GhostNap

KO | EN

gitlite — search

#python #hacktoberfest #ai #typescript #llm #go #rust #linux #docker #nodejs #awesome #kubernetes #vue #pytorch

(★ 55)

Sleep obfuscation for shellcode implants and their reflective shit

GhostNap 최신버젼 다운로드

최종 버전 다운로드 (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# GhostNap
GhostNap is my implementation of sleep obfuscation in Nim.
It protects the shellcode implant, but also protects the reflective DLL's loaded by the shellcode, as Meterpreter and Cobalt Strike beacons love to do.

The traditional proof:
![](https://raw.githubusercontent.com/itaymigdal/GhostNap/main/yay.png)

# Why
Most of the sleep obfuscation techniques I encountered, were protecting the image. Regarding protecting shellcodes, [ShellGhost](https://github.com/lem0nSec/ShellGhost) is really awesome, but the only other I know - [ShellcodeFluctuation](https://github.com/mgeeky/ShellcodeFluctuation), wasn't worked good for me. 
Also, I did not see yet a pure shellcode implants, that do not depend on loading other PE's, so I believe that my solution is kind of filling this gap.
It also coded in Nim - which is the thing :yellow_heart:

## How
1. Installs a hook on `kernel32:Sleep` (so your implant must use it).
2. Allocates memory for the shellcode implant, then change the protection to `PAGE_EXECUTE_READWRITE`.
3. Installs a hook on `kernel32:VirtualAlloc` (so your implant must not use lower calls like `NtAllocateVirtualMemory`)
4. Copies the shellcode, and executes it via Fiber or by the `CertEnumSystemStore` callback.
5. Any invocation of `VirtualAlloc` is intercepted, and the permission is compared against `PAGE_READWRITE`, `PAGE_EXECUTE_READ`, or `PAGE_EXECUTE_READWRITE`. If the comparison yields a positive result, we proceed to protect the corresponding memory page as well.
6. Any call to `Sleep` will:
   1. Remove the `X` permission from the shellcode and any other protected page.
   2. Encode the shellcode and any other protected page by single byte xor, or by RC4 using `SystemFunction032`.
   3. Sleep.
   4. Decode each page back.
   5. Add the `X` permission again.

## Installation
Built with Nim 1.6.12.
```
nimble install winim ptr_math nimprotect minhook
```

## Usage
Just edit the config at the source file, it's very commented.

Compile with `-d:release`, unless you want to see verbose prints.

## Credits
- khchen for the great projects [minhook](https://github.com/khchen/minhook) and [winim](https://github.com/khchen/winim)
- s3cur3th1ssh1t for [SystemFunction032 Nim implementation](https://s3cur3th1ssh1t.github.io/SystemFunction032_Shellcode/)
- All the other work done by smarter guys than me on sleep obfuscation

GhostNap

GhostNap 최신버젼 다운로드

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

GhostNap

GhostNap 최신버젼 다운로드

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

Download README