Skip to content

Commit 8ee42df

Browse files
its-a-featureits-a-feature
committed
updated execute_coff and execute_pe functionality
1 parent 67790ab commit 8ee42df

36 files changed

+4835
-3001
lines changed

‎LICENSE

+25
Original file line numberDiff line numberDiff line change
@@ -27,3 +27,28 @@ SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
2727
CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
2828
OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
2929
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
30+
31+
Copyright 2020, COFFLoader by TrustedSec, LLC
32+
All rights reserved.
33+
34+
Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
35+
36+
* Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
37+
* Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer
38+
in the documentation and/or other materials provided with the distribution.
39+
* Neither the name of TrustedSec, LLC nor the names of its contributors may be used to endorse or promote products derived from
40+
this software without specific prior written permission.
41+
42+
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
43+
LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
44+
OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
45+
LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
46+
THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
47+
THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
48+
49+
The above licensing was taken from the BSD licensing and is applied to COFFLoader as well.
50+
51+
Note that the COFFLoader is provided as is, and is a royalty free open-source application.
52+
53+
Feel free to modify, use, change, market, do whatever you want with it as long as you give the appropriate credit where credit
54+
is due (which means giving the authors the credit they deserve for writing it).

‎Payload_Type/apollo/CHANGELOG.MD

+9
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,15 @@ All notable changes to this project will be documented in this file.
44
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
55
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
66

7+
## [v2.3.2] - 2025-02-25
8+
9+
### Changed
10+
11+
- Removed RunOF and replaced it with TrustedSec's COFFLoader project
12+
- Adjusted the execute_coff command to pack args instead of sending down a typed array
13+
- Added a reflective loader for the COFFLoader.dll (with Claude)
14+
- Updated execute_pe's remote loaded code to hook more exit functions and load files better (with Claude)
15+
716
## [v2.3.1] - 2025-02-11
817

918
### Changed

‎Payload_Type/apollo/Dockerfile

+1
Original file line numberDiff line numberDiff line change
@@ -20,5 +20,6 @@ COPY [".", "."]
2020

2121
# fetch all dependencies
2222
RUN cd apollo/agent_code && dotnet restore && rm donut ; cp /donut donut
23+
RUN cd apollo/agent_code && cp COFFLoader.dll /COFFLoader.dll
2324

2425
CMD ["bash", "-c", "cp /donut apollo/agent_code/donut && /venv/bin/python main.py"]

‎Payload_Type/apollo/apollo/agent_code/Apollo.sln

+330-331
Large diffs are not rendered by default.

