admin/mgeeky-ShellcodeFluctuation
1
0
Fork 0
mirror of https://github.com/mgeeky/ShellcodeFluctuation synced 2026-06-06 16:14:31 +00:00
Code Issues Packages Projects Releases Wiki Activity

readme

Browse Source
This commit is contained in:
Mariusz B. / mgeeky
2021-09-30 15:15:34 +02:00
parent 852dd846d1
commit bac4ae87e3
1 changed files with 13 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+13
View File
@@ -339,6 +339,19 @@ Unhook is done.
[Modified `unhook-bof` with option to ignore specified modules](https://github.com/mgeeky/unhook-bof)
---
## Final remark
This PoC was designed to work with Cobalt Strike's Beacon shellcodes. The Beacon is known to call out to `kernel32!Sleep` to await further instructions from its C2.
This loader leverages that fact by hooking `Sleep` in order to perform its housekeeping.
This implementation might not work with other shellcodes in the market (such as _Meterpreter_) if they don't use `Sleep` to cool down.
Since this is merely a _Proof of Concept_ showing the technique, I don't intend on adding support for any other C2 framework.
When you understand the concept, surely you'll be able to translate it into your shellcode requirements and adapt the solution for your advantage.
Please do not open Github issues related to "this code doesn't work with XYZ shellcode", they'll be closed immediately.
---