Chameleon is yet another PowerShell obfuscation tool designed to bypass AMSI and commercial antivirus solutions.

Overview

Chameleon

Chameleon is yet another PowerShell obfuscation tool designed to bypass AMSI and commercial antivirus solutions. The tool has been developed as a Python port of the Chimera project, by tokioneon_. As such, it uses mostly the same techniques to evade common detection signatures, such as:

  • comment deletion/substitution
  • string substitution (variables, functions, data-types)
  • variable concatenation
  • indentation randomization
  • semi-random backticks insertion
  • case randomization
  • encoding

Why porting it

Chimera was indeed a shiny project, so why did I decided to port it to Python and why you should use chameleon? Well, there are several reasons why I decided to build Chameleon. I wrote a more detailed post about them here. I've also listed below the most important ones.

Reliability

As the author of Chimera states in the readme, the chimera script can successfully obfuscate scripts that the author tested personally, which are contained in the shells directory. However, the tool is not very reliable with other, untested, scripts. Quoting the author:

there's no telling how untested scripts will reproduce with Chimera...

This alone was a good reason to attempt to make the tool a bit more reliable, and also capable to obfuscate more complex scripts.

Speed

Chimera attempts several obfuscation steps, which usually requires the input to be read from a file, and stored back in a file again. While this is a safe approach, because each step is saved to disk (let's say there is an error at step n, we would still have the result of the obfuscation till n - 1), this is not really efficient. The overhead of writing and reading from a file at each time make the tool really slow when operating on large scripts (up to several minutes with the -a option).

Chameleon, instead, performs all obfuscation steps in memory, meaning it is extremely faster.

Portability

Chimera has been developed as a Bash Script, and heavily relies on common Linux utilities to accomplish the obfuscation.

Chameleon, on the other hand, is built with Python, meaning that you can use it wherever Python is installed.

Smart evasion checking

Chimera offers a function to submit scripts to VirusTotal directly. While this might be considered a useful utility, it will expose the obfuscated script to third party threat-intelligence, weakening the obfuscation engine.

To address this issue, Chameleon uses the utility AMSITrigger by RhytmStick, to check if the obfuscated result will indeed bypass AMSI.

Improvements

So far, we've talked about the efficiency and reliability issues of chimera, but what are the real improvements from an obfuscation standpoint? The techniques used by Chameleon are for the most the same as Chimera, with some improvements:

  • "Smart" variable scope identification (function local variables will be replaced "carefully" or left untouched)
  • Random backticks insertion (not just limited to a set of strings)
  • Random case switch (not just limited to a set of strings)
  • Supports an external obfuscation mapping for functions and parameters (TODO)
  • Additional Base64 Encoding wrapping

Chameleon manages to handle function and local parameters by implementing a very minimalist PowerShell "reader", which is capable of distinguish three contexts:

  • Global/Main Scope
  • In-Function Scope
    • Param() Blocks

The reader is still not a real parser, and relies on Dick Language to find relevant areas limits.

Usage

Using the tool is pretty straightforward, as observable from the help:

usage: chameleon.py [-h] [-l {0,1,2,3,4,5}] -o OUTPUT [-v] [-s] [-d] [-n] [-c] [-f] [-b] [--random-backticks] [-r] [-i] [-x] [-j] [-a] [--decimal] [--base64] [-z] [-F FUNCTION_MAPPING] [-K KEYWORDS] [-B BACKTICKS] [-t {r,d,h}] [--safe] [--verbose] [--about]
                    target

Chameleon - PowerShell script obfuscator (Improved Python port of Chimera)

