admin/fortra-No-Consolation
1
0
Fork 0
mirror of https://github.com/fortra/No-Consolation synced 2026-06-06 15:44:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

update readme

Browse Source
This commit is contained in:
S4ntiagoP
2024-07-17 13:33:03 -03:00
parent 77753128d0
commit ff5d16d064
1 changed files with 28 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+28 -25
View File
@@ -11,32 +11,38 @@ This is a Beacon Object File (BOF) that executes unmanaged PEs inline and retrie
- Links modules to the PEB
- Saves binaries in memory
- Supports C++ exceptions (x64 only)
- Custom loads all dependencies
## Usage
```
Summary: Run an unmanaged EXE/DLL inside Beacon's memory.
Usage: noconsolation [--local] [--link-to-peb] [--dont-unload] [--timeout 60] [-k] [--method funcname] [-w] [--no-output] [--alloc-console] [--close-handles] [--free-libraries] [--dont-save] [--list-pes] [--unload-pe pename] /path/to/binary.exe arg1 arg2
--local, -l Optional. The binary should be loaded from the target Windows machine
--link-to-peb, -ltp Optional. Load the PE into the PEB
--dont-unload, -du Optional. If set, the DLL won't be unloaded.
--timeout NUM_SECONDS, -t NUM_SECONDS Optional. The number of seconds you wish to wait for the PE to complete running. Default 60 seconds. Set to 0 to disable
-k Optional. Overwrite the PE headers
--method EXPORT_NAME, -m EXPORT_NAME Optional. Method or function name to execute in case of DLL. If not provided, DllMain will be executed
-w Optional. Command line is passed to unmanaged DLL function in UNICODE format. (default is ANSI)
--no-output, -no Optional. Do not try to obtain the output
--alloc-console, -ac Optional. Allocate a console. This will spawn a new process
--close-handles, -ch Optional. Close Pipe handles once finished. If PowerShell was already ran, this will break the output for PowerShell in the future
--free-libraries, -fl Optional. Free all loaded DLLs
--dont-save, -ds Optional. Do not save this binary in memory
--list-pes, -lpe Optional. List all PEs that have been loaded in memory
--unload-pe PE_NAME, -upe PE_NAME Optional. Unload from memory a PE
Usage: noconsolation [--local] [--link-to-peb] [--dont-unload] [--timeout 60] [-k] [--method funcname] [-w] [--no-output] [--alloc-console] [--close-handles] [--free-libraries] [--dont-save] [--list-pes] [--unload-pe pename] [--load-all-dependencies] [--load-all-dependencies-but advapi32.dll] [--load-dependencies wininet.dll] [--search-paths C:\\Windows\\Temp\\] /path/to/binary.exe arg1 arg2
--local, -l Optional. The binary should be loaded from the target Windows machine
--link-to-peb, -ltp Optional. Load the PE into the PEB
--dont-unload, -du Optional. If set, the DLL won't be unloaded.
--timeout NUM_SECONDS, -t NUM_SECONDS Optional. The number of seconds you wish to wait for the PE to complete running. Default 60 seconds. Set to 0 to disable
-k Optional. Overwrite the PE headers
--method EXPORT_NAME, -m EXPORT_NAME Optional. Method or function name to execute in case of DLL. If not provided, DllMain will be executed
-w Optional. Command line is passed to unmanaged DLL function in UNICODE format. (default is ANSI)
--no-output, -no Optional. Do not try to obtain the output
--alloc-console, -ac Optional. Allocate a console. This will spawn a new process
--close-handles, -ch Optional. Close Pipe handles once finished. If PowerShell was already ran, this will break the output for PowerShell in the future
--free-libraries, -fl Optional. Free all loaded DLLs
--dont-save, -ds Optional. Do not save this binary in memory
--list-pes, -lpe Optional. List all PEs that have been loaded in memory
--unload-pe PE_NAME, -upe PE_NAME Optional. Unload from memory a PE
--load-all-dependencies, -lad Optional. Custom load all the PE's dependencies
--load-all-dependencies-but, -ladb DLL_A,DLL_B Optional. Custom load all the PE's dependencies except these
--load-dependencies, -ld DLL_A,DLL_B Optional. Custom load these PE's dependencies
--search-paths, -sp PATH_A,PATH_B Optional. Look for DLLs on these paths (system32 is the default)
/path/to/binary.exe Required. Full path to the windows EXE/DLL you wish you run inside Beacon. If already loaded, you can simply specify the binary name.
ARG1 ARG2 Optional. Parameters for the PE. Must be provided after the path
Example: noconsolation --local C:\windows\system32\windowspowershell\v1.0\powershell.exe $ExecutionContext.SessionState.LanguageMode
Example: noconsolation --local C:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe \$ExecutionContext.SessionState.LanguageMode
Example: noconsolation /tmp/mimikatz.exe privilege::debug token::elevate exit
Example: noconsolation --local C:\windows\system32\cmd.exe /c ipconfig
Example: noconsolation --local C:\\windows\\system32\\cmd.exe /c ipconfig
Example: noconsolation --list-pes
Example: noconsolation LoadedBinary.exe args
```
@@ -57,16 +63,13 @@ If you are done with some binary and wish to unload it, run `--unload-pe mimikat
Finally, if you want to run a binary without it being automatically loaded in memory, run it with `--dont-save`.
## Loading DLLs into beacon
If you want to load a suspicious DLL into beacon, you can run:
## Loading PE's dependencies
You can avoid all image load events by custom loading all the PE's depdendencies:
```
beacon> noconsolation --dont-unload --link-to-peb --no-output --dont-save --local C:\windows\system32\foo.dll
beacon> noconsolation --load-dependencies --link-to-peb /tmp/malware.exe
```
This way, the DLL will be loaded in memory, linked to the PEB (so `GetMoudleHandle`/`GetProcAddress` will work) and `DllMain` will be executed.
Next, you can run any PE that uses that DLL without triggering an image load callback.
Caveats:
- If the DLL has a dependency, it's going to be loaded using LoadLibrary.
- There isn't a way to unload the DLL once you are done with it.
After execution is completed, the PE and its dependencies will be offloaded automatically.
DLLs that use Thread Local Storage are not supported.
## Credits