admin/boku7-BokuLoader
1
0
Fork 0
mirror of https://github.com/boku7/BokuLoader/ synced 2026-06-06 15:24:27 +00:00
Code Issues Packages Projects Releases Wiki Activity
368 Commits 2 Branches 0 Tags
966ea3058c7dc46150799b614128e4c4c9294d2a
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Bobby Cooke 966ea3058c Merge pull request #33 from 0xbad53c/main 
Add strreps for SMB, TCP and DNS
 2023-11-22 15:25:50 -07:00
Bobby Cooke 553e6e6665 Merge from susMdT/main - Dylan Tran 
Implement find_api_return_address_on_stack to find thread start frame…
 2023-10-11 17:04:32 -07:00
Bobby Cooke 0c491b0555 Reflective Callstack Spoofing - Dylan Tran 
Reflective Callstack Spoofing - co-author Dylan Tran
 2023-10-06 10:06:07 -07:00
Bobby Cooke b4c81489d6 Reflective Callstack Spoofing - Dylan Tran 
Synthetic call stack spoofing added.
 2023-10-06 09:40:04 -07:00
Bobby Cooke d641dc47d6 Merge pull request #28 from ScriptIdiot/main 
Support indirect syscall
 2023-10-06 09:23:38 -07:00
Bobby Cooke 88bbfda41e Delete bokuloaderbanner.png 2023-03-15 17:38:48 -07:00
Bobby Cooke 0f6febfcaf Add files via upload 2023-03-15 17:38:39 -07:00
Bobby Cooke 4eda1185c2 Update README.md 2023-03-15 17:38:19 -07:00
Bobby Cooke 50295d3de4 Update README.md 2023-03-15 17:36:05 -07:00
Bobby Cooke 0eb8553b7d Update README.md 2023-03-15 17:35:46 -07:00
Bobby Cooke 8e4455d5de Delete bl_banner.png 2023-03-15 17:35:32 -07:00
Bobby Cooke 37c42948ca Add files via upload 2023-03-15 17:35:24 -07:00
Bobby Cooke b78cf1746b Delete banner.png 2023-03-15 17:22:02 -07:00
Bobby Cooke ac8ce95e1b Add files via upload 2023-03-15 17:21:52 -07:00
Bobby Cooke fd3741f322 Update README.md 2023-03-15 17:21:26 -07:00
Bobby Cooke 62120b3c84 Add files via upload 2023-03-15 17:20:39 -07:00
Bobby Cooke 2cc91e7c24 Add files via upload 2023-03-15 17:17:58 -07:00
Bobby Cooke b85878131d Update README.md 2023-03-15 17:09:00 -07:00
Bobby Cooke 1577518522 Add files via upload 2023-03-15 17:08:08 -07:00
Bobby Cooke 0f278bdbb3 Update README.md 2023-03-05 19:42:58 -07:00
Bobby Cooke 70755870fa Update README.md 2023-03-05 19:35:06 -07:00
Bobby Cooke c32b367431 Update README.md 2023-03-03 08:22:59 -07:00
Bobby Cooke 7a5d985929 Merge pull request #23 from xforcered/main 
IAT Hooking functionality added, Fixed bugs
 2023-03-03 06:18:17 -07:00
Bobby Cooke 1d61c810bb IAT Hooking functionality added, Fixed bugs 
Added IAT hooking functionality to support future planned feature releases. Currently non-default Kernel32.Sleep hook poc added to sleep with ZwDelayExecution direct syscall (experimental). Fixed issues with stack frames and stack alignment that happened on some builds - Shoutout to @ilove2pwn_ @C5pider @kyleavery_
 2023-03-03 06:17:42 -07:00
Bobby Cooke 0aa215a0ec Add files via upload 2023-03-03 06:12:54 -07:00
Bobby Cooke fd30ec40bc Update BokuLoader.cna 2023-03-02 18:00:26 -07:00
Bobby Cooke 641b34dd63 Merge pull request #22 from xforcered/main 
Update README.md
 2023-03-02 15:01:50 -07:00
Bobby Cooke 2395cb8447 Update README.md 2023-03-02 15:01:32 -07:00
Bobby Cooke cbb2802cc6 Update README.md 2023-03-02 13:55:27 -07:00
Bobby Cooke 1c3b0e2291 Update BokuLoader.c 2023-03-02 13:16:31 -07:00
Bobby Cooke 49f24bc660 Add files via upload 2023-03-02 13:15:56 -07:00
Bobby Cooke 52c5984451 Update README.md 2023-03-02 06:25:22 -07:00
Bobby Cooke fae45e63df Update README.md 2023-03-02 06:23:15 -07:00
Bobby Cooke d4b72073ae Update BokuLoader.cna 2023-03-02 06:21:26 -07:00
Bobby Cooke d193d3765a Added support for x64 Pivot beacon obfuscation 
Experimental feature in testing. Test to ensure it is working correctly.
