mirror of
https://github.com/atomiczsec/Adrenaline
synced 2026-06-21 13:47:29 +00:00
upload existing repo to github
This commit is contained in:
atomiczsec
Binary file not shown.
|
After Width: | Height: | Size: 47 KiB |
@@ -0,0 +1,35 @@
|
||||
# Adrenaline BOF Kit
|
||||
<img src="https://github.com/atomiczsec/Adrenaline/blob/main/Assets/ADRENALINE.jpg" width="100%">
|
||||
|
||||
*This repository contains BOFs (Beacon Object Files) designed for various red team and offensive security engagements. The end goal is to have a toolkit of BOFs that we can run interchangeably when looking to orchestrate large scale recon or actions.*
|
||||
<div align='center'>
|
||||
|
||||
**BOF Description:**
|
||||
|
||||
**appnumberBOF:** Counts the number of installed applications via the registry, de-duplicates, and prints. Applied to large number of beacons we can see differences in app number quantity and infer certain things about that device.
|
||||
|
||||
**amsi-etw-ping-BOF:** Checks for AMSI and ETW presence in the current process by detecting loaded DLLs and ETW-related exports. Applied to large number of beacons, we will be able to pick targets that have less security activity.
|
||||
|
||||
|
||||
### Quick Reference
|
||||
|
||||
<a href='https://twitter.com/atomiczsec'>
|
||||
|
||||
<img src='https://img.shields.io/twitter/follow/atomiczsec?style=social'>
|
||||
|
||||
</a>
|
||||
|
||||
<a href='https://github.com/atomiczsec/My-Payloads/'>
|
||||
|
||||
</a>
|
||||
|
||||
<a href='https://github.com/atomiczsec/'>
|
||||
|
||||
<img src='https://img.shields.io/github/followers/atomiczsec?style=social'>
|
||||
|
||||
</a>
|
||||
</div>
|
||||
|
||||
|
||||
DISCLAIMER: The creators of this repository are not responsible for any harm or damage that may occur as a result of using the information or code provided in this repository.
|
||||
By accessing and using this repository, you acknowledge and agree that you do so at your own risk.
|
||||
@@ -0,0 +1,61 @@
|
||||
# Makefile for AMSI/ETW Ping BOF
|
||||
|
||||
CC_X64 ?= x86_64-w64-mingw32-gcc
|
||||
CC_X86 ?= i686-w64-mingw32-gcc
|
||||
|
||||
CFLAGS_COMMON := -c -Os -std=c99 \
|
||||
-fno-stack-protector -fno-stack-check -mno-stack-arg-probe \
|
||||
-fno-builtin -fno-builtin-memset -fno-builtin-memcpy -fno-builtin-memmove \
|
||||
-ffunction-sections -fdata-sections -nostdlib \
|
||||
-fno-asynchronous-unwind-tables -fno-unwind-tables -fno-ident \
|
||||
-Wall -Wextra -Wno-unused-parameter -Wno-unused-variable
|
||||
|
||||
CFLAGS_COMMON += -fno-leading-underscore -fno-ms-extensions
|
||||
|
||||
TARGET := amsi_etw_ping
|
||||
SOURCE := $(TARGET).c
|
||||
HEADERS := beacon.h
|
||||
|
||||
all: $(TARGET).x64.o $(TARGET).x86.o
|
||||
|
||||
$(TARGET).x64.o: $(SOURCE) $(HEADERS)
|
||||
$(CC_X64) $(CFLAGS_COMMON) -o $@ $<
|
||||
@echo "Built x64 BOF: $@"
|
||||
@echo "Checking symbols in $@..."
|
||||
@objdump -t $@ | grep -E "(GetModuleHandleW|GetProcAddress|KERNEL32$GetModuleHandleW|KERNEL32$GetProcAddress)" || echo "No problematic symbols found"
|
||||
|
||||
$(TARGET).x86.o: $(SOURCE) $(HEADERS)
|
||||
$(CC_X86) $(CFLAGS_COMMON) -o $@ $<
|
||||
@echo "Built x86 BOF: $@"
|
||||
@echo "Checking symbols in $@..."
