Hacking Articles Tips Tricks Videos Tutorials

KitPloit - PenTest Tools!
ProtectMyTooling - Multi-Packer Wrapper Letting Us Daisy-Chain Various Packers, Obfuscators And Other Red Team Oriented Weaponry

https://blogger.googleusercontent.com/img/a/AVvXsEgW4rGeBRxR7etSIXkrwt8JYvnAnQj8e1PSHykrqMxAAqSZnCOabEeSwy6EAhLMlYU_U5kJT638uYpVQJwOxcBEdxlIlXg3z_AtViMn3LqZ9MsmSkqihmPJvfCwe65D_0584vC0_dBHoA3xuTZPM7O-gpvhqbProt9cAAVoKBBXbMf01lH0IcuVZYM4ig=w640-h324 Script that wraps around multitude of packers, protectors, obfuscators, shellcode loaders, encoders, generators to produce complex protected Red Team implants. Your perfect companion in Malware Development CI/CD pipeline, helping watermark your artifacts, collect IOCs, backdoor and more.
ProtectMyToolingGUI.py https://blogger.googleusercontent.com/img/a/AVvXsEh2yJbHotvIoGs6fb8gCwDVRWWwHELsTf8C79h7g4Bz3DnaTtzudETHw3775Fkivt0lLz4Vvf28QDgyEdpKUspedf9c-dsGJSomp5rDCz--wrijpE2nAYOTBVMjBh_iAPDCYPnQ8QPSR3V5KFaxiHLqPyMSVpOYZM12QV8gaWa8ntuu5CeIcDtVXvJ_iQ=w640-h514 With ProtectMyToolingyou can quickly obfuscate your binaries without having to worry about clicking through all the Dialogs, interfaces, menus, creating projects to obfuscate a single binary, clicking through all the options available and wasting time about all that nonsense. It takes you straight to the point - to obfuscate your tool.

Aim is to offer the most convenient interface possible and allow to leverage a daisy-chain of multiple packers combined on a single binary.

That's right - we can launch ProtectMyToolingwith several packers at once: C:\> py ProtectMyTooling.py hyperion,upx mimikatz.exe mimikatz-obf.exe The above example will firstly pass mimikatz.exeto the Hyperion for obfuscation, and then the result will be provided to UPX for compression. Resulting with UPX(Hyperion(file))Features* Supports multiple different PE Packers, .NET Obfuscators, Shellcode Loaders/Builders
* Allows daisy-chaining packers where output from a packer is passed to the consecutive one: callobf,hyperion,upxwill produce artifact UPX(Hyperion(CallObf(file)))* Collects IOCs at every obfuscation step so that auditing & Blue Team requests can be satisfied
* Offers functionality to inject custom Watermarks to resulting PE artifacts - in DOS Stub, Checksum, as a standalone PE Section, to file's Overlay
* Comes up with a handy Cobalt Strike aggressor script bringing protected-uploadand protected-execute-assemblycommands
* Straightforward command line usage InstallationThis tool was designed to work on Windows, as most packers natively target that platform.

Some features may work however on Linux just fine, nonetheless that support is not fully tested, please report bugs and issues.

1. First, disable your AV and add contribdirectory to exclusions. That directory contains obfuscators, protectors which will get flagged by AV and removed.
2. Then clone this repository PS C:\> git clone --recurse https://github.com/Binary-Offensive/ProtectMyTooling 1. Actual installation is straightforward:

Windows PS C:\ProtectMyTooling> .\install.ps1 Linux bash# ./install.sh GimmicksFor ScareCrowpacker to run on Windows 10, there needs to be WSLinstalled and bash.exeavailable (in %PATH%). Then, in WSL one needs to have golanginstalled in version at least 1.16:

cmd> bash
bash$ sudo apt update ; sudo apt upgrade -y ; sudo apt install golang=2:1.18~3 -y

ConfigurationTo plug-in supported obfuscators, change default options or point ProtectMyTooling to your obfuscator executable path, you will need to adjust config\ProtectMyTooling.yamlconfiguration file.

There is also config\sample-full-config.yamlfile containing all the available options for[...]

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest & Hacking Tools

ProtectMyTooling - Multi-Packer Wrapper Letting Us Daisy-Chain Various Packers, Obfuscators And Other Red Team Oriented Weaponry

10 viewsedited 12:01

Hacking Articles Tips Tricks Videos Tutorials

KitPloit - PenTest Tools!
ProtectMyTooling - Multi-Packer Wrapper Letting Us Daisy-Chain Various Packers, Obfuscators And Other Red Team Oriented Weaponry

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest & Hacking Tools

ProtectMyTooling - Multi-Packer Wrapper Letting Us Daisy-Chain Various Packers, Obfuscators And Other Red Team Oriented Weaponry

7 viewsedited 12:01

Hacking Articles Tips Tricks Videos Tutorials

ProtectMyTooling - Multi-Packer Wrapper Letting Us Daisy-Chain Various Packers, Obfuscators And Other Red Team Oriented Weaponry
http://www.kitploit.com/2022/10/protectmytooling-multi-packer-wrapper.html

