InlineWhispers2

Tool for working with Direct System Calls in Cobalt Strike's Beacon Object Files (BOF) via Syswhispers2

Based on https://github.com/outflanknl/InlineWhispers and https://github.com/helpsystems/nanodump work

Note

This project is not a fork, the first version of InlineWhispers is based on SysWhispers, this version is for the second version of SysWhispers, to understand what it changes, take a look at it:

https://github.com/jthuraisamy/SysWhispers2#difference-between-syswhispers-1-and-2

How do I set this up?

git clone https://github.com/Sh0ckFR/InlineWhispers2 && cd InlineWhispers2
cd SysWhispers2/ && python3 syswhispers.py --preset all -o syscalls_all && cd ..
python3 InlineWhispers2.py

How to use syscalls in your Cobalt-Strike BOF?

Import syscalls.c syscalls.h, syscalls-asm.h in your project and include syscalls.c to start to use syscalls

Now you can use all syscalls that you need:

#include <windows.h>
#include <stdio.h>
#include <tlhelp32.h>

#include "beacon.h"

#include "syscalls.c"

int go(char* args, int length) {
	datap  parser;
	BeaconDataParse(&parser, args, length);

	int pid = BeaconDataInt(&parser);

	BeaconPrintf(CALLBACK_OUTPUT, "	- Opening process: %d.", pid);

	HANDLE hProcess = NULL;
	OBJECT_ATTRIBUTES ObjectAttributes;
	InitializeObjectAttributes(&ObjectAttributes, NULL, 0, NULL, NULL);

	CLIENT_ID uPid = { 0 };
	uPid.UniqueProcess = (HANDLE)(DWORD_PTR)pid;
	uPid.UniqueThread = (HANDLE)0;

	NTSTATUS status = NtOpenProcess(&hProcess, PROCESS_ALL_ACCESS, &ObjectAttributes, &uPid);
	if (hProcess == NULL || status != 0) {
		BeaconPrintf(CALLBACK_OUTPUT, "	[ERROR] Failed to get processhandle, status: 0x%lx", status);
		return 0;
	}
	BeaconPrintf(CALLBACK_OUTPUT, "	- Handle: %x", hProcess);

	NtClose(hProcess);

	return 0;
}

Limitations

Actually, you can't use NtCallEnclave, NtGetCachedSigningLevel, NtSetCachedSigningLevel, NtCreateSectionEx syscalls

Known issues

[21/07/2022] The version of Syswhispers2 in this repository is not the lastest one, it will be updated later.

Blog Posts/GitHubs who used or quoted InlineWhispers2 (thanks to the authors)

Credits

@jthuraisamy for Syswhispers2
@outflanknl for the first version of InlineWhispers
@helpsystems for the nanodump exemple
@boku7 for his awesome work and his kindness
@HackingDave because he's the owner of a great DeLorean vroom vroom
The French Read The Fancy Manual community, the CyberThreatForce, and OsintFr (@sigsegv_event @CTFofficielFR and @OsintFr)
All infosec enthusiasts who share their knowledge without looking down on other enthusiasts

Fails with latest Syswhispers2 update

Hello! Thanks for taking the time to develop this tool. Unfortunately, the latest syswhispers2 update has changed its output to be split between x86 and x64 syscalls, and it has also changed the output naming. This is what Syswhispers2 looks like when run with the commands included in the README.

$ python3 syswhispers.py --preset all -o syscalls_all && cd ..

                  .                         ,--.
,-. . . ,-. . , , |-. o ,-. ,-. ,-. ,-. ,-.    /
`-. | | `-. |/|/  | | | `-. | | |-' |   `-. ,-'
`-' `-| `-' ' '   ' ' ' `-' |-' `-' '   `-' `---
     /|                     |  @Jackson_T
    `-'                     '  @modexpblog, 2021

SysWhispers2: Why call the kernel when you can whisper?

All functions selected.

Complete! Files written to:
	syscalls_all.h
	syscalls_all.c
	syscalls_all_stubs.x86.asm
	syscalls_all_stubs.x86.nasm
	syscalls_all_stubs.x86.s
	syscalls_all_stubs.x64.asm
	syscalls_all_stubs.x64.nasm
	syscalls_all_stubs.x64.s

This breaks InlineWhispers2, because it now fails to read the correct output file when run.

$ python3 InlineWhispers2.py
.___       .__  .__              __      __.__    .__                                   ________
|   | ____ |  | |__| ____   ____/  \    /  \  |__ |__| ____________   ___________  _____\_____  \
|   |/    \|  | |  |/    \_/ __ \   \/\/   /  |  \|  |/  ___/\____ \_/ __ \_  __ \/  ___//  ____/
|   |   |  \  |_|  |   |  \  ___/\        /|   Y  \  |\___ \ |  |_> >  ___/|  | \/\___ \/       \
|___|___|  /____/__|___|  /\___  >\__/\  / |___|  /__/____  >|   __/ \___  >__|  /____  >_______ \
         \/             \/     \/      \/       \/        \/ |__|        \/           \/        \/

Sh0ckFR - https://twitter.com/Sh0ckFR

Traceback (most recent call last):
  File "/Users/davidmckennirey/tools/InlineWhispers2/InlineWhispers2.py", line 120, in <module>
    create_asm_file()
  File "/Users/davidmckennirey/tools/InlineWhispers2/InlineWhispers2.py", line 52, in create_asm_file
    with open('SysWhispers2/syscalls_all_stubs.asm', 'r') as file:
FileNotFoundError: [Errno 2] No such file or directory: 'SysWhispers2/syscalls_all_stubs.asm'

sh0ckfr / inlinewhispers2 Goto Github PK