Tool for working with Direct System Calls in Cobalt Strike's Beacon Object Files (BOF) via Syswhispers2

Last update: Dec 31, 2022

Related tags

Miscellaneous InlineWhispers2

Overview

InlineWhispers2

Tool for working with Direct System Calls in Cobalt Strike's Beacon Object Files (BOF) via Syswhispers2

Based on https://github.com/outflanknl/InlineWhispers and https://github.com/helpsystems/nanodump work

How do I set this up?

git clone https://github.com/Sh0ckFR/InlineWhispers2 && cd InlineWhispers2
git clone https://github.com/jthuraisamy/SysWhispers2
cd SysWhispers2/ && python3 syswhispers.py --preset all -o syscalls_all && cd ..
python3 InlineWhispers2.py

How to use syscalls in your Cobalt-Strike BOF?

Import syscalls.c syscalls.h, syscalls-asm.h in your project and include syscalls.c to start to use syscalls

Now you can use all syscalls that you need:

#include <windows.h>
#include <stdio.h>
#include <tlhelp32.h>

#include "beacon.h"

#include "syscalls.c"

int go(char* args, int length) {
	datap  parser;
	BeaconDataParse(&parser, args, length);

	int pid = BeaconDataInt(&parser);

	BeaconPrintf(CALLBACK_OUTPUT, "	- Opening process: %d.", pid);

	HANDLE hProcess = NULL;
	OBJECT_ATTRIBUTES ObjectAttributes;
	InitializeObjectAttributes(&ObjectAttributes, NULL, 0, NULL, NULL);

	CLIENT_ID uPid = { 0 };
	uPid.UniqueProcess = (HANDLE)(DWORD_PTR)pid;
	uPid.UniqueThread = (HANDLE)0;

	NTSTATUS status = NtOpenProcess(&hProcess, PROCESS_ALL_ACCESS, &ObjectAttributes, &uPid);
	if (hProcess == NULL || status != 0) {
		BeaconPrintf(CALLBACK_OUTPUT, "	[ERROR] Failed to get processhandle, status: 0x%lx", status);
		return 0;
	}
	BeaconPrintf(CALLBACK_OUTPUT, "	- Handle: %x", hProcess);

	NtClose(hProcess);

	return 0;
}

Limitations

Actually, you can't use NtCallEnclave, NtGetCachedSigningLevel, NtSetCachedSigningLevel, NtCreateSectionEx syscalls

Credits

@jthuraisamy for Syswhispers2
@outflanknl for the first version of InlineWhispers
@helpsystems for the nanodump exemple
@boku7 for his awesome work and his kindness
@HackingDave because he's the owner of a great DeLorean vroom vroom
The French Read The Fancy Manual community, the CyberThreatForce, and OsintFr (@sigsegv_event @CTFofficielFR and @OsintFr)
All infosec enthusiasts who share their knowledge without looking down on other enthusiasts

Process RunGap output file of a workout and load data into Apple Numbers Spreadsheet and my website with API calls

1 Jan 3, 2022

[x]it! support for working with todo and check list files in Sublime Text

[x]it! for Sublime Text This Sublime Package provides syntax-highlighting, shortcuts, and auto-completions for [x]it! files. Features Syntax highlight

18 Sep 19, 2022

A tool to flash .ofp files in bootloader mode without needing MSM Tool, an alternative to official realme tool

Oppo/Realme Flash .OFP File on Bootloader A tool to flash .ofp files in bootloader mode without needing MSM Tool, an alternative to official realme to

70 Jan 2, 2023

Direct Multi-view Multi-person 3D Human Pose Estimation

Implementation of NeurIPS-2021 paper: Direct Multi-view Multi-person 3D Human Pose Estimation [paper] [video-YouTube, video-Bilibili] [slides] This is

253 Jan 5, 2023

APRS Track Direct is a collection of tools that can be used to run an APRS website

APRS Track Direct APRS Track Direct is a collection of tools that can be used to run an APRS website. You can use data from APRS-IS, CWOP-IS, OGN, HUB

42 Dec 29, 2022

Bootstraparse is a personal project started with a specific goal in mind: creating static html pages for direct display from a markdown-like file

1 Jun 15, 2022

gwcheck is a tool to check .gnu.warning.* sections in ELF object files and display their content.

gwcheck Description gwcheck is a tool to check .gnu.warning.* sections in ELF object files and display their content. For an introduction to .gnu.warn

11 Oct 28, 2022

fetchmesh is a tool to simplify working with Atlas anchoring mesh measurements

A Python library for working with the RIPE Atlas anchoring mesh. fetchmesh is a tool to simplify working with Atlas anchoring mesh measurements. It ca

2 Aug 30, 2022

A free and powerful system for awareness and research of the American judicial system.