 2023-02-27 17:15:11 -07:00
Bobby Cooke 434ed2ac85 Update README.md 2023-02-26 16:09:01 -07:00
Bobby Cooke 288123c6c6 Update README.md 2023-02-26 16:08:09 -07:00
Bobby Cooke 902ddee18e Update README.md 2023-02-24 19:48:20 -07:00
Bobby Cooke 944aab5874 UseRWX & Default Sleepmask (no kit) Support Added 
Added support for malleable PE "set userwx" option. When using default "sleepmask true" (without sleepmask kit), you will need to set "userwx" to "true" to avoid writing to non-writable beacon.text memory. When using sleepmask kit which supports RX beacon.text memory, set "sleepmask true" && "userwx false".
 2023-02-24 16:10:39 -07:00
Bobby Cooke 9426671f26 Update README.md 2023-02-24 16:07:34 -07:00
Bobby Cooke 301b03386d UseRWX & Default Sleepmask (no kit) Support Added 
Added support for malleable PE "set userwx" option. When using default "sleepmask true" (without sleepmask kit), you will need to set "userwx" to "true" to avoid writing to non-writable beacon.text memory. When using sleepmask kit which supports RX beacon.text memory, set "sleepmask true" && "userwx false".
 2023-02-24 16:02:08 -07:00
Bobby Cooke 9fcdb56a45 UseRWX & Default Sleepmask (no kit) Support Added 
Added support for malleable PE "set userwx" option. When using default "sleepmask true" (without sleepmask kit), you will need to set "userwx" to "true" to avoid writing to non-writable beacon.text memory. When using sleepmask kit which supports RX beacon.text memory, set "sleepmask true" && "userwx false".
 2023-02-24 15:57:52 -07:00
Bobby Cooke ea2b0255c0 UseRWX & Default Sleepmask (no kit) Support Added 
Added support for malleable PE "set userwx" option. When using default "sleepmask true" (without sleepmask kit), you will need to set "userwx" to "true" to avoid writing to non-writable beacon.text memory. When using sleepmask kit which supports RX beacon.text memory, set "sleepmask true" && "userwx false".
 2023-02-24 14:46:40 -07:00
Bobby Cooke 5f35cf48db UseRWX & Default Sleepmask (no kit) Support Added 
Added support for malleable PE "set userwx" option. When using default "sleepmask true" (without sleepmask kit), you will need to set "userwx" to "true" to avoid writing to non-writable beacon.text memory. When using sleepmask kit which supports RX beacon.text memory, set "sleepmask true" && "userwx false".
 2023-02-24 14:45:20 -07:00
Bobby Cooke 2f8187f9c8 UseRWX & Default Sleepmask (no kit) Support Added 
Added support for malleable PE "set userwx" option. When using default "sleepmask true" (without sleepmask kit), you will need to set "userwx" to "true" to avoid writing to non-writable beacon.text memory. When using sleepmask kit which supports RX beacon.text memory, set "sleepmask true" && "userwx false".
 2023-02-24 14:43:18 -07:00
Bobby Cooke a4f3581bbb UseRWX & Default Sleepmask (no kit) Support Added 
Added support for malleable PE "set userwx" option. When using default "sleepmask true" (without sleepmask kit), you will need to set "userwx" to "true" to avoid writing to non-writable beacon.text memory. When using sleepmask kit which supports RX beacon.text memory, set "sleepmask true" && "userwx false".
 2023-02-24 14:38:27 -07:00
Bobby Cooke 5f7dc3f0a2 UseRWX & Default Sleepmask (no kit) Support Added 
Added support for malleable PE "set userwx" option. When using default "sleepmask true" (without sleepmask kit), you will need to set "userwx" to "true" to avoid writing to non-writable beacon.text memory. When using sleepmask kit which supports RX beacon.text memory, set "sleepmask true" && "userwx false".
 2023-02-24 14:33:39 -07:00
Bobby Cooke e713afe57e UseRWX & Default Sleepmask (no kit) Support Added 
Added support for malleable PE "set userwx" option. When using default "sleepmask true" (without sleepmask kit), you will need to set "userwx" to "true" to avoid writing to non-writable beacon.text memory. When using sleepmask kit which supports RX beacon.text memory, set "sleepmask true" && "userwx false".
