions { threadspoof := flag.Bool("ThreadSpoof", true, "Sets post-ex DLLs to spawn threads with a spoofed start address. These are generated randomly") Yaml := flag.String("Yaml", "", "Path to the Yaml config file") beacongate := flag.String("BeaconGate", "", "Specify beacon gate options (All, Comms, Core, Cleanup) or specific APIs") + eaf_bypass := flag.Bool("EafBypass", false, "Enable EAF Bypass") + rdll_use_syscalls := flag.Bool("RdllUseSyscalls", false, "Use Syscalls for Rdll") + copy_pe_header := flag.Bool("CopyPEHeader", false, "Copy PE Header") + rdll_loader := flag.String("RdllLoader", "PrependLoader", "Rdll Loader Options PrependLoader or StompLoader (Older method)") + transform_obfuscate := flag.String("TransformObfuscate", "", `Transform obfuscate options (comma-separated list): +[*] lznt1 +[*] rc4 "64" +[*] xor "32" +[*] base64 +Example: "lznt1,rc4 \"64\",xor \"32\",base64"`) + smartinject := flag.Bool("SmartInject", false, "Enable Smart Inject") + sleep_mask := flag.Bool("SleepMask", true, "Enable Sleep Mask") flag.Parse() - return &FlagOptions{stage: *stage, sleeptime: *sleeptime, jitter: *jitter, useragent: *useragent, uri: *uri, customuri: *customuri, customuriGET: *customuriGET, customuriPOST: *customuriPOST, beacon_PE: *beacon_PE, processinject_min_alloc: *processinject_min_alloc, Post_EX_Process_Name: *Post_EX_Process_Name, metadata: *metadata, injector: *injector, Host: *Host, Profile: *Profile, ProfilePath: *ProfilePath, outFile: *outFile, custom_cert: *custom_cert, cert_password: *cert_password, CDN: *CDN, CDN_Value: *CDN_Value, Yaml: *Yaml, Datajitter: *Datajitter, Keylogger: *Keylogger, Forwarder: *Forwarder, tasks_max_size: *tasks_max_size, tasks_proxy_max_size: *tasks_proxy_max_size, tasks_dns_proxy_max_size: *tasks_dns_proxy_max_size, syscall_method: *syscall_method, httplib: *httplib, threadspoof: *threadspoof, beacongate: *beacongate} + return &FlagOptions{stage: *stage, sleeptime: *sleeptime, jitter: *jitter, useragent: *useragent, uri: *uri, customuri: *customuri, customuriGET: *customuriGET, customuriPOST: *customuriPOST, beacon_PE: *beacon_PE, processinject_min_alloc: *processinject_min_alloc, Post_EX_Process_Name: *Post_EX_Process_Name, metadata: *metadata, injector: *injector, Host: *Host, Profile: *Profile, ProfilePath: *ProfilePath, outFile: *outFile, custom_cert: *custom_cert, cert_password: *cert_password, CDN: *CDN, CDN_Value: *CDN_Value, Yaml: *Yaml, Datajitter: *Datajitter, Keylogger: *Keylogger, Forwarder: *Forwarder, tasks_max_size: *tasks_max_size, tasks_proxy_max_size: *tasks_proxy_max_size, tasks_dns_proxy_max_size: *tasks_dns_proxy_max_size, syscall_method: *syscall_method, httplib: *httplib, threadspoof: *threadspoof, beacongate: *beacongate, eaf_bypass: *eaf_bypass, rdll_use_syscalls: *rdll_use_syscalls, copy_pe_header: *copy_pe_header, rdll_loader: *rdll_loader, transform_obfuscate: *transform_obfuscate, smartinject: *smartinject, sleep_mask: *sleep_mask} } @@ -253,7 +279,14 @@ func main() { opt.httplib = c.Httplib opt.threadspoof = c.Threadspoof opt.beacongate = c.BeaconGate + opt.eaf_bypass = c.EafBypass + opt.rdll_use_syscalls = c.RdllUseSyscalls + opt.copy_pe_header = c.Copy_PE_Header + opt.rdll_loader = c.RdllLoader + opt.transform_obfuscate = c.TransformObfuscate + opt.smartinject = c.SmartInject } + if opt.outFile == "" { log.Fatal("Error: Please provide a file name to save the profile into") } @@ -267,5 +300,5 @@ func main() { log.Fatal("Error: When using CustomuriGET/CustomuriPOST, both must be sepecified") } fmt.Println(c.TasksMaxSize) - Loader.GenerateOptions(opt.stage, opt.sleeptime, opt.jitter, opt.useragent, opt.uri, opt.customuri, opt.customuriGET, opt.customuriPOST, opt.beacon_PE, opt.processinject_min_alloc, opt.Post_EX_Process_Name, opt.metadata, opt.injector, opt.Host, opt.Profile, opt.ProfilePath, opt.outFile, opt.custom_cert, opt.cert_password, opt.CDN, opt.CDN_Value, opt.Datajitter, opt.Keylogger, opt.Forwarder, opt.tasks_max_size, opt.tasks_proxy_max_size, opt.tasks_dns_proxy_max_size, opt.syscall_method, opt.httplib, opt.threadspoof, opt.beacongate) + Loader.GenerateOptions(opt.stage, opt.sleeptime, opt.jitter, opt.useragent, opt.uri, opt.customuri, opt.customuriGET, opt.customuriPOST, opt.beacon_PE, opt.processinject_min_alloc, opt.Post_EX_Process_Name, opt.metadata, opt.injector, opt.Host, opt.Profile, opt.ProfilePath, opt.outFile, opt.custom_cert, opt.cert_password, opt.CDN, opt.CDN_Value, opt.Datajitter, opt.Keylogger, opt.Forwarder, opt.tasks_max_size, opt.tasks_proxy_max_size, opt.tasks_dns_proxy_max_size, opt.syscall_method, opt.httplib, opt.threadspoof, opt.beacongate, opt.eaf_bypass, opt.rdll_use_syscalls, opt.copy_pe_header, opt.rdll_loader, opt.transform_obfuscate, opt.smartinject, opt.sleep_mask) } diff --git a/Struct/Struct.go b/Struct/Struct.go index 7b5649e..df784ca 100644 --- a/Struct/Struct.go +++ b/Struct/Struct.go @@ -573,7 +573,7 @@ header "X-Via" "haproxy-www-w6k7";
- We strongly recommend enabling desktop notifications if you’ll be using Slack on this computer. + We strongly recommend enabling desktop notifications if you'll be using Slack on this computer. • • @@ -1321,7 +1321,7 @@ stage { set stomppe "true"; set cleanup "true"; set userwx "false"; - set smartinject "true"; + set smartinject "{{.Variables.smartinject}}"; beacon_gate { {{.Variables.beacongate}} } @@ -1333,7 +1333,12 @@ stage { #TCP and SMB beacons will obfuscate themselves while they wait for a new connection. #They will also obfuscate themselves while they wait to read information from their parent Beacon. - set sleep_mask "true"; + set sleep_mask {{.Variables.sleep_mask}}; + set eaf_bypass "{{.Variables.eaf_bypass}}"; + set rdll_use_syscalls "{{.Variables.rdll_use_syscalls}}"; + set copy_pe_header "{{.Variables.copy_pe_header}}"; + set rdll_loader "{{.Variables.rdll_loader}}"; + {{.Variables.transform_obfuscate}} ` } func Beacon_Stage_p2_Stuct() string { @@ -1582,6 +1587,7 @@ process-inject { # specify how we execute code in the remote process execute { + ObfSetThreadContext "ntdll!TpReleaseCleanupGroupMembers+0x{{.Variables.ThreadStartNumv2}}"; CreateThread "ntdll.dll!RtlUserThreadStart+0x{{.Variables.ThreadStartNum}}"; NtQueueApcThread-s; SetThreadContext;