Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add obfuscation to C2 Profile parameters #21

Closed
checkymander opened this issue Mar 1, 2023 · 1 comment
Closed

Add obfuscation to C2 Profile parameters #21

checkymander opened this issue Mar 1, 2023 · 1 comment
Assignees
Labels
enhancement New feature or request

Comments

@checkymander
Copy link
Collaborator

C2 Profile parameters are currently stored within the executable in plaintext. This makes it trivial to pull agent configuration information out of the agent.

I should add obfuscation to c2 profiles that encrypt with a specified key (maybe make it as part of execution guardrails a la DiscerningFinch or by using the default AESPSK generated by the profile)

I can either keep this decrypted in memory, or encrypt and decrypt it at will during sleep/run scenarios.

This likely should also be included as part of a larger obfuscation effort (at the very least renaming classes, methods, and other indicators)

The main points:

  • Encrypt/Obfuscate the default profile options within the agent (e.g. the callback URL)
    • Determine how key will be generated used for encryption (e.g. how difficult do we want it to be to pull out the AESPSK?)
  • Add obfuscation to the underlying code using a tool such as ConfuserEx2 (maybe just in rename mode?)
  • Implement a more secure way to store the c2 config (e.g. encrypted embedded resource that gets deserialized into its appropriate struct?, egg hunting?)
@checkymander checkymander self-assigned this Mar 1, 2023
@checkymander checkymander added the enhancement New feature or request label Mar 1, 2023
@checkymander
Copy link
Collaborator Author

Added obfuscation as part of rewrite, now Obfuscar can obfuscate the strings in the dll

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

1 participant