/BokuLoader

Cobalt Strike User-Defined Reflective Loader written in Assembly & C for advanced evasion capabilities. By: @0xBoku & @s4ntiago_p

Primary LanguageC

BokuLoader - Cobalt Strike Reflective Loader

Cobalt Strike User-Defined Reflective Loader written in Assembly & C for advanced evasion capabilities.

Features

  • Direct NT Syscalls via HellsGate & HalosGate
  • NOHEADERCOPY - Loader will not copy headers over to beacon. Decommits the first memory page which would normally hold the headers
  • NoRWX - The Reflective loader writes beacon with Read & Write permissions and after resolving Beacons Import Table & Relocations, changes the .TEXT code section of Beacon to Read & Execute permissions
  • XGetProcAddress for resolving symbols
  • 100k UDRL Size
  • Caesar Cipher for string obfuscation

Project Origins

Usage

  1. Start your Cobalt Strike Team Server with or without a profile.
  2. Unless you only generate RAW payloads, set the stagesize to 412256 on build.sh in the artifact kit.
  3. Load the dist-template/artifact.cna Aggressor script.
  4. Go to your Cobalt Strike GUI and import the BokuLoader.cna Aggressor script.
  5. Generate your x64 payload (Attacks -> Packages -> Windows Executable (S))
  • Does not support x86 option. The x86 bin is the original Reflective Loader object file.
  1. Use the Script Console to make sure that the beacon created successfully with this User-Defined Reflective Loader
  • If successful, the output in the Script Console will look like this:

Build

  1. Run the make command after installling required dependencies
# Install brew on macOS if you need it (https://brew.sh/)
/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
# Install Ming using Brew
brew install mingw-w64
# Clone this Reflective DLL project from this github repo
git clone https://github.com/boku7/BokuLoader.git
# Compile the BokuLoader Object file
cd BokuLoader/
make
  1. Follow "Usage" instructions

Credits / References

Reflective Loader

HalosGate SysCaller

  • Reenz0h from @SEKTOR7net
    • Most of the C techniques I use are from Reenz0h's awesome courses and blogs
    • Best classes for malware development out there.
    • Creator of the halos gate technique. His work was the motivation for this work.
    • Sektor7 HalosGate Blog

HellsGate Syscaller

Cobalt Strike User Defined Reflective Loader

Great Resource for learning Intel ASM

ETW and AMSI Bypass

Implementing ASM in C Code with GCC

Cobalt Strike C2 Profile Generator