mirror of
https://github.com/kmanc/remote_code_oxidation
synced 2026-06-08 15:21:46 +00:00
the great readme migration (#46)
This commit is contained in:
kmanc
@@ -1,73 +1,3 @@
|
||||
# Remote Code Oxidation (RCO)
|
||||
|
||||
[](https://github.com/kmanc/remote_code_oxidation/actions/workflows/linux.yml)
|
||||
[](https://github.com/kmanc/remote_code_oxidation/actions/workflows/windows.yml)
|
||||
|
||||
|
||||
|
||||
Remote Code Oxidation is a collection of offensive security tools written in Rust. My main goal for the project is to enable offensive security professionals and practitioners to prepare the tools needed for an engagement with as little overhead as possible.
|
||||
|
||||
RCO tools can be compiled on either Linux or Windows systems to provide its users flexibility in their attack infrastructure. Similarly the tools work against either Linux or Windows targets to suit the needs of the task at hand.
|
||||
|
||||
|
||||
## Tools list
|
||||
[](https://github.com/kmanc/remote_code_oxidation/tree/master/hash_params)
|
||||
|
||||
[](https://github.com/kmanc/remote_code_oxidation/tree/master/process_hollowing)
|
||||
|
||||
[](https://github.com/kmanc/remote_code_oxidation/tree/master/process_migration)
|
||||
|
||||
[](https://github.com/kmanc/remote_code_oxidation/tree/master/tcp_reverse_shell)
|
||||
|
||||
[](https://github.com/kmanc/remote_code_oxidation/tree/master/xor_params)
|
||||
|
||||
## Setup
|
||||
|
||||
Clone the repo
|
||||
```commandline
|
||||
git clone https://github.com/kmanc/remote_code_oxidation.git
|
||||
```
|
||||
|
||||
|
||||
### From Linux host for Linux target
|
||||
|
||||
Install Rust
|
||||
```commandline
|
||||
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
|
||||
```
|
||||
|
||||
Add dependencies for compiling
|
||||
```commandline
|
||||
sudo apt install build-essential
|
||||
```
|
||||
|
||||
Build!
|
||||
```commandline
|
||||
cargo build [-p package_name] [--features [xor][antisand]] [--release]
|
||||
```
|
||||
|
||||
|
||||
### From Linux host for Windows target
|
||||
|
||||
Install Rust
|
||||
```commandline
|
||||
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
|
||||
```
|
||||
|
||||
Add dependencies for cross-compiling
|
||||
```commandline
|
||||
sudo apt install mingw-w64
|
||||
rustup target add x86_64-pc-windows-gnu
|
||||
```
|
||||
|
||||
Build!
|
||||
```commandline
|
||||
cargo build --target x86_64-pc-windows-gnu [-p package_name] [--features [xor][antisand]] [--release]
|
||||
```
|
||||
|
||||
|
||||
### From Windows host for Linux target
|
||||
####Todo
|
||||
|
||||
### From Windows host for Windows target
|
||||
####Todo
|
||||
Remote Code Oxidation's documentation has moved! [See it here](https://kmanc.github.io/remote_code_oxidation/).
|
||||
+1
-24
@@ -1,26 +1,3 @@
|
||||
# RCO: Hash Params
|
||||
|
||||
[](https://github.com/kmanc/remote_code_oxidation/tree/master/hash_params)
|
||||
|
||||
|
||||
|
||||
|
||||
## How it works
|
||||
|
||||
Hash params performs Rust's default hash algorithm ([SipHash-1-3 at the time of this writing](https://en.wikipedia.org/wiki/SipHash)) on command line arguments and prints their output in hex. This should not be considered cryptographically secure, but works for obfuscating a value in a repeatable way.