positional arguments:
  target                Script to obfuscate

optional arguments:
  -h, --help            show this help message and exit
  -l {0,1,2,3,4,5}, --level {0,1,2,3,4,5}
                        String manipulation Level (1: MIN, 5: MAX, 0: RANDOM)
  -o OUTPUT, --output OUTPUT
                        Store the payload in a file
  -v, --variables       Enable variable obfuscation
  -s, --strings         Enable string obfuscation
  -d, --data-types      Enable data types obfuscation
  -n, --nishang         Enable Nishang scripts obfuscation
  -c, --comments        Enable comments obfuscation
  -f, --functions       Enable functions obfuscation
  -b, --use-backticks   Enable use of backticks with generated strings
  --random-backticks    Enable use of backticks randomization
  -r, --random-cases    Enable upper/lower randomization
  -i, --random-spaces   Enable indentation randomization
  -x, --hex-ip          Enable indentation randomization
  -j, --true-false-null
                        Try and obfuscate $true, $false and $null (experimental)
  -a, --enable-all      Enable all obfuscation types
  --decimal             Convert obfuscated payload to decimal format
  --base64              Convert obfuscated payload to base64 format
  -z, --check           Check the script against AMSI Trigger (@RythmStick, @rasta-mouse)
  -F FUNCTION_MAPPING, --function-mapping FUNCTION_MAPPING
                        Add custom keywords to obfuscate
  -K KEYWORDS, --keywords KEYWORDS
                        Add custom keywords to obfuscate
  -B BACKTICKS, --backticks BACKTICKS
                        Add a list of words to backtick
  -t {r,d,h}, --randomization-type {r,d,h}
                        Type of randomization (r: Random, d: Dictionary, h: Hybrid)
  --safe                Reduce obfuscation of certain variables
  --verbose             Enable verbose output
  --about               Shows additional information about the tool

Notes

Worth saying that, even if now Chameleon is capable of obfuscate also complex scripts, it's still not comparable with Invoke-Obfuscation, which actually is way more mature and is also backed-up by a fully fledged parser Management.Automation.Language.Parser.

Next steps

Moreover, Chameleon is still not perfect and still needs further development to increase both its accuracy and improve its obfuscation techniques. A non-exhaustive list of planned improvements are below:

  • Upgrade the PowerShell reader
  • Include other encoding schemes
  • Add more obfuscation methods

Contribute

If you want to contribute, just fork the repository. Any PR is well accepted.

Credits

Worth saying that Chameleon would not be a thing without the work of tokioneon_ on Chimera, as the most of the obfuscation process was ported from Bash to Python (of course with some mods).

References

Issues
  • Adding random lettering in front of a function declaration

    Adding random lettering in front of a function declaration

    My simple statement is: python chameleon.py -o OUTPUT.ps1 -v Test1.ps1 . The only thing in Test1.ps1 is : -----------------------------------------------start of file function runmeforfun { Write-Host "Hey!" $variablenopurpose = "no purpose" Write-Host $variablenopurpose } #single line comment runmeforfun

    -------------------------------------------------end of file

    Unfortunately when I run the statement above I get this in the OUTPUT.ps1 file:

    -------------------------------------------------start of file function runmeforfun { Write-Host "Hey!" $obfuscatedrandomletteringnothereforpostingpurposes= "no purpose" Write-Host $obfuscatedrandomletteringnothereforpostingpurposes }

    runmeforfun -------------------------------------------------end of file

    Notice the comment is completely gone and there is now random lettering in front of the function, making the ps1 file now with errors and will not run.

    Upon further investigation it looks like the "zeroing out comments" section seems to be the problem

    Let me know if I have done something wrong or if this is an error with the python code!! Thank you!

    opened by AnnaMachovec 1
  • Functions not obfuscating

    Functions not obfuscating

    Hi! I am having trouble finding out as to why the functions are not obfuscating in my small script:

    test1.ps1--------------- function runmefor-fun { $variablenopurpose = "no purpose" Write-Host $variablenopurpose } #commment runmefor-fun #hi


    My command line is: chameleon.py -l 1 -o OUTPUT.ps1 -v -c -f Test1.ps1

    and my output file is this: --------------------------------

    function runmefor-fun { Write-Host "Hey!" $pretendreallylongobfuscationishortenedfordisplay = "no purpose" Write-Host $pretendreallylongobfuscationishortenedfordisplay

    } #commentthatislong runmefor-fun #commentthatislong

    any ideas as to why this will not work?

    bug good first issue 
    opened by AnnaMachovec 2
Owner
Lucky husband, proud father, and security researcher working for BSI
null
Yet another bash/zsh prompt script

Here we have yet another script for Git-aware customization of the command prompt in Bash and zsh. Unlike all the other scripts, I wrote this one, so