 2023-02-24 14:24:46 -07:00
Bobby Cooke 339146687d UseRWX & Default Sleepmask (no kit) Support Added 
Added support for malleable PE "set userwx" option. When using default "sleepmask true" (without sleepmask kit), you will need to set "userwx" to "true" to avoid writing to non-writable beacon.text memory. When using sleepmask kit which supports RX beacon.text memory, set "sleepmask true" && "userwx false".
 2023-02-24 12:38:37 -07:00
Bobby Cooke 5fece6670b UseRWX & Default Sleepmask (no kit) Support Added 
Added support for malleable PE "set userwx" option. When using default "sleepmask true" (without sleepmask kit), you will need to set "userwx" to "true" to avoid writing to non-writable beacon.text memory. When using sleepmask kit which supports RX beacon.text memory, set "sleepmask true" && "userwx false".
 2023-02-24 09:31:45 -07:00
Bobby Cooke 3356b6c526 Merge pull request #20 from xforcered/main 
UseRWX & Default Sleepmask (no kit) Support Added
 2023-02-24 09:30:03 -07:00
Bobby Cooke b6b86b0771 UseRWX & Default Sleepmask (no kit) Support Added 
Added support for malleable PE "set userwx" option. When using default "sleepmask true" (without sleepmask kit), you will need to set "userwx" to "true" to avoid writing to non-writable beacon.text memory. When using sleepmask kit which supports RX beacon.text memory, set "sleepmask true" && "userwx false".
 2023-02-24 09:29:46 -07:00
Bobby Cooke 206894c09a UseRWX & Default Sleepmask (no kit) Support Added 
Added support for malleable PE "set userwx" option. When using default "sleepmask true" (without sleepmask kit), you will need to set "userwx" to "true" to avoid writing to non-writable beacon.text memory. When using sleepmask kit which supports RX beacon.text memory, set "sleepmask true" && "userwx false".
 2023-02-24 09:28:37 -07:00
Bobby Cooke 7f2b86b5c7 UseRWX & Default Sleepmask (no kit) Support Added 
Added support for malleable PE "set userwx" option. When using default "sleepmask true" (without sleepmask kit), you will need to set "userwx" to "true" to avoid writing to non-writable beacon.text memory. When using sleepmask kit which supports RX beacon.text memory, set "sleepmask true" && "userwx false".
 2023-02-24 09:18:22 -07:00
Bobby Cooke 256f7b4b1c Update BokuLoader.cna 2023-02-24 09:08:37 -07:00
Bobby Cooke e1dc099c04 UseRWX & Default Sleepmask (no kit) Support Added 
Added support for malleable PE "set userwx" option. When using default "sleepmask true" (without sleepmask kit), you will need to set "userwx" to "true" to avoid writing to non-writable beacon.text memory. When using sleepmask kit which supports RX beacon.text memory, set "sleepmask true" && "userwx false".
 2023-02-24 08:56:10 -07:00
Bobby Cooke 574c0c293d Update README.md 2023-02-24 08:51:20 -07:00
Bobby Cooke a70b24385d UseRWX & Default Sleepmask (no kit) Support Added 
Added support for malleable PE "set userwx" option. When using default "sleepmask true" (without sleepmask kit), you will need to set "userwx" to "true" to avoid writing to non-writable beacon.text memory. When using sleepmask kit which supports RX beacon.text memory, set "sleepmask true" && "userwx false".
 2023-02-24 08:48:00 -07:00
Bobby Cooke d8c6e80c40 UseRWX & Default Sleepmask (no kit) Support Added 
Added support for malleable PE "set userwx" option. When using default "sleepmask true" (without sleepmask kit), you will need to set "userwx" to "true" to avoid writing to non-writable beacon.text memory. When using sleepmask kit which supports RX beacon.text memory, set "sleepmask true" && "userwx false".
 2023-02-24 08:38:29 -07:00
Bobby Cooke 98d0f95918 RWX supported 
Added support for malleable PE "set userwx" option. When using default "sleepmask true" (without sleepmask kit), you will need to set "userwx" to "true" to avoid writing to non-writable beacon.text memory. When using sleepmask kit which supports RX beacon.text memory, set "sleepmask true" && "userwx false".
