Add Ekko / Sleep Obfuscation to Sliver #1805
Conversation
|
Looks awesome we'll try to get this reviewed and merged shortly! |
|
Heya, @rkervella ! Thanks for the first review. Cleaned out the prints and randomised XOR key generation. |
| @@ -307,6 +307,7 @@ func coreImplantFlags(name string, cmd *cobra.Command) { | |||
| f.BoolP("evasion", "e", false, "enable evasion features (e.g. overwrite user space hooks)") | |||
| f.BoolP("skip-symbols", "l", false, "skip symbol obfuscation") | |||
| f.BoolP("disable-sgn", "G", false, "disable shikata ga nai shellcode encoder") | |||
| f.BoolP("sleep-obfuscation", "B", false, "apply ekko in-memory sleep obfuscation") | |||
There was a problem hiding this comment.
This should probably be in coreBeaconFlags instead since sleep obfuscation is only relevant for beacons (unless I'm mistaken, feel free to correct me).
| @@ -272,6 +272,7 @@ func parseCompileFlags(cmd *cobra.Command, con *console.SliverClient) (string, * | |||
| debug, _ := cmd.Flags().GetBool("debug") | |||
| evasion, _ := cmd.Flags().GetBool("evasion") | |||
| templateName, _ := cmd.Flags().GetString("template") | |||
| sleepObfuscation, _ := cmd.Flags().GetBool("sleep-obfuscation") | |||
There was a problem hiding this comment.
Same idea, please move this to generate-beacon.go instead.
|
Alright, I finally started testing this, and I couldn't get the beacon process to self-encrypt when sleeping: I tried with a debug beacon to confirm Ekko is properly called, and it is. |
|
Hey, @rkervella, Busy time of the year. I believe the self-encryption is working as intended. If you reconfig the beacon to have short sleep time (a few seconds) you'll see the memory address changing from RW to RWX whenever it's time for the beacon callback. while awake, RWX: while sleeping, RW: Well spotted on the process randomly hanging after some time. I've also found an old process hanging on a test server as you described. It appears that the memory region stays stuck in RWX and never self-encrypts/ goes back to sleep. |
Card
This PR implements Ekko / in-memory sleep obfuscation for a beacon.
Details
Based on the work of https://github.com/scriptchildie/goEkko, adapted from https://github.com/Cracked5pider/Ekko, it pauses Go runtime and encrypts the beacon's memory region with the Ekko technique.
Command -B / --sleep-obfuscation added on generate beacon to support this feature.
Only applicable for Windows.
Beacon while performing operations / active:
Beacon while in its sleep duration:
