Crystal Kit

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://rastamouse.me/crystal-kit/
• Blog Title: Crystal Kit
• Suggested Section: Windows → AV/EDR Evasion & Process Injection → API/IAT Hooking and Call-Stack Spoofing (Reflective loaders, BOFs integration)

🎯 Content Summary

What it is: Crystal Kit is an experimental red-team toolkit intended to replace Cobalt Strike’s Sleepmask/BeaconGate by moving runtime evasion into the target module via IAT hooking with Position-Independent Code (PIC). Repo: Crystal-Kit.

Why it’s needed: Sleepmask/BeaconGate both mask Beacon’s memory and proxy a limited set of Win32 APIs for Beacon/BOFs, enabling evasion techniqu...

🔧 Technical Details

IAT hooking to wrap arbitrary imports: Inject a PIC blob and patch a DLL’s IAT so targeted imported functions (e.g., CreateProcessA, LoadLibrary) resolve to attacker-controlled PIC. The PIC can perform evasion (mask/unmask memory, manipulate control flow) and then tail-call the real API.

Call-stack spoofing via PIC: Use a Draugr-style PIC stub to construct a benign call stack before invoking the intended API, frustrating call-stack analysis detections that expect canonical call paths from Beacon/BOFs.

Memory mask/unmask around sensitive APIs: As shown by Crystal Palace’s simplehook, temporarily obfuscate key memory regions before an API call and restore them after, reducing scan visibility during the critical window.

Extending evasion to post-ex DLLs: Hook LoadLibrary in post-ex DLLs to intercept module loads and blunt detections tied to specific imag...

🤖 Agent Actions

I analyzed the Crystal Kit blog and the HackTricks repository, and I didn’t find existing coverage of IAT hooking with PIC to wrap arbitrary imports for call-stack spoofing across Beacon, BOFs, and post-ex DLLs. The closest content was generic function hook bypassing/syscalls and a specific LdrLoadDll hook for AMSI, but no end-to-end technique for IAT hooking during load, PIC call-stack spoofing, or extending to post-ex DLLs via LoadLibrary hooks.

What I updated

• File: src/windows-hardening/av-bypass.md
• Added a new section: “API/IAT Hooking + Call-Stack Spoofing with PIC (Crystal Kit-style)”
  • Summarizes the approach: reflective loader stages PIC, IAT-walk to patch targeted imports, wrappers perform memory masking and call-stack spoofing, then tail-call the real API.
  • Highlights operational impact: hooking CreateProcessA for post-ex commands under call-stack detections, hooking LoadLibrary for post-ex DLLs to blunt image-load telemetry.
  • Includes a minimal IAT hook sketch and practical notes for reflective loaders and PIC.
  • Provides detection/DFIR considerations (IAT integrity checks, stack anomalies, loader telemetry).
  • References related building blocks: TitanLdr/AceLdr, simplehook, stackcutting, Draugr.
• Updated the References section with:
  • Crystal Kit blog
  • Crystal-Kit GitHub
  • Elastic call-stack analysis article
  • Crystal Palace docs, simplehook, stackcutting
  • Draugr PIC stub

Why here

• The av-bypass.md page already centralizes Windows AV/EDR evasion and process-related stealth techniques (AMSI, ETW, DLL sideloading, syscalls). It’s the most relevant place to add an “API/IAT Hooking and Call-Stack Spoofing” technique section.
• The cobalt-strike.md page already links users to the AV bypass page for detailed evasion content, so cross-linking is already covered.

Changes made

• Added the new section and references directly to av-bypass.md:
  • API/IAT Hooking + Call-Stack Spoofing with PIC (Crystal Kit-style)
  • References include:
    • https://rastamouse.me/crystal-kit/
    • https://github.com/rasta-mouse/Crystal-Kit
    • https://www.elastic.co/security-labs/call-stacks-no-more-free-passes-for-malware
    • https://tradecraftgarden.org/docs.html
    • https://tradecraftgarden.org/simplehook.html
    • https://tradecraftgarden.org/stackcutting.html
    • https://github.com/NtDallas/Draugr

No new files were created since this fit naturally into Windows AV/EDR evasion.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://rastamouse.me/crystal-kit/

Content Categories: Based on the analysis, this content was categorized under "Windows → AV/EDR Evasion & Process Injection → API/IAT Hooking and Call-Stack Spoofing (Reflective loaders, BOFs integration)".

Repository Maintenance:

• MD Files Formatting: 900 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0

[carlospolop]

merge