 2023-02-24 08:35:28 -07:00
Bobby Cooke 7048cc5a29 Add files via upload 2023-02-24 08:32:16 -07:00
Bobby Cooke 70a814e66f Merge pull request #19 from xforcered/main 
fix readme
 2023-02-24 07:51:24 -07:00
Bobby Cooke cef1c1a6da Update README.md 2023-02-24 07:50:55 -07:00
Bobby Cooke 4826288330 Update README.md 2023-02-24 07:50:13 -07:00
Bobby Cooke 0dcd44b707 Update README.md 2023-02-24 07:23:25 -07:00
Bobby Cooke d75cb363de Update README.md 2023-02-24 07:17:13 -07:00
Bobby Cooke 6cde93243a Update README.md 2023-02-24 07:14:17 -07:00
Bobby Cooke 75690173a5 Merge pull request #18 from boku7/add-license-1 
Create LICENSE.md
 2023-02-24 06:47:09 -07:00
Bobby Cooke ffc876cec0 Create LICENSE.md 2023-02-24 06:46:55 -07:00
Bobby Cooke 81be693559 Update README.md 2023-02-24 06:43:11 -07:00
Bobby Cooke 5dc84c2ea8 Update README.md 2023-02-24 06:42:52 -07:00
Bobby Cooke a38c5551ca Update README.md 2023-02-23 08:46:23 -07:00
Bobby Cooke c6d67d6669 DLL Module Stomping & All Allocators supported! 
All beacon memory allocators are now supported and they are pulled from the C2 malleable profile! DLL Module Stomping, HeapAlloc, MapViewOfFile, VirtualAlloc(NtAlloc via direct syscall).
Additionally the Export Directory of the raw beacon DLL is zero'd out as there is no use for it and it contains known IOC's like "ReflectiveLoader" function name export.
set entry_point supported.
 2023-02-22 17:36:52 -07:00
Bobby Cooke 11bc4aa814 DLL Module Stomping & All Allocators supported! 
All beacon memory allocators are now supported and they are pulled from the C2 malleable profile! DLL Module Stomping, HeapAlloc, MapViewOfFile, VirtualAlloc(NtAlloc via direct syscall).
Additionally the Export Directory of the raw beacon DLL is zero'd out as there is no use for it and it contains known IOC's like "ReflectiveLoader" function name export.
set entry_point supported.
 2023-02-22 17:34:43 -07:00
Bobby Cooke 2410e3b2b3 DLL Module Stomping & All Allocators supported! 
All beacon memory allocators are now supported and they are pulled from the C2 malleable profile! DLL Module Stomping, HeapAlloc, MapViewOfFile, VirtualAlloc(NtAlloc via direct syscall).
Additionally the Export Directory of the raw beacon DLL is zero'd out as there is no use for it and it contains known IOC's like "ReflectiveLoader" function name export.
 2023-02-22 17:33:36 -07:00
Bobby Cooke 5d88bb8252 Update BokuLoader.h 2023-02-22 17:32:56 -07:00
Bobby Cooke d38f183954 Update BokuLoader.c 2023-02-22 17:32:35 -07:00
Bobby Cooke 5f63d7dbe0 DLL Module Stomping & All Allocators supported! 
All beacon memory allocators are now supported and they are pulled from the C2 malleable profile! DLL Module Stomping, HeapAlloc, MapViewOfFile, VirtualAlloc(NtAlloc via direct syscall).
Additionally the Export Directory of the raw beacon DLL is zero'd out as there is no use for it and it contains known IOC's like "ReflectiveLoader" function name export.
 2023-02-22 16:03:23 -07:00
Bobby Cooke 88227477a5 DLL Module Stomping & All Allocators supported! 
All beacon memory allocators are now supported and they are pulled from the C2 malleable profile! DLL Module Stomping, HeapAlloc, MapViewOfFile, VirtualAlloc(NtAlloc via direct syscall).
Additionally the Export Directory of the raw beacon DLL is zero'd out as there is no use for it and it contains known IOC's like "ReflectiveLoader" function name export.
 2023-02-22 10:44:37 -07:00
Bobby Cooke 895884e933 DLL Module Stomping & All Allocators supported! 
All beacon memory allocators are now supported and they are pulled from the C2 malleable profile! DLL Module Stomping, HeapAlloc, MapViewOfFile, VirtualAlloc(NtAlloc via direct syscall).
Additionally the Export Directory of the raw beacon DLL is zero'd out as there is no use for it and it contains known IOC's like "ReflectiveLoader" function name export.
 2023-02-22 10:36:15 -07:00
Bobby Cooke 868ee17a71 DLL Module Stomping & All Allocators supported! 
