admin/boku7-BokuLoader
1
0
Fork 0
mirror of https://github.com/boku7/BokuLoader/ synced 2026-06-06 15:24:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update README.md

Browse Source
This commit is contained in:
Bobby Cooke
2023-03-02 13:55:27 -07:00
committed by GitHub
parent 1c3b0e2291
commit cbb2802cc6
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+3 -3
View File
@@ -1,5 +1,5 @@
# BokuLoader : Cobalt Strike Reflective Loader
A proof-of-concept [User-Defined Reflective Loader (UDRL)](https://hstechdocs.helpsystems.com/manuals/cobaltstrike/current/userguide/content/topics/malleable-c2-extend_user-defined-rdll.htm) which aims to recreate, integrate, and enhance Cobalt Strike's evasion features for x64 HTTP/S beacons!
A proof-of-concept [User-Defined Reflective Loader (UDRL)](https://hstechdocs.helpsystems.com/manuals/cobaltstrike/current/userguide/content/topics/malleable-c2-extend_user-defined-rdll.htm) which aims to recreate, integrate, and enhance Cobalt Strike's evasion features!
#### Contributors:
+ [Bobby Cooke @0xBoku](https://twitter.com/0xBoku)
@@ -40,8 +40,8 @@ _Before using this project, in any form, you should properly test the evasion fe
|`cleanup`|true|Supported via CS integration
|`userwx`|true/false|Supported via BokuLoader implementation
|`sleep_mask`|(true/false) or (Sleepmask Kit+true)|Supported. When using default "sleepmask true" (without sleepmask kit) set "userwx true". When using sleepmask kit which supports RX beacon.text memory (`src47/Ekko`) set "sleepmask true" && "userwx false".
|`magic_mz_x64`|4 char string|`BokuLoader.cna` Aggressor script modification
|`magic_pe`|2 char string|`BokuLoader.cna` Aggressor script modification
|`magic_mz_x64`|4 char string|Supported via CS integration
|`magic_pe`|2 char string|Supported via CS integration
|`transform-x64 prepend`|escaped hex string|`BokuLoader.cna` Aggressor script modification
|`transform-x64 strrep`|string string|`BokuLoader.cna` Aggressor script modification
|`stomppe`|true/false|Unsupported. BokuLoader does not copy beacon DLL headers over. First `0x1000` bytes of virtual beacon DLL are `0x00`