This write-up covers the basics of working with Native Applications and some interesting things you can do with them.
Thanks to
@Protexity
for giving me the opportunity to work with them on this blog
We are happy to share a guest blog post by Steve S! Steve is a Marine veteran, graduate student, and offensive security developer. He is currently Associate Staff at Datalytica where he spearheads the development of counter-AI capabilities.
New polymorphic techniques pushed to Revenant.
Rev now uses the python build script to generate C code at build time, compile randomly different binaries, and combine runtime polymorphic patches to give better obfuscation
Check it out!
@deadvolvo
In this writeup, we leverage
@rustlang
's inherent obfuscation against existing AV technologies to quickly bypass all detection on VirusTotal using unsafe code blocks.
We can even achieve 0-total detections with a standard MSFVenom payload!
Check it out
Use C, and some inline assembly, to create a self-extracting shellcode executable!
This solution was inspired by
@hasherezade
's C to Shellcode method, and was the basis for my solution to
@MalDevAcademy
's shellcode challenge.
Check it out!
Novel
@Windows
Defender bypass that leverage’s Defender’s inability to detect a malicious executable with a >2MB stack requirement.
1) Make a big payload
2) Put it in main()
3) ???
4) PROFIT
Check out my guest write-up on the MaliciousGroup blog.
If you're interested in C, inline assembly, and return address spoofing, this is the writeup you're looking for.
@deadvolvo
In this writeup, we discuss string obfuscation techniques and implement a classic string obfuscation technique, XOR, using modern CPU features to bypass emulation and analysis by
@Mandiant
's FLOSS and CAPA.
Check it out
In this writeup we use the capabilities of inline assembly to overwrite part of our program's .text section and achieve non-standard payload self-injection and execution.
Check it out!
Apparently the large stack bypass I wrote about earlier today affects a lot of AV engines.
I’ll do some more testing on my lab over the next couple of days and see what the consequences might be.
I feel like a shitty ad…
“Bypass AV with this one ez trick!”
Novel
@Windows
Defender bypass that leverage’s Defender’s inability to detect a malicious executable with a >2MB stack requirement.
1) Make a big payload
2) Put it in main()
3) ???
4) PROFIT
In this writeup, we use
@vector35
's BinaryNinja to manipulate a standard raw
@metasploit
meterpreter payload in order to bypass detection by Windows Defender.
No encryption. No encoding. Just opcodes.
Check it out!
If you’re in the red teaming space and have never checked out this book, you need to. I’m only a couple of chapters in and it’s easily the single most beneficial resource for understanding the necessary adversarial mindset
Two articles that demonstrate the viability of unhooking by bringing your own copy of ntdll (byoDLL).
1) The first method creates a temp file (not_ntdll.dll)
2) The second method uses
@hasherezade
's
#pe2shc
to load ntdll entirely in memory
You might have seen this 3-byte AMSI bypass last week by
@blazeinfosec
You can actually achieve this same bypass by with a 1-bit patch.
More of a cool party trick than anything else, but still pretty interesting. Check out the screenshots below.
After a long hiatus, Blaze Labs is back in town! In our latest post, we explain a technique to evade antivirus with in-memory patching of
#Windows
'
#AMSI
. Red teamers of the world, enjoy the read!
Wrote an RDI today using
@deadvolvo
's writeup as a guide. I learned a ton going through the process.
If you haven't checked it out, you're missing out.
In this writeup we demonstrate how custom payload/implant implementations can be used to break call stack tracing using assembly functions, inline assembly, and a custom payload based on
@0xBoku
's popcalc!
Check it out!
A detailed analysis on embedding payloads (x86) using
@metasploit
's MSFVenom . We look at effects the payload has on the binary, how the redirection stub works, and a quick look at defeating some AV signatures when we use this technique
Take a peek
Would anyone be interested in a detailed analysis of how msfvenom’s -x option works?
Here’s a good write up on how to use it, but I’m interested in showing how it works
Finally finished this book!
A lot of the technical specifications are dated, but it’s so rich in creativity and offensive mindset that I would recommend this book to anyone!
Do you have any other book recommendations?
After a couple weeks of studying and playing with the Talon implementation, we have a working (v0.01) of Revenant for
@C5pider
's Havoc C2!
It's still mostly Talon, but
@deadvolvo
and I will keep grinding on it in the coming weeks👀
In this writeup we continue our use of
@vxunderground
's VX-API, implement a decompressing -> remote process injection implant, and then use some compiler trickery to bypass
#Windows
Defender.
Check it out.
A writeup on achieving zero detection on VirusTotal for a plain msfvenom calc.bin by making assembly level modifications using
@vector35
's BinaryNinja.