|
||||
|
||||
|
||||
## Using it
|
||||
|
||||
1. [Not shown in GIF] Compile the executable
|
||||
|
||||
#### For Linux
|
||||
```commandline
|
||||
cargo build -p hash_params --release
|
||||
```
|
||||
|
||||
#### For Windows
|
||||
```commandline
|
||||
cargo build --target x86_64-pc-windows-gnu -p hash_params --release
|
||||
```
|
||||
2. Run the executable with the desired hash targets
|
||||
[See Hash Params' documentation here](https://kmanc.github.io/remote_code_oxidation/hash_params.html)
|
||||
@@ -1,55 +1,3 @@
|
||||
# RCO: Process Hollowing
|
||||
|
||||
[](https://github.com/kmanc/remote_code_oxidation/tree/master/process_hollowing)
|
||||
|
||||
Linux target | Windows target
|
||||
:-------------------------:|:-------------------------:
|
||||
 | 
|
||||
|
||||
|
||||
## How it works
|
||||
|
||||
Windows process hollowing works by creating a suspended process and writing the [shellcode](https://en.wikipedia.org/wiki/Shellcode) over the entry point of the process's main thread. It then resumes the suspended process, which in turn executes the shellcode.
|
||||
|
||||
Linux process hollowing functions a little differently. First, the executable creates a child process by cloning itself. Then it overwrites the child process's [instruction pointer](https://datacadamia.com/computer/instruction/instruction_pointer) with shellcode. Because this process was not running before the attack, it is unlikely this will cause any issues on the victim machine.
|
||||
|
||||
## Using it
|
||||
|
||||
1. [Not shown in GIF] Generate shellcode for the desired end result (for example, use [msfvenom](https://book.hacktricks.xyz/shells/shells/msfvenom) to generate a reverse TCP shell shellcode for the target operating system)
|
||||
2. [Not shown in GIF] Open [the config file](https://github.com/kmanc/remote_code_oxidation/blob/master/rco_config/src/lib.rs)
|
||||
and change the shellcode to the shellcode generated in step 1
|
||||
3. [Optional] Encrypt the shellcode and target process using [xor_params](https://github.com/kmanc/remote_code_oxidation/blob/master/xor_shellcode) and update the encrypted shellcode value in [the config file](https://github.com/kmanc/remote_code_oxidation/blob/master/rco_config/src/lib.rs)
|
||||
4. [Not shown in GIF] Compile the executable, only including `--features xor` if you did step 3
|
||||
|
||||
#### Build for Linux target
|
||||
```commandline
|
||||
cargo build -p process_hollowing [xor][,][antisand][,][antistring]] --release
|
||||
```
|
||||
|
||||
#### Build for Windows target
|
||||
```commandline
|
||||
cargo build --target x86_64-pc-windows-gnu -p process_hollowing [xor][,][antisand][,][antistring]] --release
|
||||
```
|
||||
5. Start a netcat listener on the attacking machine on the same port you configured the shellcode to connect to in step 1
|
||||
```commandline
|
||||
nc -nlvp 4444
|
||||
```
|
||||
6. Execute the payload on the victim machine
|
||||
7. Return to the listener and enter desired commands for the victim machine to run
|
||||
|
||||
|
||||
## Detection rates
|
||||
|
||||
|
||||
<p align="center"> Linux </p>
|
||||
|
||||
[No features - 7 / 40](https://kleenscan.com/scan_result/1177abafe77dc580337ec6294c68bdc4873ceb36a4eeac057fd0673c3ae50e7f) | [Using `--features xor` - 0 / 40](https://kleenscan.com/scan_result/8a0268ca750a14fc93f40f6b1864f13ce94318c4c4a7ecc49dfeb332b9c9d860)
|
||||
:-------------------------:|:-------------------------:
|
||||
 | 
|
||||
|
||||
|
||||
<p align="center"> Windows </p>
