Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
https://github.com/mgeeky/ElusiveMice
Cobalt Strike User-Defined Reflective Loader with AV/EDR Evasion in mind
https://github.com/mgeeky/ElusiveMice
Last synced: 3 months ago
JSON representation
Cobalt Strike User-Defined Reflective Loader with AV/EDR Evasion in mind
- Host: GitHub
- URL: https://github.com/mgeeky/ElusiveMice
- Owner: mgeeky
- Created: 2021-08-27T19:22:20.000Z (about 3 years ago)
- Default Branch: master
- Last Pushed: 2023-07-12T17:54:07.000Z (over 1 year ago)
- Last Synced: 2024-05-02T17:53:11.083Z (6 months ago)
- Language: C
- Size: 83 KB
- Stars: 391
- Watchers: 11
- Forks: 65
- Open Issues: 2
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
- awesome-hacking-lists - mgeeky/ElusiveMice - Cobalt Strike User-Defined Reflective Loader with AV/EDR Evasion in mind (C)
README
# ElusiveMice - custom Cobalt Strike User-Defined Reflective Loader
This is a fork of [Cobalt Strike's User-Defined Reflective Loader](https://www.cobaltstrike.com/help-user-defined-reflective-loader) which in turn is a fork of [Stephen Fewer's ReflectiveDLLInjection](https://github.com/stephenfewer/ReflectiveDLLInjection) implementation, but with a _slight_ plot twist - it adds a few lightweight evasions.
## Features
- utilizes changed API/module name dynamic resolution hashes to avoid simple signature detections
- reflective loader now properly restores section memory protections and avoids using one big `RWX` allocation
- `elusiveMice` tries to wipe itself from the memory, leaving close to no remnants of UDRL code when memory scan sweep comes in
## Usage
1. Modify you `arsenal_kit.config` accordingly:
```
include_artifact_kit="true"
include_udrl_kit="false"
include_sleepmask_kit="true"
include_process_inject_kit="true"
include_resource_kit="true"
include_mimikatz_kit="true"
rdll_size=100
artifactkit_stack_spoof="true"
artifactkit_technique="mailslot"
artifactkit_stage_size=424948
artifactkit_syscalls_method="indirect_randomized"
sleepmask_sleep_method="WaitForSingleObject"
sleepmask_mask_text_section="true"
sleepmask_syscalls_method="indirect_randomized"
```
2. Compile arsenal kit `./build_arsenal_kit.sh`
3. Load `bin/elusiveMice.cna` script into your Cobalt Strike
4. Generate your beacon via `Attacks -> Packages -> Windows Stageless Payload` or any other sort of Beacon's shellcode.
5. (Optionally) observe output in `View -> Script Console`
The CNA script may have `$debug` mode enabled by flipping the variable:
```
# Enable Debug of PE content
# The generated PE content will be displayed in the script console if debug is true
#$debug = "true";
$debug = "true";
```
Which will dump PE headers of newly generated Reflective DLL containing Beacon's codebase.
## Other work
So far there aren't many publicly available implementations of _User-Defined Reflective Loaders_, but the ones of a great quality that I'm aware of include:
- [boku7's BokuLoader](https://github.com/boku7/BokuLoader)
## Author
```
Mariusz B. / mgeeky, 21-23
(https://github.com/mgeeky)
```