mirror of
https://github.com/kmanc/remote_code_oxidation
synced 2026-06-08 15:21:46 +00:00
Documentation (#22)
* Update README.md * Update README.md * Update README.md * badges to sub-readmes * main readme polishing * formatting * feasts feedback incorporated
This commit is contained in:
kmanc
@@ -1,11 +1,14 @@
|
||||
# Remote code oxidation (RCO)
|
||||
# Remote Code Oxidation (RCO)
|
||||
|
||||
[](https://github.com/kmanc/remote_code_oxidation/actions/workflows/linux.yml)
|
||||
[](https://github.com/kmanc/remote_code_oxidation/actions/workflows/windows.yml)
|
||||
|
||||
|
||||
|
||||
A collection of offensive security tools written in Rust. More details to come
|
||||
Remote Code Oxidation is a collection of offensive security tools written in Rust. My main goal for the project is to enable offensive security professionals and practitioners to prepare the tools needed for an engagement with as little overhead as possible.
|
||||
|
||||
RCO tools can be compiled on either Linux or Windows systems to provide its users flexibility in their attack infrastructure. Similarly the tools work against either Linux or Windows targets to suit the needs of the task at hand.
|
||||
|
||||
|
||||
## Tools list
|
||||
[](https://github.com/kmanc/remote_code_oxidation/tree/master/tcp_reverse_shell)
|
||||
@@ -20,6 +23,7 @@ Clone the repo
|
||||
git clone https://github.com/kmanc/remote_code_oxidation.git
|
||||
```
|
||||
|
||||
|
||||
### From Linux host for Linux target
|
||||
|
||||
Install Rust
|
||||
@@ -37,6 +41,7 @@ Build!
|
||||
cargo build [-p package_name] [--release]
|
||||
```
|
||||
|
||||
|
||||
### From Linux host for Windows target
|
||||
|
||||
Install Rust
|
||||
@@ -54,3 +59,10 @@ Build!
|
||||
```commandline
|
||||
cargo build --target x86_64-pc-windows-gnu [-p package_name] [--release]
|
||||
```
|
||||
|
||||
|
||||
### From Windows host for Linux target
|
||||
####Todo
|
||||
|
||||
### From Windows host for Windows target
|
||||
####Todo
|
||||
+18
-17
@@ -1,25 +1,26 @@
|
||||
# RCO: Process Migration
|
||||
|
||||
## What it is
|
||||
[](https://github.com/kmanc/remote_code_oxidation/tree/master/process_migration)
|
||||
|
||||
Linux target | Windows target
|
||||
:-------------------------:|:-------------------------:
|
||||
 | 
|
||||
|
||||
RCO's process migration is a technique used to hide malicious code running on a victim machine. It has the added benefit
|
||||
of making it less likely the the malicious code is accidentally closed by a user on a victim machine by moving the payload
|
||||
to a process that is unlikely to be terminated.
|
||||
|
||||
## How it works
|
||||
|
||||
RCO's Windows process migration works by obtaining a handle to the target process and writing [shellcode](https://en.wikipedia.org/wiki/Shellcode) to it. Then it
|
||||
spawns a remote thread within the process whose starting point is the newly written shellcode. RCO's Linux process migration works slightly differently; it temporarily pauses the target process, then writes the shellcode over the [instruction pointer](https://datacadamia.com/computer/instruction/instruction_pointer) for that process. This will likely cause issues with the process.
|
||||
Windows process migration works by obtaining a handle to the target process and writing [shellcode](https://en.wikipedia.org/wiki/Shellcode) to it. A remote thread is then created; the starting point of this thread is the newly written shellcode.
|
||||
|
||||
Linux process migration works slightly differently. After temporarily pausing the target process, RCO writes shellcode over the process's [instruction pointer](https://datacadamia.com/computer/instruction/instruction_pointer). This can cause issues (the most likely of which is crashing) for the target process.
