mirror of
https://github.com/licitrasimone/CrystalSliver
synced 2026-06-21 13:55:58 +00:00
Simone Licitra
74b0d2ed1b
- Redesign stager as two-file delivery: csvchelper.exe (~17 KB) + payload.dat (AES-256-CBC encrypted PICO). Removes the 36 MB high-entropy .data blob that triggered VirTool:Win64/ZomBytes.B static detection. - Replace XOR+NtCreateSection approach with BCryptDecrypt (AES-256-CBC) + VirtualAlloc(RW)/VirtualProtect(RX). No Nt* strings in .rdata, no PAGE_EXECUTE_READWRITE mapping, no GetProcAddress/ntdll pattern. - Add manifest.xml (asInvoker, RT_MANIFEST resource ID 1) to suppress UAC auto-elevation triggered by "Update"/"Service" keywords in FileDescription. - Update FileDescription in resource.rc to avoid UAC heuristic trigger words. - gen_payload.py now calls openssl for AES encryption; produces payload.dat + payload_key.h (key+IV, compiled in, never committed via .gitignore). - Makefile: add -s (strip symbols), -ffunction-sections/-fdata-sections, --gc-sections to keep binary clean and small. - Update all docs (RUNBOOK, TOOLCHAIN, README, crystal-kit-sliver/README) to reflect two-file delivery, new evasion profile, and UAC fix.
48 lines
836 B
Plaintext
48 lines
836 B
Plaintext
# Reference clones (upstream repos pulled locally for analysis only)
|
|
references/
|
|
|
|
# External downloaded tooling (Crystal Palace dist, etc.) — not redistributable
|
|
external/
|
|
|
|
# Sliver operator configs (contain credentials)
|
|
*.cfg
|
|
|
|
# Build artifacts
|
|
*.o
|
|
*.obj
|
|
*.bin
|
|
*.dll
|
|
*.exe
|
|
bin/
|
|
build/
|
|
# Generated embed headers (xxd output — can be 100s of MB, always rebuilt)
|
|
pico_payload.h
|
|
crystalexec_pico.h
|
|
# AES key header generated by gen_payload.py (unique per build)
|
|
payload_key.h
|
|
# Encrypted PICO (delivery artifact, not source)
|
|
payload.dat
|
|
|
|
# Archives / dist downloads
|
|
*.tgz
|
|
*.tar.gz
|
|
*.zip
|
|
|
|
# Crystal Palace prerequisite (proprietary tooling, do NOT commit)
|
|
*.jar
|
|
libtcg.x64.zip
|
|
|
|
# Per-operator config (engagement-specific paths, never commit)
|
|
.crystalenv
|
|
|
|
# OS / editor
|
|
.DS_Store
|
|
.vscode/
|
|
.idea/
|
|
*.swp
|
|
*~
|
|
|
|
# Claude Code
|
|
.claude/
|
|
MEMORY/
|