John T. Wodder II 5 Oct 13, 2021
Shellcode runner to execute malicious payload and bypass AV

buffshark-shellcode-runner Python Shellcode Runner to execute malicious payload and bypass AV This script utilizes mmap(for linux) and win api wrapper

Momo Lenard 1 Nov 23, 2021
Another (unofficial) Qt CLI Installer on multi-platforms

Another Qt installer(aqt) Release: Documentation: Test status: and Coverage: This is a utility alternative to the official graphical Qt installer, for

Hiroshi Miura 340 Dec 1, 2021
Shortcut-Maker - It is a tool that can be set to run any tool with a single command

Shortcut-Maker It is a tool that can be set to run any tool with a single command Coded by Dave Smith(Owner of Sl Cyber Warriors) Command list ?? pkg

Dave Smith 8 Aug 12, 2021
liquidctl – liquid cooler control Cross-platform tool and drivers for liquid coolers and other devices

Cross-platform CLI and Python drivers for AIO liquid coolers and other devices

null 1.2k Nov 26, 2021
Sink is a CLI tool that allows users to synchronize their local folders to their Google Drives. It is similar to the Git CLI and allows fast and reliable syncs with the drive.

Sink is a CLI synchronisation tool that enables a user to synchronise local system files and folders with their Google Drives. It follows a git C

Yash Thakre 13 Sep 15, 2021
A lightweight Python module and command-line tool for generating NATO APP-6(D) compliant military symbols from both ID codes and natural language names

Python military symbols This is a lightweight Python module, including a command-line script, to generate NATO APP-6(D) compliant military symbol icon

Nick Royer 1 Nov 28, 2021
Command-line tool for looking up colors and palettes.

Colorpedia Colorpedia is a command-line tool for looking up colors, shades and palettes. Supported color models: HEX, RGB, HSL, HSV, CMYK. Requirement

Joohwan Oh 273 Nov 30, 2021
Simple command line tool for text to image generation using OpenAI's CLIP and Siren (Implicit neural representation network)

Simple command line tool for text to image generation using OpenAI's CLIP and Siren (Implicit neural representation network)

Phil Wang 3.9k Nov 23, 2021
Free and Open-Source Command Line tool for Text Replacement

Sniplet Free and Open Source Text Replacement Tool Description: Sniplet is a work in progress CLI tool which can do text replacement globally in Linux

Veeraraghavan Narasimhan 14 Aug 17, 2021
A simple weather tool. I made this as a way for me to learn Python, API, and PyPi packaging.

A simple weather tool. I made this as a way for me to learn Python, API, and PyPi packaging.

Clint E. 102 Nov 25, 2021
A command line tool to remove background from video and image

A command line tool to remove background from video and image, brought to you by BackgroundRemover.app which is an app made by nadermx powered by this tool

Johnathan Nader 904 Nov 26, 2021
A command line tool (and Python library) for archiving Twitter JSON

A command line tool (and Python library) for archiving Twitter JSON

Documenting the Now 1.1k Nov 25, 2021
CLabel is a terminal-based cluster labeling tool that allows you to explore text data interactively and label clusters based on reviewing that data.

CLabel is a terminal-based cluster labeling tool that allows you to explore text data interactively and label clusters based on reviewing that

Peter Baumgartner 27 Oct 30, 2021
Command line tool to keep track of your favorite playlists on YouTube and many other places.

Command line tool to keep track of your favorite playlists on YouTube and many other places.

Wolfgang Popp 121 Nov 11, 2021
googler is a power tool to Google (web, news, videos and site search) from the command-line.

googler is a power tool to Google (web, news, videos and site search) from the command-line.

Terminator X 5.5k Nov 23, 2021
Shellmon is a tool used to create and control a webshell remotely, created using the Python3

An Simple PHP Webshell Manager Description Shellmon is a tool used to create and control a webshell remotely, created using the Python3 programming la

22XploiterCrew 4 Nov 30, 2021
A CLI tool to disable and enable security standards controls in AWS Security Hub

Security Hub Controls CLI A CLI tool to disable and enable security standards controls in AWS Security Hub. It is designed to work together with AWS S

AWS Samples 3 Nov 3, 2021