|
||||
|
||||
|
||||
## Using it
|
||||
|
||||
1. Generate shellcode for the desired end result (for example, use [msfvenom](https://book.hacktricks.xyz/shells/shells/msfvenom) to generate a reverse TCP
|
||||
1. [Not shown in GIF] Generate shellcode for the desired end result (for example, use [msfvenom](https://book.hacktricks.xyz/shells/shells/msfvenom) to generate a reverse TCP
|
||||
shell shellcode for the target operating system)
|
||||
|
||||
2. Open [the config file](https://github.com/kmanc/remote_code_oxidation/blob/master/rco_config/src/lib.rs)
|
||||
2. [Not shown in GIF] Open [the config file](https://github.com/kmanc/remote_code_oxidation/blob/master/rco_config/src/lib.rs)
|
||||
and change the shellcode to the shellcode generated in step 1
|
||||
|
||||
3. Compile the executable
|
||||
3. [Not shown in GIF] Compile the executable
|
||||
|
||||
#### Build for Linux target
|
||||
```commandline
|
||||
@@ -30,13 +31,13 @@ and change the shellcode to the shellcode generated in step 1
|
||||
```commandline
|
||||
cargo build --target x86_64-pc-windows-gnu -p process_migration --release
|
||||
```
|
||||
|
||||
4. Execute the payload on the victim machine
|
||||
5. Return to the listener and enter desired commands for the victim machine to run
|
||||
4. Start a netcat listener on the attacking machine on the same port you configured the shellcode to connect to in step 1
|
||||
```commandline
|
||||
nc -nlvp 4444
|
||||
```
|
||||
5. Execute the payload on the victim machine
|
||||
6. Return to the listener and enter desired commands for the victim machine to run
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
## Detection rates
|
||||
|
||||
|
||||
+14
-22
@@ -1,29 +1,22 @@
|
||||
# RCO: TCP Reverse Shell
|
||||
|
||||
## What it is
|
||||
[](https://github.com/kmanc/remote_code_oxidation/tree/master/tcp_reverse_shell)
|
||||
|
||||
Linux target | Windows target
|
||||
:-------------------------:|:-------------------------:
|
||||
 | 
|
||||
|
||||
RCO's TCP reverse shell is a no-frills [reverse shell](https://www.hackingtutorials.org/networking/hacking-netcat-part-2-bind-reverse-shells/). This means it allows you to run Terminal (Linux)
|
||||
or Command Prompt (Windows) commands _on the victim machine_ from the attacking machine. Getting a remote shell on a
|
||||
victim machine usually allows much more control over the victim than other attacks.
|
||||
|
||||
## How it works
|
||||
|
||||
Both RCO's Linux and Windows TCP reverse shells work by establishing a [TCP session](https://www.scottklement.com/rpg/socktut/overview.html) from the victim machine
|
||||
to the attacking machine. Then a Terminal (Linux) or Command Prompt (Windows) process is spun up with its [standard input](https://en.wikipedia.org/wiki/Standard_streams#Standard_input_(stdin)),
|
||||
[standard output](https://en.wikipedia.org/wiki/Standard_streams#Standard_output_(stdout)), and [standard error](https://en.wikipedia.org/wiki/Standard_streams#Standard_error_(stderr)) all assigned to the TCP session. This means that
|
||||
input commands and output results are read from and written to (respectively) a TCP stream.
|
||||
The reverse shells for both Linux and Windows work by establishing a [Transmission Control Protocol (TCP) session](https://www.scottklement.com/rpg/socktut/overview.html) from the victim machine to the attacking machine. Then a Terminal (Linux) or Command Prompt (Windows) process then starts with its [standard input](https://en.wikipedia.org/wiki/Standard_streams#Standard_input_(stdin)), [standard output](https://en.wikipedia.org/wiki/Standard_streams#Standard_output_(stdout)), and [standard error](https://en.wikipedia.org/wiki/Standard_streams#Standard_error_(stderr)) all assigned to the TCP session. This means that input commands and output results are read from and written to (respectively) the TCP stream.
|
||||
|
||||
|
||||
## Using it
|
||||
|
||||
1. Start a listener on the attacking machine
|
||||
```commandline
|
||||
nc -nlvp 4444
|
||||
```
|
||||
|
||||
2. Open [the config file](https://github.com/kmanc/remote_code_oxidation/blob/master/rco_config/src/lib.rs)
|
||||
and change the IP address and port to match your attacking machine and listener, respectively
|
||||
|
||||
3. Compile the executable
|
||||
1. [Not shown in GIF] Open [the config file](https://github.com/kmanc/remote_code_oxidation/blob/master/rco_config/src/lib.rs)
|
||||
and change the IP address and port to match the IP address of your attacking machine and the port you will use for a listener respectively
|
||||
2. [Not shown in GIF] Compile the executable
|
||||
|
||||
#### For Linux targets
|
||||
```commandline
|
||||
@@ -34,14 +27,13 @@ and change the IP address and port to match your attacking machine and listener,
|
||||
```commandline
|
||||
cargo build --target x86_64-pc-windows-gnu -p tcp_reverse_shell --release
|
||||
```
|
||||
|
||||
3. Start a netcat listener on the attacking machine on the same port you configured in step 1
|
||||
```commandline
|
||||
nc -nlvp 4444
|
||||
```
|
||||
4. Execute the payload on the victim machine
|
||||
|
||||
5. Return to the listener and enter desired commands for the victim machine to run
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
## Detection rates
|
||||
|
||||
|
||||
Reference in New Issue
Block a user