All beacon memory allocators are now supported and they are pulled from the C2 malleable profile! DLL Module Stomping, HeapAlloc, MapViewOfFile, VirtualAlloc(NtAlloc via direct syscall).
Additionally the Export Directory of the raw beacon DLL is zero'd out as there is no use for it and it contains known IOC's like "ReflectiveLoader" function name export.
 2023-02-22 10:02:14 -07:00
Bobby Cooke a0c7aec9f1 DLL Module Stomping & All Allocators supported! 
All beacon memory allocators are now supported and they are pulled from the C2 malleable profile! DLL Module Stomping, HeapAlloc, MapViewOfFile,VirtualAlloc(NtAlloc via direct syscall)
 2023-02-22 09:53:17 -07:00
Bobby Cooke 1b1fe2f8c7 Delete BokuLoader.h 2023-02-22 09:52:43 -07:00
Bobby Cooke 1eb823a541 Delete BokuLoader.c 2023-02-22 09:52:38 -07:00
Bobby Cooke d7b948715c Delete BokuLoader.h 2023-02-22 09:52:31 -07:00
Bobby Cooke 8422552a2e Delete BokuLoader.c 2023-02-22 09:52:26 -07:00
Bobby Cooke cc81f989cf DLL Module Stomping & All Allocators supported! 
All beacon memory allocators are now supported and they are pulled from the C2 malleable profile! DLL Module Stomping, HeapAlloc, MapViewOfFile, VirtualAlloc(NtAlloc via direct syscall).
Additionally the Export Directory of the raw beacon DLL is zero'd out as there is no use for it and it contains known IOC's like "ReflectiveLoader" function name export.
 2023-02-22 09:47:07 -07:00
Bobby Cooke ae9d257372 DLL Module Stomping & All Allocators supported! 
All beacon memory allocators are now supported and they are pulled from the C2 malleable profile! DLL Module Stomping, HeapAlloc, MapViewOfFile, VirtualAlloc(NtAlloc via direct syscall).
Additionally the Export Directory of the raw beacon DLL is zero'd out as there is no use for it and it contains known IOC's like "ReflectiveLoader" function name export.
 2023-02-22 09:43:49 -07:00
Bobby Cooke dc98d22f05 DLL Module Stomping & All Allocators supported! 
All beacon memory allocators are now supported and they are pulled from the C2 malleable profile! DLL Module Stomping, HeapAlloc, MapViewOfFile, VirtualAlloc(NtAlloc via direct syscall).
Additionally the Export Directory of the raw beacon DLL is zero'd out as there is no use for it and it contains known IOC's like "ReflectiveLoader" function name export.
 2023-02-22 09:41:26 -07:00
Bobby Cooke 7cdd7f88b9 Zero out the export directory. 
Zero out the export directory.
 2023-02-22 09:38:48 -07:00
Bobby Cooke fa8b6bc331 DLL Module Stomping & All Allocators supported! 
All beacon memory allocators are now supported and they are pulled from the C2 malleable profile! DLL Module Stomping, HeapAlloc, MapViewOfFile,VirtualAlloc(NtAlloc via direct syscall)
 2023-02-21 22:04:08 -07:00
Bobby Cooke edc2e20fa4 Add files via upload 2023-02-21 22:02:04 -07:00
Bobby Cooke 27c763f01a Update README.md 2023-02-21 22:01:38 -07:00
Bobby Cooke ffe7ebde0b Update README.md 2023-02-17 12:23:43 -07:00
Bobby Cooke d558a130ee Update README.md 2023-02-17 12:22:44 -07:00
Bobby Cooke 7d28309d23 Update README.md 2023-02-17 12:18:21 -07:00
Bobby Cooke 544074e745 Fix for C2 profile conflict 
boku_pe_mask($temp_dll) can cause issue if prepend transform is in C2 profile. Causes wrong bytes to be overwritten due to offset change. Disabled boku_pe_mask to honor C2 profile transformations.
 2023-02-12 08:19:18 -07:00
Bobby Cooke 7fe775bf72 Merge pull request #17 from xforcered/main 
Supports Obfuscate, Cleanup, & Sleepmask Evasions
 2023-02-10 16:34:29 -06:00
Bobby Cooke 68561ecae8 Supports Obfuscate, Cleanup, & Sleepmask Evasions 
BokuLoader now supports the Malleable PE evasion features defined in the Malleable C2 profile.
 2023-02-10 15:34:05 -07:00
Bobby Cooke c3dac7853b Update BokuLoader.cna 2023-02-10 15:28:18 -07:00