rvn0xsy / cooolis-ms Goto Github PK

Cooolis-ms是一个包含了Metasploit Payload Loader、Cobalt Strike External C2 Loader、Reflective DLL injection的代码执行工具，它的定位在于能够在静态查杀上规避一些我们将要执行且含有特征的代码，帮助红队人员更方便快捷的从Web容器环境切换到C2环境进一步进行工作。

Home Page: https://rvn0xsy.github.io/Cooolis-ms

License: GNU General Public License v3.0

C++ 97.87% C 0.66% Python 1.46%

metasploit cooolis-ms

cooolis-ms's Introduction

Cooolis-ms

Wiki说明

Cooolis-ms是一个包含了Metasploit Payload Loader、Cobalt Strike External C2 Loader、Reflective DLL injection的代码执行工具，它的定位在于能够在静态查杀上规避一些我们将要执行且含有特征的代码，帮助红队人员更方便快捷的从Web容器环境切换到C2环境进一步进行工作。

如何下载它？

你可以从Github直接克隆仓库获取源代码：git clone https://github.com/Rvn0xsy/Cooolis-ms
你还可以通过Release页面下载最新编译版本

基本说明

Cooolis-ms是参考了Metasploit API 文档实现了RPC服务客户端的功能，使得Cooolis-ms的服务端能够发送任意载荷，让Cooolis-ms的灵活性得以提高。
Cooolis-ms是借鉴了MemoryModule实现了PE的加载，让Cooolis-ms的执行特征得以减少，查杀几率降低。
Cooolis-ms是借鉴了ReflectiveDLLInjection实现了反射DLL的加载执行和注入，让Cooolis-ms的执行特征得以减少，查杀几率降低。
Cooolis-ms是参考了External C2 (Third-party Command and Control)实现了基本的External C2执行，让Cooolis-ms的执行特征得以减少，查杀几率降低。
Cooolis-ms还考虑到通过Aliyun OSS服务器上的文件作为执行代码，自动加载至内存运行，让Cooolis-ms的灵活性得以提高。

使用方法

目前Cooolis-ms拥有以下几个子命令：

[~\Documents\Cooolis-ms\Cooolis-ms-Loader\Release]> .\Cooolis-ms.exe -h
Version v1.2.6
Usage: C:\Users\Administrator\Documents\Cooolis-ms\Cooolis-ms-Loader\Release\Cooolis-ms.exe [OPTIONS] SUBCOMMAND

Options:
  -h,--help                   Print this help message and exit

Subcommands:
  metasploit                  Metasploit RPC Loader
  cobaltstrike                Cobalt Strike External C2 Loader
  reflective                  Reflective DLL injection
  shellcode                   Shellcode Loader

通过在子命令后添加-h/--help获取子命令对应的详细参数：

[~\Documents\Cooolis-ms\Cooolis-ms-Loader\Release]> .\Cooolis-ms.exe metasploit -h
Metasploit RPC Loader
Usage: C:\Users\Administrator\Documents\Cooolis-ms\Cooolis-ms-Loader\Release\Cooolis-ms.exe metasploit [OPTIONS]

Options:
  -h,--help                   Print this help message and exit
  -p,--payload TEXT=windows/meterpreter/reverse_tcp
                              Payload Name, e.g. windows/meterpreter/reverse_tcp
  -o,--options TEXT           Payload options, e.g. LHOST=1.1.1.1,LPORT=8866
  -P,--PORT UINT:INT in [1 - 65535]=8899 REQUIRED
                              RPC Server Port
  -H,--HOST TEXT:IPV4 REQUIRED
                              RPC Server Host