|
||||
|
||||
[No features - 12 / 40](https://kleenscan.com/scan_result/dd7858b48235bc782383fa5a929125369c7918d3c119a9196b0fdab791624763) | [Using `--features antisand` - 12 / 40](https://kleenscan.com/scan_result/dc73a322924b772b90957aaffe8d2735acd6d6049e0607a1befada2bc5aa86f3) | [Using `--features antistring` - 12 / 40](https://kleenscan.com/scan_result/1505ac5f33afe16a79796045d80c6c55617944c86396411487f1cbd934e875fb) | [Using `--features antisand,antistring` - 12 / 40](https://kleenscan.com/scan_result/177242f39b392107e4953a8cb717afbc6f912daa5bd9ec8d71a959834942db8d) | [Using `--features xor` - 6 / 40](https://kleenscan.com/scan_result/455d775c517cf26a6e83a42b3eae7982364d8a8174127eca377094c05e0dd948) | [Using `--features antistring,xor` - 1 / 40](https://kleenscan.com/scan_result/e6214cb0175737d1e3bba8bafbaa17d5aa575f613dab718a6d35dd46c7af8767) | [Using `--features antisand,xor` - 0 / 40](https://kleenscan.com/scan_result/de899245ec6a258d741b6243d18cf10fae5e6a1fe344ab3d02f17899a67d2bb7) | [Using `--features antisand,antistring,xor` - 0 / 40](https://kleenscan.com/scan_result/49f53e2e15b86d9e5425d684e9ab964289d2d96fef8ca61ba927e3826ebd0392)
|
||||
:-------------------------:|:-------------------------:|:-------------------------:|:-------------------------:|:-------------------------:|:-------------------------:|:-------------------------:|:-------------------------:
|
||||
 |  |  |  |  |  |  | 
|
||||
[See Process Hollowing's documentation here](https://kmanc.github.io/remote_code_oxidation/process_hollowing.html)
|
||||
@@ -1,56 +1,3 @@
|
||||
# RCO: Process Migration
|
||||
|
||||
[](https://github.com/kmanc/remote_code_oxidation/tree/master/process_migration)
|
||||
|
||||
Linux target | Windows target
|
||||
:-------------------------:|:-------------------------:
|
||||
 | 
|
||||
|
||||
|
||||
## How it works
|
||||
|
||||
Windows process migration works by obtaining a handle to the target process and writing [shellcode](https://en.wikipedia.org/wiki/Shellcode) to it. A remote thread is then created; the starting point of this thread is the newly written shellcode.
|
||||
|
||||
Linux process migration works slightly differently. After temporarily pausing the target process, RCO writes shellcode over the process's [instruction pointer](https://datacadamia.com/computer/instruction/instruction_pointer). This can cause issues (the most likely of which is crashing) for the victim machine.
|
||||
|
||||
|
||||
## Using it
|
||||
|
||||
1. [Not shown in GIF] Generate shellcode for the desired end result (for example, use [msfvenom](https://book.hacktricks.xyz/shells/shells/msfvenom) to generate a reverse TCP
|
||||
shell shellcode for the target operating system)
|
||||
2. [Not shown in GIF] Open [the config file](https://github.com/kmanc/remote_code_oxidation/blob/master/rco_config/src/lib.rs)
|
||||
and change the shellcode to the shellcode generated in step 1
|
||||
3. [Optional] Encrypt the shellcode and target process using [xor_params](https://github.com/kmanc/remote_code_oxidation/blob/master/xor_shellcode) and update the encrypted shellcode value in [the config file](https://github.com/kmanc/remote_code_oxidation/blob/master/rco_config/src/lib.rs)
|
||||
4. [Not shown in GIF] Compile the executable, only including `--features xor` if you did step 3
|
||||
|
||||
#### Build for Linux target
|
||||
```commandline
|
||||
cargo build -p process_migration [xor][,][antisand][,][antistring]] --release
|
||||
```
|
||||
|
||||
#### Build for Windows target
|