No encryption. No encoding. Just opcodes.
If you're not using the VX-API for your tooling, you're missing out on very useful capabilities packaged into a well written API.
In this article we look at the default implant in the API to analyze functionality and utility.
Check it out
Modern implant design: position independent malware development.
A small blog post on how to design "modern" malware with features like global variables, raw strings, and compile-time hashing.
Repo:
Revenant Updates!
> powershell (pwsh) command
> Architecture part of default name (Revenant_x64/x86.exe)
> Fixed OS architecture enumeration bug
> Improved debugging and error handling
> (HAVOC) Health monitoring candidate
@C5pider
Check it out!
In this writeup we look at Windows support for non-existent file paths and demonstrate a use case against Yara rules.
It's an interesting trick, check it out!
Revenant updates focused on backward compatibility:
> x86 .exe building
> Rolled to C99 standard
> Win7/8 Compatability (WinAPI)
Check it out!
#HavocC2
New updates to Revenant!
> Revenant is now compiled with llvm-mingw
> Reworked polymorphic functionality
> Protection against Mandiant's FLOSS
> Anti-debug and Polymorphic functions execute prior to Main()
Check it out!
This week, we take another look at the VX-API and implement reverse shell capabilities in our implant using an MSFVenom payload. We leverage a compression algorithm and some compiler trickery to fool Windows Defender and get a connection.
Check it out!
I did some testing on two binaries. One written in C++, one written in Rust.
> Rust was bigger, but just as fast
> Rust produced bigger and lower quality decompilation results
> The Rust binary was only detected by 5/72 AV engines on VT
Check it out
Updates to Revenant! Just in time for your July 4th celebrations.
> More hash definitions in support of future functionality
> Build-time anti-debug inline assembly injections
> Unhook via Perun's Fart method
>> Rehooks after cmd execution
Check it out!
Before we wrap up the year, it’s time to get out one last Kali release for 2023.
Announcing Kali 2023.4! for a focus on the addition of Hyper-V support to Vagrant, ARM64 Cloud images, support for the Pi 5, and an update to Gnome 45. Check it out!
Huge updates dropped for Revenant!
@deadvolvo
put in a lot of work this week to bring you streamlined string obfuscation and native API functionality. These updates are pretty huge and add a lot of functionality to our
#Havoc
implant
Check it out!
In this writeup, we discussed a more advanced, multi-step, methodology that bypasses detection by Mandiant's FLOSS string deobfuscator.
Be sure to head over to Patreon for early access to similar writeups!
Check it out!
Just launched my Patreon!
We’re kicking things off with a poll. Feel free to check it out and vote on what types of things you’d like to see me cover in the future 🔥
Does anyone know why runtime modifications to a function's return address would result in broken stack tracing?
The address in the stack trace is off by one, which is what first hinted to me that something was wrong. But what's interesting is that checking the actual contents
if you look at the CISA stats:
~88% of pwnage is from the attacker having a set of credentials that work... (phishing, brute force or theft etc.)
Cybercrime is largely stealing credentials....
lot's of "IT people" say stuff like:
well sure if you have
Apparently, there's a Yara rule for Revenant that's been out since July on
@malpedia
Seems to only work on versions of Revenant compiled in April.
Interesting...
It's worth noting that these were not all compiled with the same features enabled. Just old copies I happen to
An exploration of various techniques to reduce detectability for high-level code delivery. Achieved 0-total detections on virus total using only anti-debugging techniques and WinAPI pointers.
No encryption. No encoding. No winnt.h.
@egeblc
"mimicking the natural PE loading" =! a properly loaded PE. There's no debate to be had about that.
The additional artifacts and signatured mechanics of reflective loading are significant drawbacks that stardust resolves in a way reflective loading, by design, cannot.
@0xTriboulet
I find out how to compile in MSVC what you did in …There is the github repo …there is a bunch of code but the project is shellcode_gen_msvc_c
@Laughing_Mantis
If Microsoft aggregates the data collected to improve the model (which is probably a given), it's now possible to poison the data set locally
A writeup on manually correcting deficiently embeded x64 payloads using MSFVenom and BinaryNinja.
By default embedding x64 payloads that are started on a new thread doesn't work using MSFVenom.
Learn one way to fix it.
If you saw my x86 writeup and tried to apply it to an x64 payload you know embeded payload exec in a new thread doesn't work by default w/
@metasploit
's msfvenom
In this writeup we take a practical approach to manual correction of an embeded (x64) payload.
Check it out.
@MalDevAcademy
's challenge inspired this implementation: Using macros, we can set a kill date when our implant will self-delete.
Patrons can access the early access writeup 🔥
Other writeups that haven't made it to my blog are available for free!