|
||||
@objdump -t $@ | grep -E "(GetModuleHandleW|GetProcAddress|KERNEL32$GetModuleHandleW|KERNEL32$GetProcAddress)" || echo "No problematic symbols found"
|
||||
|
||||
|
||||
debug: $(TARGET).x64.o
|
||||
@echo "=== All symbols in $(TARGET).x64.o ==="
|
||||
@objdump -t $(TARGET).x64.o
|
||||
@echo "=== Relocations ==="
|
||||
@objdump -r $(TARGET).x64.o
|
||||
|
||||
|
||||
verbose: $(SOURCE) $(HEADERS)
|
||||
$(CC_X64) $(CFLAGS_COMMON) -v -o $(TARGET).x64.o $<
|
||||
|
||||
clean:
|
||||
rm -f *.o
|
||||
|
||||
info:
|
||||
@echo "AMSI/ETW Ping BOF Build System"
|
||||
@echo "Targets:"
|
||||
@echo " all - Build both x64 and x86 BOF objects"
|
||||
@echo " debug - Build x64 and show all symbols/relocations"
|
||||
@echo " verbose - Build with verbose compiler output"
|
||||
@echo " clean - Remove compiled objects"
|
||||
@echo " info - Show this help"
|
||||
@echo ""
|
||||
@echo "Requirements:"
|
||||
@echo " - MinGW-w64 cross-compiler (x86_64-w64-mingw32-gcc, i686-w64-mingw32-gcc)"
|
||||
@echo " - objdump (for symbol inspection)"
|
||||
@echo " - Output: COFF objects for Cobalt Strike BOF loading and COFFLoader"
|
||||
|
||||
.PHONY: all debug verbose clean info
|
||||
@@ -0,0 +1,11 @@
|
||||
# AMSI/ETW Ping BOF
|
||||
|
||||
## Summary
|
||||
|
||||
This Beacon Object File (BOF) checks for AMSI and ETW presence in the current process by detecting loaded DLLs (`clr.dll`, `coreclr.dll`, `System.Management.Automation.dll`) and ETW-related exports.
|
||||
|
||||
### Example Output
|
||||
|
||||
```
|
||||
CLR_DLL: true CORECLR_DLL: true PS_DLL: true ADVAPI_DLL: true EVENT_WRITE: true EVENT_FULL: true NTDLL_DLL: true ETW_WRITE: true ETW_FULL: false
|
||||
```
|
||||
@@ -0,0 +1,38 @@
|
||||
#include "beacon.h"
|
||||
|
||||
|
||||
static inline const char* yn(int b) { return b ? "Yes" : "No"; }
|
||||
|
||||
|
||||
static inline int has_export(LPCWSTR modW, LPCSTR nameA) {
|
||||
HMODULE m = KERNEL32$GetModuleHandleW(modW);
|
||||
if (!m) return FALSE;
|
||||
return KERNEL32$GetProcAddress(m, nameA) ? TRUE : FALSE;
|
||||
}
|
||||
|
||||
void go(char *args, unsigned long alen) {
|
||||
(void)args; (void)alen;
|
||||
|
||||
int amsi_dll = (KERNEL32$GetModuleHandleW(L"amsi.dll") != (HMODULE)0);
|
||||
int amsi_api = has_export(L"amsi.dll", "AmsiScanBuffer");
|
||||
|
||||
int clr_dll = (KERNEL32$GetModuleHandleW(L"clr.dll") != (HMODULE)0);
|
||||
int coreclr_dll = (KERNEL32$GetModuleHandleW(L"coreclr.dll") != (HMODULE)0);
|
||||
int ps_dll = (KERNEL32$GetModuleHandleW(L"System.Management.Automation.dll") != (HMODULE)0);
|
||||
|
||||
|
||||
int advapi_dll = (KERNEL32$GetModuleHandleW(L"advapi32.dll") != (HMODULE)0);
|
||||
int event_write = has_export(L"advapi32.dll", "EventWrite");
|
||||
int event_full = has_export(L"advapi32.dll", "EventWriteFull");
|
||||
|
||||
int ntdll_dll = (KERNEL32$GetModuleHandleW(L"ntdll.dll") != (HMODULE)0);
|
||||
int etw_write = has_export(L"ntdll.dll", "EtwEventWrite");
|
||||
int etw_full = has_export(L"ntdll.dll", "EtwEventWriteFull");
|
||||
|
||||
|
||||
BeaconPrintf(
|
||||
CALLBACK_OUTPUT,
|
||||
"AMSI_DLL=%s AMSI_API=%s CLR_DLL=%s CORECLR_DLL=%s PS_DLL=%s ADVAPI_DLL=%s EVENTWRITE=%s EVENTWRITEFULL=%s NTDLL_DLL=%s ETW_EVENTWRITE=%s ETW_EVENTWRITEFULL=%s",
|
||||
yn(amsi_dll), yn(amsi_api), yn(clr_dll), yn(coreclr_dll), yn(ps_dll), yn(advapi_dll), yn(event_write), yn(event_full), yn(ntdll_dll), yn(etw_write), yn(etw_full)
|
||||
);
|
||||
}
|
||||
Binary file not shown.