子命令使用详解

学习与扩展

你可以参考这里，写出自己的好项目

关于其他

如果你觉得这个项目不错，请给我一个Star～

issue

我要提交建议或问题

LICENSE

GNU General Public License v3.0

cooolis-ms's People

Contributors

Stargazers

Watchers

Forkers

harry1080 patrilic gavz sry309 miaochiahao t0mcat3r sasqwatch main110 1sn0m4d mkv4 eniac888 qsdj rako9000 rv0p111 fengzihk izj007 hadesangel redwifiteam hmoytx quinn-yan wbglil wh0ale greyd0g lyy0755 3snwgeek askyeye jayuugg t1r3d f8syw5v hllcaiji123 tor4k 1f3lse koushui 5l1v3r1 axax002 wolfking2 mxm-tools smitnald raystyle jjcmop fdlucifer m0tky h4xl0r optionalg bluep0int ysyyrps123 nonese cjw2478 nkingpp h1d3r ondrik8 pacejj27 hackerxj007 rakjong j5t4fun pyking nhpt evi1hack happy-everyday-sa fengjixuchui whizsail reverse-ex firekeeper123 ausecwa cyb3rk33p3r starkchristmas gysf666 aaaddress1 5h4d3s bigbroke prsood huangyuan666 hedou 3rkut exi1sh0w bigbrobro selfevo conanjun redteam-site n1f2c3 ltears o7966 gh0st0ne deepwebhacker 0x0000141 sjhgithub traxsw safebaseline luciker ykankaya istoliving y11en aasim-syed gamblingmaster2020 libaizaishuijiao lily110 n0ooooone jackbro potat0chips watch-later

cooolis-ms's Issues

请教2个问题

请教2个问题：
1为什么Coolis-ms.exe与msf联动后，进程是rundll32.exe而不是Coolis-ms.exe，是执行successfull = (*DllEntry)((HINSTANCE)code, DLL_PROCESS_ATTACH, 0)后直接进入了dllmain么，我在源码中没有找到有关rundll32.exe的信息，我看执行这句后，msf就收到数据连接成功了，后面的代码也就不执行了.
2如果dllmain中无执行信息，通过MemoryGetProcAddress（）调用相关函数才会执行一下语句是么.
//DllMain = (Module)MemoryGetProcAddress(hModule, cFunctionName);
//hThread = CooolisCreateThread(NULL, NULL, (LPTHREAD_START_ROUTINE)DllMain, NULL, NULL, &dwThread);
//WaitForSingleObject(hThread, INFINITE);
//MemoryFreeLibrary(hModule);
//return VOID();

有没有联系方式啊，想和师傅沟通下~

✈@golangniu 有没有联系方式啊，想和师傅沟通下~

请问 payload 类型支持 reverse_tcp_rc4 吗？

例如 windows/x64/meterpreter/reverse_tcp_rc4，我看 loader 里面没有 rc4 的相关内容。

我想问一下，编译出来的文件大小差很多，是我的vs的文件不够吗，麻烦了

掉线问题

用msf tcp_rc4的payload 成功上线后。只要目标网络中断过，就无法重新正常上线。
sessions 可看到但是无任何信息，应该是Encrypted: No这个问题。

server.py中py-term库存在问题

这个问题在v1.2中解决了

Workflows are referencing vulnerable actions

Hello, there!

As part of the university research we are currently doing regarding the security of Github Actions, we noticed that one or many of the workflows that are part of this repository are referencing vulnerable versions of the third-party actions. As part of a disclosure process, we decided to open issues to notify GitHub Community.

Please note that there are could be some false positives in our methodology, thus not all of the open issues could be valid. If that is the case, please let us know, so that we can improve on our approach. You can contact me directly using an email: ikoishy [at] ncsu.edu

Thanks in advance

The workflow main.yml is referencing action ilammy/msvc-dev-cmd using references v1.4.1. However this reference is missing the commit 74a501b which may contain fix to the vulnerability.

The vulnerability fix that is missing by actions' versions could be related to:
(1) CVE fix
(2) upgrade of vulnerable dependency
(3) fix to secret leak and others.
Please consider updating the reference to the action.

If you end up updating the reference, please let us know. We need the stats for the paper :-)

reflective 模式用自己的域名和VPS不行？

是一定要用阿里云的OSS吗？或者是哪个地方需要修改？