diff --git a/.github/workflows/autorelease.yml b/.github/workflows/autorelease.yml new file mode 100644 index 0000000..c544f36 --- /dev/null +++ b/.github/workflows/autorelease.yml @@ -0,0 +1,61 @@ +name: Release + +on: + push: + tags: ["v[0-9]+.[0-9]+.[0-9]+"] + branches: ["main"] + +jobs: + + linux-windows-build: + name: MinGW Build + if: startsWith( github.ref, 'refs/tags/v') + runs-on: ubuntu-latest + timeout-minutes: 45 + steps: + + - name: OS Packages + run: | + sudo apt-get update --fix-missing && sudo apt-get -y install \ + git build-essential zlib1g zlib1g-dev wget zip unzip \ + mingw-w64 binutils-mingw-w64 g++-mingw-w64 gcc-multilib + + - name: Minisign + run: | + MINISIGN_TMP=`mktemp -d` + cd $MINISIGN_TMP + wget https://github.com/aead/minisign/releases/download/v0.2.0/minisign-linux-amd64.tar.gz + tar xvf minisign-linux-amd64.tar.gz + mv ./minisign ~/minisign + + - name: Check out code into the Go module directory + uses: actions/checkout@v2 + + - name: Git Fetch Tags + run: git fetch --prune --unshallow --tags -f + + - name: Build Package + run: | + ./compile.sh + rm -f ./compiled/.gitkeep + VERSION=$(git describe --tags --abbrev=0) + cat extension.json | jq ".version |= \"$VERSION\"" > ./compiled/extension.json + cp LICENSE ./compiled/LICENSE + cd compiled + tar -czvf ../inject-etw-bypass.tar.gz . + + - name: Sign Package + run: | + touch ~/minisign.key && chmod 600 ~/minisign.key + echo -e "${{ secrets.MINISIGN_PRIVATE_KEY }}" > ~/minisign.key + MANIFEST=$(cat ./compiled/extension.json | base64 -w 0) + bash -c "echo \"\" | ~/minisign -s ~/minisign.key -S -m ./inject-etw-bypass.tar.gz -t \"$MANIFEST\" -x inject-etw-bypass.minisig" + + - name: "Publish Release" + uses: "marvinpinto/action-automatic-releases@latest" + with: + repo_token: "${{ secrets.GITHUB_TOKEN }}" + prerelease: false + files: | + ./inject-etw-bypass.minisig + ./inject-etw-bypass.tar.gz diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..520fe97 --- /dev/null +++ b/.gitignore @@ -0,0 +1,2 @@ +*.o +compiled/** \ No newline at end of file diff --git a/compile.sh b/compile.sh index e4ece2e..9aa2ff0 100644 --- a/compile.sh +++ b/compile.sh @@ -1,2 +1,2 @@ -x86_64-w64-mingw32-gcc -m64 -mwindows -c injectEtwBypass.c -o injectEtwBypass.o -masm=intel -Wall -fno-asynchronous-unwind-tables -nostdlib -fno-ident -Wl,-Tlinker.ld,--no-seh -echo "Succesfully compiled, you can load 'injectEtwBypass.cna' into Cobalt-Strike and use the command 'injectEtwBypass PID'" +#!/bin/bash +x86_64-w64-mingw32-gcc -m64 -mwindows -c injectEtwBypass.c -o ./compiled/injectEtwBypass.o -masm=intel -Wall -fno-asynchronous-unwind-tables -nostdlib -fno-ident -Wl,-Tlinker.ld,--no-seh diff --git a/compiled/.gitkeep b/compiled/.gitkeep new file mode 100644 index 0000000..e69de29 diff --git a/extension.json b/extension.json new file mode 100644 index 0000000..00e2076 --- /dev/null +++ b/extension.json @@ -0,0 +1,26 @@ +{ + "name": "Inject ETW Bypass", + "version": "v0.0.0", + "command_name": "inject-etw-bypass", + "extension_author": "@moloch--", + "original_author": "@boku7", + "repo_url": "https://github.com/sliverarmory/injectEtwBypass", + "help": "", + "depends_on": "coff-loader", + "entrypoint": "go", + "files": [ + { + "os": "windows", + "arch": "amd64", + "path": "injectEtwBypass.x64.o" + } + ], + "arguments": [ + { + "name": "pid", + "desc": "The PID of the process you want to inject the bypass into.", + "type": "int", + "optional": false + } + ] + } \ No newline at end of file diff --git a/injectEtwBypass.o b/injectEtwBypass.o deleted file mode 100644 index 3b3a0b2..0000000 Binary files a/injectEtwBypass.o and /dev/null differ