Binary file not shown.
@@ -0,0 +1,71 @@
|
||||
/*
|
||||
* Common BOF (Beacon Object File) Header
|
||||
* Provides standard Windows API declarations for BOF development
|
||||
* Compatible with Cobalt Strike BOF loader and COFFLoader
|
||||
*/
|
||||
|
||||
#ifndef BOF_COMMON_H
|
||||
#define BOF_COMMON_H
|
||||
|
||||
#ifndef DECLSPEC_IMPORT
|
||||
#define DECLSPEC_IMPORT __declspec(dllimport)
|
||||
#endif
|
||||
|
||||
#ifndef WINAPI
|
||||
#define WINAPI __stdcall
|
||||
#endif
|
||||
|
||||
// Basic Windows types
|
||||
typedef void* PVOID;
|
||||
typedef void* HANDLE;
|
||||
typedef void* HMODULE;
|
||||
typedef void* HINSTANCE;
|
||||
typedef void* FARPROC;
|
||||
typedef unsigned long DWORD;
|
||||
typedef unsigned short WORD;
|
||||
typedef unsigned char BYTE;
|
||||
typedef int BOOL;
|
||||
typedef char CHAR;
|
||||
typedef short SHORT;
|
||||
typedef long LONG;
|
||||
typedef unsigned short wchar_t;
|
||||
typedef wchar_t WCHAR;
|
||||
|
||||
// String types
|
||||
typedef const char* LPCSTR;
|
||||
typedef char* LPSTR;
|
||||
typedef const wchar_t* LPCWSTR;
|
||||
typedef wchar_t* LPWSTR;
|
||||
|
||||
// Constants
|
||||
#define TRUE 1
|
||||
#define FALSE 0
|
||||
#define NULL ((void*)0)
|
||||
|
||||
// Process/Thread types
|
||||
typedef struct _PROCESS_INFORMATION {
|
||||
HANDLE hProcess;
|
||||
HANDLE hThread;
|
||||
DWORD dwProcessId;
|
||||
DWORD dwThreadId;
|
||||
} PROCESS_INFORMATION;
|
||||
|
||||
// Beacon API declarations
|
||||
DECLSPEC_IMPORT void BeaconPrintf(int type, char *fmt, ...);
|
||||
DECLSPEC_IMPORT void BeaconOutput(int type, char *data, int len);
|
||||
|
||||
// Beacon callback types
|
||||
#define CALLBACK_OUTPUT 0x0
|
||||
#define CALLBACK_OUTPUT_OEM 0x1e
|
||||
#define CALLBACK_ERROR 0x0d
|
||||
#define CALLBACK_OUTPUT_UTF8 0x20
|
||||
|
||||
// Essential Windows API functions - BOF format with LIBRARY$ prefix
|
||||
DECLSPEC_IMPORT HMODULE WINAPI KERNEL32$GetModuleHandleW(LPCWSTR lpModuleName);
|
||||
DECLSPEC_IMPORT HMODULE WINAPI KERNEL32$GetModuleHandleA(LPCSTR lpModuleName);
|
||||
DECLSPEC_IMPORT FARPROC WINAPI KERNEL32$GetProcAddress(HMODULE hModule, LPCSTR lpProcName);
|
||||
DECLSPEC_IMPORT HMODULE WINAPI KERNEL32$LoadLibraryW(LPCWSTR lpLibFileName);
|
||||
DECLSPEC_IMPORT HMODULE WINAPI KERNEL32$LoadLibraryA(LPCSTR lpLibFileName);
|
||||
DECLSPEC_IMPORT BOOL WINAPI KERNEL32$FreeLibrary(HMODULE hLibModule);
|
||||
|
||||
#endif // BOF_COMMON_H
|
||||