‎Payload_Type/apollo/apollo/agent_code/Apollo/Apollo.csproj

+39-39
Original file line numberDiff line numberDiff line change
@@ -1,40 +1,40 @@
1-
<Project Sdk="Microsoft.NET.Sdk">
2-
<PropertyGroup>
3-
<TargetFramework>net451</TargetFramework>
4-
<OutputType>Exe</OutputType>
5-
<LangVersion>12</LangVersion>
6-
<Nullable>enable</Nullable>
7-
<GenerateAssemblyInfo>false</GenerateAssemblyInfo>
8-
<Platforms>AnyCPU;x64;x86</Platforms>
9-
</PropertyGroup>
10-
<ItemGroup>
11-
<Reference Include="System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL">
12-
<SpecificVersion>False</SpecificVersion>
13-
<HintPath>..\..\..\..\..\..\..\..\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll</HintPath>
14-
</Reference>
15-
<Reference Include="System.Security" />
16-
</ItemGroup>
17-
<ItemGroup>
18-
<ProjectReference Include="..\ApolloInterop\ApolloInterop.csproj" />
19-
<ProjectReference Include="..\DInvokeResolver\DInvokeResolver.csproj" />
20-
<ProjectReference Include="..\EncryptedFileStore\EncryptedFileStore.csproj" />
21-
<ProjectReference Include="..\HttpProfile\HttpProfile.csproj" />
22-
<ProjectReference Include="..\Injection\Injection.csproj" />
23-
<ProjectReference Include="..\KerberosTickets\KerberosTickets.csproj" />
24-
<ProjectReference Include="..\NamedPipeProfile\NamedPipeProfile.csproj" />
25-
<ProjectReference Include="..\PlaintextCrypto\PlaintextCryptography.csproj" />
26-
<ProjectReference Include="..\Process\Process.csproj" />
27-
<ProjectReference Include="..\PSKCrypto\PSKCryptography.csproj" />
28-
<ProjectReference Include="..\SimpleResolver\SimpleResolver.csproj" />
29-
<ProjectReference Include="..\Tasks\Tasks.csproj" />
30-
<ProjectReference Include="..\TcpProfile\TcpProfile.csproj" />
31-
<ProjectReference Include="..\WebsocketProfile\WebsocketProfile.csproj"/>
32-
33-
</ItemGroup>
34-
<ItemGroup>
35-
<PackageReference Include="Costura.Fody" Version="5.7.0" PrivateAssets="All" />
36-
<PackageReference Include="Microsoft.CSharp" Version="4.7.0" />
37-
<PackageReference Include="PolySharp" Version="1.14.1" />
38-
<PackageReference Include="System.Data.DataSetExtensions" Version="4.5.0" />
39-
</ItemGroup>
1+
<Project Sdk="Microsoft.NET.Sdk">
2+
<PropertyGroup>
3+
<TargetFramework>net451</TargetFramework>
4+
<OutputType>Exe</OutputType>
5+
<LangVersion>12</LangVersion>
6+
<Nullable>enable</Nullable>
7+
<GenerateAssemblyInfo>false</GenerateAssemblyInfo>
8+
<Platforms>AnyCPU;x64;x86</Platforms>
9+
</PropertyGroup>
10+
<ItemGroup>
11+
<Reference Include="System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL">
12+
<SpecificVersion>False</SpecificVersion>
13+
<HintPath>..\..\..\..\..\..\..\..\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll</HintPath>
14+
</Reference>
15+
<Reference Include="System.Security" />
16+
</ItemGroup>
17+
<ItemGroup>
18+
<ProjectReference Include="..\ApolloInterop\ApolloInterop.csproj" />
19+
<ProjectReference Include="..\DInvokeResolver\DInvokeResolver.csproj" />
20+
<ProjectReference Include="..\EncryptedFileStore\EncryptedFileStore.csproj" />
21+
<ProjectReference Include="..\HttpProfile\HttpProfile.csproj" />
22+
<ProjectReference Include="..\Injection\Injection.csproj" />
23+
<ProjectReference Include="..\KerberosTickets\KerberosTickets.csproj" />
24+
<ProjectReference Include="..\NamedPipeProfile\NamedPipeProfile.csproj" />
25+
<ProjectReference Include="..\PlaintextCrypto\PlaintextCryptography.csproj" />
26+
<ProjectReference Include="..\Process\Process.csproj" />
27+
<ProjectReference Include="..\PSKCrypto\PSKCryptography.csproj" />
28+
<ProjectReference Include="..\SimpleResolver\SimpleResolver.csproj" />
29+
<ProjectReference Include="..\Tasks\Tasks.csproj" />
30+
<ProjectReference Include="..\TcpProfile\TcpProfile.csproj" />
31+
<ProjectReference Include="..\WebsocketProfile\WebsocketProfile.csproj" />
32+
33+
</ItemGroup>
34+
<ItemGroup>
35+
<PackageReference Include="Costura.Fody" Version="5.7.0" PrivateAssets="All" />
36+
<PackageReference Include="Microsoft.CSharp" Version="4.7.0" />
37+
<PackageReference Include="PolySharp" Version="1.14.1" />
38+
<PackageReference Include="System.Data.DataSetExtensions" Version="4.5.0" />
39+
</ItemGroup>
4040
</Project>

‎Payload_Type/apollo/apollo/agent_code/Apollo/FodyWeavers.xml

+4-3
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
1-
<?xml version="1.0" encoding="utf-8"?>
2-
<Weavers xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="FodyWeavers.xsd">
3-
<Costura IncludeDebugSymbols='false'/>
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<Weavers xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="FodyWeavers.xsd">
3+
<Costura IncludeDebugSymbols='false'>
4+
</Costura>
45
</Weavers>

‎Payload_Type/apollo/apollo/agent_code/Apollo/Management/Files/FileManager.cs

+6
Original file line numberDiff line numberDiff line change
@@ -190,6 +190,7 @@ public bool GetFile(CancellationToken ct, string taskID, string fileID, out byte
190190
_agent.GetTaskManager().AddTaskResponseToQueue(new MythicTaskResponse()
191191
{
192192
TaskID = taskID,
193+
Status = "Fetching file...",
193194
Upload = new UploadMessage()
194195
{
195196
TaskID = taskID,
@@ -215,6 +216,11 @@ public bool GetFile(CancellationToken ct, string taskID, string fileID, out byte
215216
bRet = false;
216217
}
217218
_uploadMessageStore.TryRemove(uuid, out UploadMessageTracker _);
219+
_agent.GetTaskManager().AddTaskResponseToQueue(new MythicTaskResponse()
220+
{
221+
TaskID = taskID,
222+
Status = "Using file...",
223+
});
218224
return bRet;
219225
}
220226

0 commit comments

Comments
 (0)