||||
```commandline
|
||||
cargo build --target x86_64-pc-windows-gnu -p process_migration [xor][,][antisand][,][antistring]] --release
|
||||
```
|
||||
5. Start a netcat listener on the attacking machine on the same port you configured the shellcode to connect to in step 1
|
||||
```commandline
|
||||
nc -nlvp 4444
|
||||
```
|
||||
6. Execute the payload on the victim machine
|
||||
7. Return to the listener and enter desired commands for the victim machine to run
|
||||
|
||||
|
||||
## Detection rates
|
||||
|
||||
<p align="center"> Linux </p>
|
||||
|
||||
[No features: 7 / 40](https://kleenscan.com/scan_result/5d88b167a6fdf674a0a81514e37f171a4d0eb63c0b063dec1dd02a5d9b63d4fb) | [Using `--features xor`: 0 / 40](https://kleenscan.com/scan_result/5568475e28d65306af33f75df28e215e7024daa922241fbd9c1e9205cd27a96d)
|
||||
:-------------------------:|:-------------------------:
|
||||
 | 
|
||||
|
||||
|
||||
<p align="center"> Windows </p>
|
||||
|
||||
[No features: 12 / 40](https://kleenscan.com/scan_result/5588bdf5da5bd1c25e08ca6cb7a07d7729160a5fdcbc218b8f7cd112620f6f67) | [Using `--features antisand`: 12 / 40](https://kleenscan.com/scan_result/ebebddfa24b6d95c65900003629914cbcadf09fddcd9a70db614b9f8e9f5fc42) | [Using `--features antistring`: 12 / 40](https://kleenscan.com/scan_result/7200bae53ce50bd8b0f3a528026ee72d71b47615235cf96384fe0752a1ff6145) | [Using `--features antisand,antistring`: 12 / 40](https://kleenscan.com/scan_result/e702816970ee629f718e6dbec58a129b03742b0ac7644bc3de942d8368e7252b) | [Using `--features xor`: 1 / 40](https://kleenscan.com/scan_result/8b3feb5f4db1b06a9fd33a9597b62d22847f518f607d7f049579b87b44ce8fea) | [Using `--features antistring,xor`: 1 / 40](https://kleenscan.com/scan_result/f580330422109325f3c83fd1fa51a966798cb173d0edca5c1b4c310a2c95c082) | [Using `--features antisand,xor`: 0 / 40](https://kleenscan.com/scan_result/19a7640ebedb91c375aeebf9d576ea005260610ca0eb23621413dc058a8ff067) | [Using `--features antisand,antistring,xor`: 0 / 40](https://kleenscan.com/scan_result/1de23cfca021214907bb51174df2b8d69d2fe45cb6ebc903c1e3328bb958678f)
|
||||
:-------------------------:|:-------------------------:|:-------------------------:|:-------------------------:|:-------------------------:|:-------------------------:|:-------------------------:|:-------------------------:
|
||||
 |  |  |  |  |  |  | 
|
||||
[See Process Migration's documentation here](https://kmanc.github.io/remote_code_oxidation/process_migration.html)
|
||||
@@ -1,51 +1,3 @@
|
||||
# RCO: TCP Reverse Shell
|
||||
|
||||
[](https://github.com/kmanc/remote_code_oxidation/tree/master/tcp_reverse_shell)
|
||||
|
||||
Linux target | Windows target
|
||||
:-------------------------:|:-------------------------:
|
||||
 | 
|
||||
|
||||
|
||||
## How it works
|
||||
|
||||
The reverse shells for both Linux and Windows work by establishing a [Transmission Control Protocol (TCP) session](https://www.scottklement.com/rpg/socktut/overview.html) from the victim machine to the attacking machine. Then a Terminal (Linux) or Command Prompt (Windows) process starts with its [standard input](https://en.wikipedia.org/wiki/Standard_streams#Standard_input_(stdin)), [standard output](https://en.wikipedia.org/wiki/Standard_streams#Standard_output_(stdout)), and [standard error](https://en.wikipedia.org/wiki/Standard_streams#Standard_error_(stderr)) all assigned to the TCP session. This means that input commands and output results are read from and written to (respectively) the TCP stream.