@@ -0,0 +1,14 @@
|
||||
CC_x64=x86_64-w64-mingw32-gcc
|
||||
CC_x86=i686-w64-mingw32-gcc
|
||||
CFLAGS=-c -fno-builtin -fno-builtin-memset -fno-builtin-memcpy -fno-builtin-memmove -fno-asynchronous-unwind-tables -fno-unwind-tables -fno-stack-protector -fno-stack-check -mno-stack-arg-probe -Os
|
||||
|
||||
all: bof_implant.o bof_implant_x64.o
|
||||
|
||||
bof_implant.o: bof_implant.c
|
||||
$(CC_x86) $(CFLAGS) -o $@ $<
|
||||
|
||||
bof_implant_x64.o: bof_implant.c
|
||||
$(CC_x64) $(CFLAGS) -o $@ $<
|
||||
|
||||
clean:
|
||||
rm -f *.o
|
||||
@@ -0,0 +1,14 @@
|
||||
# Count Installed Applications BOF
|
||||
|
||||
## Summary
|
||||
|
||||
This Beacon Object File (BOF) enumerates installed applications by querying the number of subkeys under `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall` in the Windows Registry and returns the total count.
|
||||
|
||||
### Example Output
|
||||
|
||||
```
|
||||
[*] Tasked beacon to run BOF
|
||||
[+] host called home, sent: 10 bytes
|
||||
[+] received output:
|
||||
Found 123 installed applications.
|
||||
```
|
||||
Binary file not shown.
Binary file not shown.
@@ -0,0 +1,115 @@
|
||||
#define WIN32_LEAN_AND_MEAN
|
||||
#include <windows.h>
|
||||
#include "beacon.h"
|
||||
|
||||
DECLSPEC_IMPORT LSTATUS ADVAPI32$RegOpenKeyExA(HKEY, LPCSTR, DWORD, REGSAM, PHKEY);
|
||||
DECLSPEC_IMPORT LSTATUS ADVAPI32$RegQueryInfoKeyA(HKEY, LPSTR, LPDWORD, LPDWORD, LPDWORD, LPDWORD, LPDWORD, LPDWORD, LPDWORD, LPDWORD, LPDWORD, PFILETIME);
|
||||
DECLSPEC_IMPORT LSTATUS ADVAPI32$RegCloseKey(HKEY);
|
||||
DECLSPEC_IMPORT LSTATUS ADVAPI32$RegEnumKeyExA(HKEY, DWORD, LPSTR, LPDWORD, LPDWORD, LPSTR, LPDWORD, PFILETIME);
|
||||
DECLSPEC_IMPORT LSTATUS ADVAPI32$RegQueryValueExA(HKEY, LPCSTR, LPDWORD, LPDWORD, LPBYTE, LPDWORD);
|
||||
|
||||
|
||||
static unsigned long hash_string(const char *s) {
|
||||
unsigned long h = 5381;
|
||||
unsigned int i = 0;
|
||||
unsigned char c = 0;
|
||||
if (s == 0) return 0;
|
||||
while (i < 1024) {
|
||||
c = (unsigned char)s[i++];
|
||||
if (c == '\0') break;
|
||||
h = ((h << 5) + h) + c;
|
||||
}
|
||||
return h;
|
||||
}
|
||||
|
||||
void go(char *args, unsigned long alen) {
|
||||
HKEY hKey;
|
||||
LPCSTR lpSubKey = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall";
|
||||
DWORD dwSubKeys = 0;
|
||||
LONG lStatus;
|
||||
|
||||
lStatus = ADVAPI32$RegOpenKeyExA(
|
||||
HKEY_LOCAL_MACHINE,
|
||||
lpSubKey,
|
||||
0,
|
||||
KEY_READ,
|