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest & Hacking Tools

ProtectMyTooling - Multi-Packer Wrapper Letting Us Daisy-Chain Various Packers, Obfuscators And Other Red Team Oriented Weaponry

7 viewsedited 12:01

Hacking Articles Tips Tricks Videos Tutorials

7 views12:01

Hacking Articles Tips Tricks Videos Tutorials

Script that wraps around multitude of packers, protectors, obfuscators, shellcode loaders, encoders, generators to produce complex protected Red Team implants. Your perfect companion in Malware Development (https://www.kitploit.com/search/label/Malware%20Development) CI/CD pipeline, helping watermark your artifacts, collect IOCs, backdoor and more.
ProtectMyToolingGUI.py

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest & Hacking Tools

Leading source of security tools, hacking tools, cybersecurity and network security. Learn about new tools and updates in one place.

6 viewsedited 12:01

Hacking Articles Tips Tricks Videos Tutorials

7 views12:01

Hacking Articles Tips Tricks Videos Tutorials

With ProtectMyTooling you can quickly obfuscate your binaries without having to worry about clicking through all the Dialogs, interfaces, menus, creating projects to obfuscate a single binary, clicking through all the options available and wasting time about all that nonsense. It takes you straight to the point - to obfuscate your tool. Aim is to offer the most convenient interface possible and allow to leverage a daisy-chain of multiple packers combined on a single binary. That's right - we can launch ProtectMyTooling with several packers at once: C:\> py ProtectMyTooling.py hyperion,upx mimikatz.exe mimikatz-obf.exe
The above example will firstly pass mimikatz.exe to the Hyperion for obfuscation, and then the result will be provided to UPX for compression. Resulting with UPX(Hyperion(file)) Features Supports multiple different PE Packers, .NET Obfuscators, Shellcode Loaders/Builders Allows daisy-chaining packers where output from a packer is passed to the consecutive one: callobf,hyperion,upx will produce artifact UPX(Hyperion(CallObf(file))) Collects IOCs at every obfuscation step so that auditing & Blue Team requests can be satisfied Offers functionality to inject custom Watermarks to resulting PE artifacts - in DOS Stub, Checksum, as a standalone PE Section, to file's Overlay Comes up with a handy Cobalt Strike (https://www.kitploit.com/search/label/Cobalt%20Strike) aggressor script bringing protected-upload and protected-execute-assembly commands Straightforward command line (https://www.kitploit.com/search/label/Command%20Line) usage Installation This tool was designed to work on Windows, as most packers natively target that platform. Some features may work however on Linux just fine, nonetheless that support is not fully tested, please report bugs and issues. First, disable your AV and add contrib directory to exclusions. That directory contains obfuscators, protectors which will get flagged by AV and removed. Then clone this repository PS C:\> git clone --recurse https://github.com/Binary-Offensive/ProtectMyTooling
Actual installation is straightforward: Windows PS C:\ProtectMyTooling> .\install.ps1
Linux bash# ./install.sh
Gimmicks For ScareCrow packer to run on Windows 10, there needs to be WSL installed and bash.exe available (in %PATH%). Then, in WSL one needs to have golang installed in version at least 1.16: cmd> bash
bash$ sudo apt update ; sudo apt upgrade -y ; sudo apt install golang=2:1.18~3 -y
Configuration To plug-in supported obfuscators, change default options or point ProtectMyTooling to your obfuscator executable path, you will need to adjust config\ProtectMyTooling.yaml configuration file. There is also config\sample-full-config.yaml file containing all the available options for all the supported packers, serving as reference point. Friendly reminder If your produced binary crashes or doesn't run as expected - try using different packers chain. Packers don't guarantee stability of produced binaries, therefore ProtectMyTooling cannot as well. While chaining, carefully match output->input payload formats according to what consecutive packer expects. Usage Before ProtectMyTooling's first use, it is essential to adjust program's YAML configuration file ProtectMyTooling.yaml. The order of parameters processal is following: Firstly default parameters are used Then they're overwritten by values coming from YAML Finally, whatever is provided in command line will overwrite corresponding values There, supported packer paths and options shall be set to enable. Scenario 1: Simple ConfuserEx obfuscation Usage is very simple, all it takes is to pass the name of obfuscator to choose, input and output file paths: C:\> py ProtectMyTooling.py confuserex Rubeus.exe Rubeus-obf.exe

::::::::::.:::::::.. ... :::::::::::.,:::::: .,-::::::::::::::::
`;;;```.;;;;;;``;;;; .;;;;;;;;;;;;;;;\''';;;;\'\''',;;;'````;;;;;;;;\'\'''

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest & Hacking Tools

Leading source of security tools, hacking tools, cybersecurity and network security. Learn about new tools and updates in one place.

10 viewsedited 12:01

About

Blog

Apps

Platform