DOCSEARCHbyAlgolia
Submit Docs

OffensiveRust Documentation

repository·master·Indexed 25 days ago

https://github.com/trickster0/offensiverust

A repository of research and implementations for offensive security operations using Rust. It includes tools and techniques for implant development and AV evasion, such as Litcrypt string encryption, memfd_create-rs for memory execution, and various injection methods including classic DLL injection, module stomping, process hollowing, and Reflective DLL Injection (RDI). It also features eagle-rs for kernel-level process manipulation, ekko-rs for sleep obfuscation, and MimiRust for post-exploitation tasks like credential dumping and privilege escalation.

Tokens
33.7K
Snippets
101
Records
207
Agent score
84%

What's inside OffensiveRust

  2. Overview of PE Madness (Portable Executable Parsing Library)

    master

    PE Madness is a Portable Executable (PE) parsing library written in Rust. Unlike standard parsing libraries, it is specifically designed for scenarios like Reflective DLL Injection or Shellcode Reflective DLL Injection where traditional heap allocation and dynamic sizing are not possible.

    Key design constraints for use in shellcode/self-loading environments:

    • No Heap Allocation: Designed to work without relying on a heap.
    • Stack-Based: Dynamically sized data must be placed on the stack.
    • Self-Contained: Does not rely on libc or other implicit external APIs to avoid dependency on the OS loader.
    • Minimal Dependencies: Uses the windows-sys crate and unsafe code to maintain a low footprint.
    • Obfuscation: Uses hashes instead of string obfuscation (like obfstr) to make dynamic analysis more difficult.

  3. Overview of OffensiveRust

    master
    OffensiveRust is a collection of experiments focused on weaponizing the Rust programming language for implant development and general offensive operations. It leverages Rust's performance, LLVM-based architecture for bypassing static AV detection, and Cargo's dependency management to facilitate offensive security tasks.

  5. Overview of Reflective DLL Injection (RDI)

    master

    This repository provides implementations and research related to Reflective DLL Injection (RDI). RDI is a technique used to load a DLL from memory rather than from disk, which can be used to evade detection by security software that monitors file-on-disk activity.

    If you are looking for Shellcode Reflective DLL Injection (sRDI), please refer to the dedicated repository: https://github.com/memN0ps/srdi-rs.

  6. Use MimiRust for post-exploitation tasks

    master

    MimiRust is a post-exploitation tool written in Rust for Windows. It can be used to spawn processes as SYSTEM, execute shell commands, and extract Windows credentials (Wdigest passwords and NTLM hashes) from memory.

    There are two ways to run the tool:

    1. Interactive Shell: Run the executable without arguments to enter an interactive menu.
    2. Command Line: Run the executable with specific flags/arguments directly.

  7. Understand Syscall Evasion Techniques in mordor-rs

    master

    The mordor-rs package implements several techniques to bypass user-mode hooks (such as those from EDRs) by retrieving system call numbers directly or using alternative invocation methods.

    Direct Syscall Retrieval Techniques

    • Hell's Gate: Parses ntdll.dll to find the syscall stub (4c8bd1b8) and retrieves the syscall ID. It is vulnerable to failure if the syscall stub itself is hooked.
    • Halo's Gate: An evolution of Hell's Gate that detects hooks by checking if the first byte is e9 (jmp). If a hook is detected, it searches neighboring functions to calculate the correct syscall ID based on incremental numbering.
    • Tartarus' Gate: An evolution of Halo's Gate that also checks if the second line (after mov r10, rcx) is hooked by searching for the byte sequence 4c8bd1e9.

    Export Directory & OS-Based Techniques

    • FreshyCalls: Searches the Export Directory for functions starting with Nt, sorts them by address, and uses the lowest address as the syscall identifier.
    • SysWhispers1: Selects the correct system call number based on OS version information.
    • SysWhispers2: Similar to FreshyCalls, but searches for Zw functions in the Export Directory and maps them to Nt names.
    • SysWhispers3: An advanced version supporting x86/WoW64, syscall instruction replacement with an EGG (for dynamic replacement), and direct jumps to syscalls or random syscalls.

  8. Use memfd_create-rs to execute binaries from memory

    master
    The memfd_create-rs project provides a way to load ELF binaries into memory and execute them without writing them to the disk, utilizing the memfd_create technique (MITRE ATT&CK T1620). The main program downloads an ELF file and executes it directly from memory.

  9. Review manual_map-rs features and roadmap

    master

    The current capabilities and planned features for manual_map-rs are:

    Implemented Features:

    • Manual Mapping in Remote process
    • Manual Mapping x64 DLLs
    • Rebasing image and resolving imports in the local process
    • Download DLL remotely (HTTP supported)

    Planned Features (ToDo):

    • HTTPS support for remote downloads
    • Manual Mapping in local process
    • Manual Mapping in an executable file
    • TLS callbacks

  10. Use Ekko Sleep Obfuscation in Rust

    master
    Ekko in Rust is a port of the Ekko sleep obfuscation technique to Rust. It utilizes the CreateTimerQueueTimer Win32 API function to implement sleep obfuscation, originally ported from the C implementation by Cracked5pider. This technique is used to evade detection by obfuscating the sleep state of a process.

  11. Navigate the MimiRust interactive shell

    master

    When running MimiRust in interactive mode, the prompt prefix indicates your current privilege level:

    • mimiRust $: Running without elevated privileges.
    • mimiRust #: Running with elevated privileges.
    • mimiRust @: Running with SYSTEM privileges.

    To view available options in the shell, use:

    • ? (to see top-level modules)
    • h or help (for help)

    Modules available in the shell:

    • passwords
    • pivioting
    • privilege

  12. Use module_stomping-rs for Module Stomping

    master
    The module_stomping-rs tool performs Module Stomping (also known as Module Overloading or DLL Hollowing). It injects a Microsoft-signed DLL (e.g., amsi.dll) into a target process using classic DLL injection, then reads the AddressOfEntryPoint of that DLL and overwrites its content with shellcode. This allows shellcode to execute from within the memory space of a legitimate, signed module.