||||
&hKey
|
||||
);
|
||||
|
||||
if (lStatus != ERROR_SUCCESS) {
|
||||
BeaconPrintf(CALLBACK_ERROR, "Failed to open registry key: HKLM\\%s. Error code: %ld", lpSubKey, lStatus);
|
||||
ADVAPI32$RegCloseKey(hKey);
|
||||
return;
|
||||
}
|
||||
|
||||
lStatus = ADVAPI32$RegQueryInfoKeyA(
|
||||
hKey,
|
||||
NULL,
|
||||
NULL,
|
||||
NULL,
|
||||
&dwSubKeys,
|
||||
NULL,
|
||||
NULL,
|
||||
NULL,
|
||||
NULL,
|
||||
NULL,
|
||||
NULL,
|
||||
NULL
|
||||
);
|
||||
|
||||
if (lStatus != ERROR_SUCCESS) {
|
||||
BeaconPrintf(CALLBACK_ERROR, "Failed to query registry key info. Error code: %ld", lStatus);
|
||||
ADVAPI32$RegCloseKey(hKey);
|
||||
return;
|
||||
}
|
||||
|
||||
// de-duplication by counting unique DisplayName values
|
||||
{
|
||||
#define MAX_TRACKED 256
|
||||
unsigned long seenHashes[MAX_TRACKED];
|
||||
DWORD seenCount = 0;
|
||||
DWORD uniqueCount = 0;
|
||||
|
||||
for (DWORD i = 0; i < dwSubKeys; i++) {
|
||||
char subKeyName[256];
|
||||
DWORD subKeyLen = sizeof(subKeyName);
|
||||
if (ADVAPI32$RegEnumKeyExA(hKey, i, subKeyName, &subKeyLen, NULL, NULL, NULL, NULL) != ERROR_SUCCESS) {
|
||||
continue;
|
||||
}
|
||||
|
||||
HKEY hApp = NULL;
|
||||
if (ADVAPI32$RegOpenKeyExA(hKey, subKeyName, 0, KEY_READ, &hApp) != ERROR_SUCCESS) {
|
||||
uniqueCount++;
|
||||
continue;
|
||||
}
|
||||
|
||||
char displayName[512];
|
||||
DWORD type = 0;
|
||||
DWORD nameSize = sizeof(displayName);
|
||||
displayName[0] = '\0';
|
||||
LSTATUS q = ADVAPI32$RegQueryValueExA(hApp, "DisplayName", NULL, &type, (LPBYTE)displayName, &nameSize);
|
||||
ADVAPI32$RegCloseKey(hApp);
|
||||
|
||||
if (q != ERROR_SUCCESS || displayName[0] == '\0') {
|
||||
uniqueCount++;
|
||||
continue;
|
||||
}
|
||||
|
||||
unsigned long h = hash_string(displayName);
|
||||
int found = 0;
|
||||
for (DWORD j = 0; j < seenCount; j++) {
|
||||
if (seenHashes[j] == h) { found = 1; break; }
|
||||
}
|
||||
if (!found) {
|
||||
if (seenCount < MAX_TRACKED) {
|
||||
seenHashes[seenCount++] = h;
|
||||
}
|
||||
uniqueCount++;
|
||||
}
|
||||
}
|
||||
|
||||
BeaconPrintf(CALLBACK_OUTPUT, "Number of applications installed: %lu", (unsigned long)uniqueCount);
|
||||
}
|
||||
|
||||
ADVAPI32$RegCloseKey(hKey);
|
||||
}
|
||||
@@ -0,0 +1,69 @@
|
||||
/*
|
||||
* Beacon Object Files (BOF)
|
||||
* -------------------------
|
||||
* A Beacon Object File is a light-weight post exploitation tool that runs
|
||||
* with Beacon's inline-execute command.
|
||||
*
|
||||
* Additional BOF resources are available here:
|
||||
* - https://github.com/Cobalt-Strike/bof_template
|
||||
*
|
||||
* Cobalt Strike 4.x
|
||||
* ChangeLog:
|
||||
* 1/25/2022: updated for 4.5
|
||||
*/
|
||||
|
||||
/* data API */
|
||||
typedef struct {
|
||||
char * original; /* the original buffer [so we can free it] */
|
||||
char * buffer; /* current pointer into our buffer */
|
||||
int length; /* remaining length of data */
|
||||
int size; /* total size of this buffer */
|
||||
} datap;
|
||||
|
||||
DECLSPEC_IMPORT void BeaconDataParse(datap * parser, char * buffer, int size);
|
||||
DECLSPEC_IMPORT char * BeaconDataPtr(datap * parser, int size);
|
||||
DECLSPEC_IMPORT int BeaconDataInt(datap * parser);
|
||||
DECLSPEC_IMPORT short BeaconDataShort(datap * parser);
|
||||
DECLSPEC_IMPORT int BeaconDataLength(datap * parser);
|
||||
DECLSPEC_IMPORT char * BeaconDataExtract(datap * parser, int * size);
|
||||
|
||||
/* format API */
|
||||
typedef struct {
|
||||
char * original; /* the original buffer [so we can free it] */
|
||||
char * buffer; /* current pointer into our buffer */
|
||||
int length; /* remaining length of data */
|
||||
int size; /* total size of this buffer */
|
||||
} formatp;
|
||||
|
||||
DECLSPEC_IMPORT void BeaconFormatAlloc(formatp * format, int maxsz);
|
||||
DECLSPEC_IMPORT void BeaconFormatReset(formatp * format);
|
||||
DECLSPEC_IMPORT void BeaconFormatAppend(formatp * format, char * text, int len);
|
||||
DECLSPEC_IMPORT void BeaconFormatPrintf(formatp * format, char * fmt, ...);
|
||||
DECLSPEC_IMPORT char * BeaconFormatToString(formatp * format, int * size);
|
||||
DECLSPEC_IMPORT void BeaconFormatFree(formatp * format);
|
||||
DECLSPEC_IMPORT void BeaconFormatInt(formatp * format, int value);
|
||||
|
||||
/* Output Functions */
|
||||
#define CALLBACK_OUTPUT 0x0
|
||||
#define CALLBACK_OUTPUT_OEM 0x1e
|
||||
#define CALLBACK_OUTPUT_UTF8 0x20
|
||||
#define CALLBACK_ERROR 0x0d
|
||||
|
||||
DECLSPEC_IMPORT void BeaconOutput(int type, char * data, int len);
|
||||
DECLSPEC_IMPORT void BeaconPrintf(int type, char * fmt, ...);
|
||||
|
||||
|
||||
/* Token Functions */
|
||||
DECLSPEC_IMPORT BOOL BeaconUseToken(HANDLE token);
|
||||
DECLSPEC_IMPORT void BeaconRevertToken();
|
||||
DECLSPEC_IMPORT BOOL BeaconIsAdmin();
|
||||
|
||||
/* Spawn+Inject Functions */
|
||||
DECLSPEC_IMPORT void BeaconGetSpawnTo(BOOL x86, char * buffer, int length);
|
||||
DECLSPEC_IMPORT void BeaconInjectProcess(HANDLE hProc, int pid, char * payload, int p_len, int p_offset, char * arg, int a_len);
|
||||
DECLSPEC_IMPORT void BeaconInjectTemporaryProcess(PROCESS_INFORMATION * pInfo, char * payload, int p_len, int p_offset, char * arg, int a_len);
|
||||
DECLSPEC_IMPORT BOOL BeaconSpawnTemporaryProcess(BOOL x86, BOOL ignoreToken, STARTUPINFO * si, PROCESS_INFORMATION * pInfo);
|
||||
DECLSPEC_IMPORT void BeaconCleanupProcess(PROCESS_INFORMATION * pInfo);
|
||||
|
||||
/* Utility Functions */
|
||||
DECLSPEC_IMPORT BOOL toWideChar(char * src, wchar_t * dst, int max);
|
||||
Reference in New Issue
Block a user