/InvisibilityCloak

Proof-of-concept obfuscation toolkit for C# post-exploitation tools

Primary LanguagePython

InvisibilityCloak

Proof-of-concept obfuscation toolkit for C# post-exploitation tools. This will perform the below actions for a C# visual studio project.

  • Change the tool name
  • Change the project GUID
  • Obfuscate compatible strings in source code files based on obfuscation method entered by user
  • Removes one-line comments (e.g. // this is a comment)
  • Remove PDB string option for compiled release .NET assembly

Blog Post: https://securityintelligence.com/posts/invisibility-cloak-obfuscate-c-tools-evade-signature-based-detection

String Candidates Not Obfuscated

The below string candidates are not included in obfuscation

  • Strings less than 3 characters
  • Strings using string interpolation (e.g., Console.WriteLine($"Hello, {name}! Today is {date.DayOfWeek}, it's {date:HH:mm} now.");)
  • Case statements as they need to be static values
  • Const vars as they need to be static values
  • Strings in method signatures as they need to be static values
  • Line with " => " as used in switch statement and needs to be static value.
  • is in an if statement when doing comparison as the values compared must be static
  • Strings within Regexes
  • Override strings as they need to be static values
  • The below random edge cases for strings, as they have caused issues when encoding/decoding
    • String starting with or ending with '
    • ""' in the line
    • + @" in the line
    • """ in the line
    • "" in the line
    • Encoding.Unicode.GetString in the line
    • Encoding.Unicode.GetBytes in the line
    • Encoding.ASCII.GetBytes in the line
    • Line starting with " and ending with ")]. This is typically used for command line switches and needs to be static value.

Support Information

  • Windows
  • Linux (Debian-based systems)
  • Python3

Arguments/Options

  • -d, --directory - directory where your visual studio project is located
  • -m, --method - obfuscation method (base64, rot13, reverse)
  • -n, --name - name of your new tool
  • -h, --help - help menu
  • --version - get version of tool

Usage/Examples

Run InvisibilityCloak with string obfuscation

Base64 String Obfuscation

python InvisibilityCloak.py -d /path/to/project -n "TotallyLegitTool" -m base64

python InvisibilityCloak.py -d C:\path\to\project -n "TotallyLegitTool" -m base64

ROT13 String Obfuscation

python InvisibilityCloak.py -d /path/to/project -n "TotallyLegitTool" -m rot13

python InvisibilityCloak.py -d C:\path\to\project -n "TotallyLegitTool" -m rot13

Reverse String Obfuscation

python InvisibilityCloak.py -d /path/to/project -n "TotallyLegitTool" -m reverse

python InvisibilityCloak.py -d C:\path\to\project -n "TotallyLegitTool" -m reverse

Run InvisibilityCloak without string obfuscation

python InvisibilityCloak.py -d /path/to/project -n "TotallyLegitTool"

python InvisibilityCloak.py -d C:\path\to\project -n "TotallyLegitTool"

Signature-Based Detection Statistics

The below table shows the signature-based detection statistics between the unobfuscated and obfuscated versions of 20 popular public C# tools with InvisibilityCloak.

This is specifically for Microsoft Defender (free version), and accurate as of April 14th, 2022.

Tool Link Unobfuscated Obfuscated w/ InvisibilityCloak
ADCSPwn https://github.com/bats3c/ADCSPwn Detected Not Detected
Certify https://github.com/GhostPack/Certify Detected Not Detected
Farmer https://github.com/mdsecactivebreach/Farmer Detected Not Detected
Rubeus https://github.com/GhostPack/Rubeus Detected Detected
SafetyKatz https://github.com/GhostPack/SafetyKatz Detected Not Detected
Seatbelt https://github.com/GhostPack/Seatbelt Detected Not Detected
SharpClipboard https://github.com/slyd0g/SharpClipboard Not Detected Not Detected
SharPersist https://github.com/mandiant/SharPersist Not Detected Not Detected
SharpExec https://github.com/anthemtotheego/SharpExec Detected Not Detected
SharpGPOAbuse https://github.com/FSecureLABS/SharpGPOAbuse Detected Not Detected
SharpHound https://github.com/BloodHoundAD/SharpHound Not Detected Not Detected
SharpLogger https://github.com/djhohnstein/SharpLogger Detected Not Detected
SharpMove https://github.com/0xthirteen/SharpMove Detected Not Detected
SharpRDP https://github.com/0xthirteen/SharpRDP Detected Detected
SharpSecDump https://github.com/G0ldenGunSec/SharpSecDump Detected Not Detected
SharpUp https://github.com/GhostPack/SharpUp Not Detected Not Detected
SharpView https://github.com/tevora-threat/SharpView Detected Not Detected
SharpWMI https://github.com/GhostPack/SharpWMI Detected Not Detected
StandIn https://github.com/xforcered/StandIn Detected Not Detected
WireTap https://github.com/djhohnstein/WireTap Not Detected Not Detected

Compiled C# Tool Size Statistics

The below table shows the file sizes of 20 popular public C# tools between the unobfucated and obfuscated versions using InvisibilityCloak with various string obfuscation methods.

Tool Link Unobfuscated ROT13 String Obfuscation Base64 String Obfuscation Reverse String Obfuscation
ADCSPwn https://github.com/bats3c/ADCSPwn 718 KB 728 KB 722 KB 720 KB
Certify https://github.com/GhostPack/Certify 170 KB 198 KB 178 KB 176 KB
Farmer https://github.com/mdsecactivebreach/Farmer 13 KB 17 KB 14 KB 13 KB
Rubeus https://github.com/GhostPack/Rubeus 418 KB 605 KB 469 KB 455 KB
SafetyKatz https://github.com/GhostPack/SafetyKatz 714 KB 716 KB 948 KB 715 KB
Seatbelt https://github.com/GhostPack/Seatbelt 543 KB 904 KB 618 KB 608 KB
SharpClipboard https://github.com/slyd0g/SharpClipboard 6 KB 7 KB 6 KB 7 KB
SharPersist https://github.com/mandiant/SharPersist 231 KB 281 KB 248 KB 243 KB
SharpExec https://github.com/anthemtotheego/SharpExec 30 KB 57 KB 36 KB 34 KB
SharpGPOAbuse https://github.com/FSecureLABS/SharpGPOAbuse 70 KB 98 KB 79 KB 76 KB
SharpHound https://github.com/BloodHoundAD/SharpHound 880 KB 897 KB 885 KB 883 KB
SharpLogger https://github.com/djhohnstein/SharpLogger 19 KB 27 KB 20 KB 20 KB
SharpMove https://github.com/0xthirteen/SharpMove 41 KB 100 KB 50 KB 49 KB
SharpRDP https://github.com/0xthirteen/SharpRDP 322 KB 346 KB 326 KB 325 KB
SharpSecDump https://github.com/G0ldenGunSec/SharpSecDump 42 KB 55 KB 45 KB 43 KB
SharpUp https://github.com/GhostPack/SharpUp 35 KB 50 KB 40 KB 39 KB
SharpView https://github.com/tevora-threat/SharpView 719 KB 856 KB 742 KB 738 KB
SharpWMI https://github.com/GhostPack/SharpWMI 53 KB 92 KB 62 KB 61 KB
StandIn https://github.com/xforcered/StandIn 162 KB 294 KB 197 KB 189 KB
WireTap https://github.com/djhohnstein/WireTap 282 KB 292 KB 285 KB 284 KB

Roadmap

  • Add support for C# projects with multiple C# project files (multi-project solutions)
  • Obfuscation support for variable names and method names