|
||||
|
||||
|
||||
## Using it
|
||||
|
||||
1. [Not shown in GIF] Open [the config file](https://github.com/kmanc/remote_code_oxidation/blob/master/rco_config/src/lib.rs)
|
||||
and change the IP address and port to match the IP address of your attacking machine and the port you will use for a listener respectively
|
||||
2. [Not shown in GIF] Compile the executable
|
||||
|
||||
#### For Linux targets
|
||||
```commandline
|
||||
cargo build -p tcp_reverse_shell [antisand][,][antistring]] --release
|
||||
```
|
||||
|
||||
#### For Windows targets
|
||||
```commandline
|
||||
cargo build --target x86_64-pc-windows-gnu -p tcp_reverse_shell [--features [antisand][,][antistring]] --release
|
||||
```
|
||||
3. Start a netcat listener on the attacking machine on the same port you configured in step 1
|
||||
```commandline
|
||||
nc -nlvp 4444
|
||||
```
|
||||
4. Execute the payload on the victim machine
|
||||
5. Return to the listener and enter desired commands for the victim machine to run
|
||||
|
||||
|
||||
## Detection rates
|
||||
|
||||
<p align="center"> Linux </p>
|
||||
|
||||
[No features: 0 / 40](https://kleenscan.com/scan_result/c01984f5bc45f0ff82723fe6ceab770fe48e955081f8b02e17a8232e6ba2bbeb)
|
||||
:-------------------------:
|
||||
|
||||
|
||||
|
||||
<p align="center"> Windows </p>
|
||||
|
||||
[No features: 0 / 40](https://kleenscan.com/scan_result/ce74ac206b59e9acc4e7f528bcec06f2a1dcc8ac0a1fb622c0b646cdfd2602d5) | [Using `--features antisand`: 0 / 40](https://kleenscan.com/scan_result/28fce6da1a75b3d0073649613d5e69b73019091e1a7c2a2033b1551755c5fad4) | [Using `--features antistring`: 0 / 40](https://kleenscan.com/scan_result/fafcad9c3689cf811184cacc3c1e9f939017b4e5d362712468839a6126f82278) | [Using `--features antisand,antistring`: 0 / 40](https://kleenscan.com/scan_result/ff8c1a3fda94bd5f73314e15c9861284250b88720f045351aedc937435b9d8bd)
|
||||
:-------------------------:|:-------------------------:|:-------------------------:|:-------------------------:
|
||||
 |  |  | 
|
||||
[See TCP Reverse Shell's documentation here](https://kmanc.github.io/remote_code_oxidation/tcp_reverse_shell.html)
|
||||
+1
-28
@@ -1,30 +1,3 @@
|
||||
# RCO: XOR Params
|
||||
|
||||
[](https://github.com/kmanc/remote_code_oxidation/tree/master/xor_params)
|
||||
|
||||
|
||||
|
||||
|
||||
## How it works
|
||||
|
||||
XOR params performs an [exclusive OR (XOR)](https://en.wikipedia.org/wiki/Exclusive_or) operation on each byte of the shellcode with each byte of the key (repeating the key if need be).
|
||||
|
||||
|
||||
## Using it
|
||||
|
||||
1. [Not shown in GIF] Generate shellcode for the desired end result (for example, use [msfvenom](https://book.hacktricks.xyz/shells/shells/msfvenom) to generate a reverse TCP shell shellcode for the target operating system)
|
||||
2. [Not shown in GIF] Open [the config file](https://github.com/kmanc/remote_code_oxidation/blob/master/rco_config/src/lib.rs) and change the shellcode to the shellcode generated in step 1
|
||||
3. Open [the config file](https://github.com/kmanc/remote_code_oxidation/blob/master/rco_config/src/lib.rs) and change the key to a desired key
|
||||
4. [Not shown in GIF] Compile the executable
|
||||
|
||||
#### For Linux
|
||||
```commandline
|
||||
cargo build -p xor_params --release
|
||||
```
|
||||
|
||||
#### For Windows
|
||||
```commandline
|
||||
cargo build --target x86_64-pc-windows-gnu -p xor_params --release
|
||||
```
|
||||
5. Run the executable
|
||||
6. Open [the config file](https://github.com/kmanc/remote_code_oxidation/blob/master/rco_config/src/lib.rs) and change encrypted payload to the output of step 5
|
||||
[See XOR Params' documentation here](https://kmanc.github.io/remote_code_oxidation/xor_params.html)
|
||||
Reference in New Issue
Block a user