CourtListener Started in 2009, CourtListener.com is the main initiative of Free Law Project. The goal of CourtListener.com is to provide high quality

332 Dec 25, 2022

Comments

Fails with latest Syswhispers2 update

Hello! Thanks for taking the time to develop this tool. Unfortunately, the latest syswhispers2 update has changed its output to be split between x86 and x64 syscalls, and it has also changed the output naming. This is what Syswhispers2 looks like when run with the commands included in the README.

$ python3 syswhispers.py --preset all -o syscalls_all && cd ..

                  .                         ,--.
,-. . . ,-. . , , |-. o ,-. ,-. ,-. ,-. ,-.    /
`-. | | `-. |/|/  | | | `-. | | |-' |   `-. ,-'
`-' `-| `-' ' '   ' ' ' `-' |-' `-' '   `-' `---
     /|                     |  @Jackson_T
    `-'                     '  @modexpblog, 2021

SysWhispers2: Why call the kernel when you can whisper?

All functions selected.

Complete! Files written to:
	syscalls_all.h
	syscalls_all.c
	syscalls_all_stubs.x86.asm
	syscalls_all_stubs.x86.nasm
	syscalls_all_stubs.x86.s
	syscalls_all_stubs.x64.asm
	syscalls_all_stubs.x64.nasm
	syscalls_all_stubs.x64.s

This breaks InlineWhispers2, because it now fails to read the correct output file when run.

$ python3 InlineWhispers2.py
.___       .__  .__              __      __.__    .__                                   ________
|   | ____ |  | |__| ____   ____/  \    /  \  |__ |__| ____________   ___________  _____\_____  \
|   |/    \|  | |  |/    \_/ __ \   \/\/   /  |  \|  |/  ___/\____ \_/ __ \_  __ \/  ___//  ____/
|   |   |  \  |_|  |   |  \  ___/\        /|   Y  \  |\___ \ |  |_> >  ___/|  | \/\___ \/       \
|___|___|  /____/__|___|  /\___  >\__/\  / |___|  /__/____  >|   __/ \___  >__|  /____  >_______ \
         \/             \/     \/      \/       \/        \/ |__|        \/           \/        \/

Sh0ckFR - https://twitter.com/Sh0ckFR

Traceback (most recent call last):
  File "/Users/davidmckennirey/tools/InlineWhispers2/InlineWhispers2.py", line 120, in <module>
    create_asm_file()
  File "/Users/davidmckennirey/tools/InlineWhispers2/InlineWhispers2.py", line 52, in create_asm_file
    with open('SysWhispers2/syscalls_all_stubs.asm', 'r') as file:
FileNotFoundError: [Errno 2] No such file or directory: 'SysWhispers2/syscalls_all_stubs.asm'

opened by davidmckennirey 2

Tool for working with Direct System Calls in Cobalt Strike's Beacon Object Files (BOF) via Syswhispers2

Related tags

Overview

InlineWhispers2

How do I set this up?

How to use syscalls in your Cobalt-Strike BOF?

Limitations

Credits

You might also like...

Process RunGap output file of a workout and load data into Apple Numbers Spreadsheet and my website with API calls

[x]it! support for working with todo and check list files in Sublime Text

A tool to flash .ofp files in bootloader mode without needing MSM Tool, an alternative to official realme tool

Direct Multi-view Multi-person 3D Human Pose Estimation

APRS Track Direct is a collection of tools that can be used to run an APRS website

Bootstraparse is a personal project started with a specific goal in mind: creating static html pages for direct display from a markdown-like file

gwcheck is a tool to check .gnu.warning.* sections in ELF object files and display their content.

fetchmesh is a tool to simplify working with Atlas anchoring mesh measurements

A free and powerful system for awareness and research of the American judicial system.

Comments

Fails with latest Syswhispers2 update

Owner

Beacon Object File (BOF) to obtain a usable TGT for the current user.

A beacon generator using Cobalt Strike and a variety of tools.

Stack BOF Protection Bypass Techniques

Block fingerprinting for the beacon chain, for client identification & client diversity metrics

Python: Wrangled and unpivoted gaming datasets. Tableau: created dashboards - Market Beacon and Player’s Shopping Guide.

A tool for light-duty persistent memoization of API calls

Code and yara rules to detect and analyze Cobalt Strike

Cobalt Strike Sleep Python Bridge

ChainJacking is a tool to find which of your Go lang direct GitHub dependencies is susceptible to ChainJacking attack.

a pull switch (or BYO button) that gets you out of video calls, quick