invoker - Penetration testing utility and antivirus assessme

项目说明

Invoker

Penetration testing utility and antivirus assessment tool.

Built with Studio Community 2022 v17.5.4 (64-bit) and tested on Windows 10 Enterprise OS (64-bit).

Made for educational purposes. I hope it will help!

This repository started to ha signatures and I don't have time to upload new executables each time so you should compile this project yourself.

Useful websites:

* elastic.co
* learn.microsoft.com
* processhacker.sourceforge.io
* undocumented.ntinternals.net
* pinvoke.net

To do:

* make process ghosting compatible with x86 architecture because NtCreateProcessEx doesn't work well with 32-bit processes.

Future plans:

* ~~process hollowing,~~
* process doppelgänging,
* process herpaderping,
* ~~process ghosting,~~
* more DLL proxying in,
* COM hijacking,
* Python3 script to statically obfuscate whole source code.

Things I keep in mind while coding:

* simplify e,
* ~~use dynamic allocations instead of static allocations,~~ (sometimes)
* use minimum required access rights and control flags,
* handle/catch possible errors/exceptions,
* zero-out and free arrays and memory after use,
* properly close open handles/streams after use,
* decrement reference count of libraries, objects, and similar after use,
* ~~call the garbage cleaner before exiting.~~ (not applicable)

All of the above will result in your PE having smaller size and lesser detection rate.

Table of Contents

* Invoker Library
* How to Run
* Bytecode Injection
* Generate a Reverse Shell Payload
* PowerShell
* Direct System Calls
* Make a DLL With a Hook Procedure
* Get the LocalSystem Account (NT AUTHORITY\SYSTEM)
* Images

Invoker Library

Features:

* invoke the system shells,
* ~~make direct system calls,~~
* use Windows Management Instrumentation (WMI),
* connect to a remote host,
* terminate a running process,
* run a new process,
* dump the memory of a process,
* tamper with the executable image of a process,
* inject bytecode into a process,
* inject DLL into a process,
* list loaded DLLs of a process,
* invoke DLL hijacking,
* install a hook procedure,
* enable access token pri,
* duplicate the access token of a process and run a new process,
* download a file,
* add/edit a registry key,
* schedule a task,
* list unquoted service paths and start, stop, or restart a service,
* replace multiple System32 files.

Check the Invoker library here. Feel free to use it!

---

Some features may require administrati.

Some features may not work on Windows XP and earlier because of some specific access rights and control flags used.

How to Run

Run In.exe (32-bit) or In.exe (64-bit).

To automate the reverse shell backdoor while adding persistence, run the following command:

32-bit Invoker can:

* make direct system calls,
* dump the memory of a 32-bit process,
* tamper with and inject the executable image of a 32-bit process into 32-bit process,
* tamper with and inject the executable image of a 64-bit process into 64-bit process,
* inject 32-bit bytecode into a 32-bit process,
* inject 32-bit DLL into a 32-bit process,
* list loaded DLLs of a 32-bit process,
* install a hook procedure from a 32-bit DLL.

64-bit Invoker can:

* make direct system calls,
* dump the memory of a 32-bit process,
* dump the memory of a 64-bit process,
* ~~tamper with and inject the executable image of a 32-bit process into 32-bit process,~~
* tamper with and inject the executable image of a 64-bit process into 64-bit process,
* inject 32-bit bytecode into a 32-bit process,
* inject 64-bit bytecode into a 64-bit process,
* ~~inject 32-bit DLL into a 32-bit process,~~
* inject 64-bit DLL into a 64-bit process,
* ~~list loaded DLLs of a 32-bit process,~~
* list loaded DLLs of a 64-bit process.
* ~~install a hook procedure from a 32-bit DLL,~~
* install a hook procedure from a 64-bit DLL.

Note that each injection technique has both, pros and cons; e.g. some technique requires less access rights, uses less suspicious methods, etc., but might e.g. crash the process, need some time and other special conditions to execute the payload, etc.

Note that some C2C implants might not work after releasing the memory. In that case, comment out methods like , NtFree, etc.

Bytecode Injection

Elevate pri by injecting bytecode into a higher-pri process.

This tool can download the content of a binary file in the memory and inject it into a running process. It can also parse an HTTP response and extract the payload from a custom element, e.g. from <invoker>payload</invoker> where payload is a binary code encoded in Base64.

Check the example at pastebin.com/raw/xf9Trt0d.

This is useful if antivirus is constantly deleting your local payloads.

Check an additional example at pastebin.com/raw/iW17rCxH - payload hidden in the image element.

P.S. Bytecodes provided will most certainly not work for you.

Use ngrok to give your local web server a public address.

---

To see if a process is 32-bit or 64-bit, open Task Manager -> click on More details -> go to Details tab -> right click on any of the columns -> click on Select columns -> check the Platform checkbox.

To see if a process is running with administrati, check the Elevated checkbox.

Generate a Reverse Shell Payload

Find out how to generate a reverse shell payload from my other project, as well as, how to set up Ncat and multi/handler listeners.

Bytecode injection may fail because bytecode may have bad characters, wrong exit function, or encoding; DLL injection is more reliable.

PowerShell

If you wish to run a PowerShell reverse or bind shell from the Invoker, open the Invoker and start a PowerShell session, then, run any of the one-liners (from my other project).

Direct System Calls

Direct system calls library and assembly were generated with SysWhispers2. Credits to the author!

To generate the same library and assembly, run the following command from your preferred console:

Check my wrapper around the library and assembly here. Feel free to use it!

Make a DLL With a Hook Procedure

Check the simple DLL with a hook procedure here. The hook procedure will invoke a message box on each window close.

Check the keyboard hook procedure (i.e. keylogger) here.

Check the mouse hook procedure that will run a new process on the first mouse click here.

Don't forget to remove all the created artifacts after you are done testing, e.g. remove keylogger.log, etc.

Get the LocalSystem Account (NT AUTHORITY\SYSTEM)

Follow these simple steps:

1. Run the Invoker as administrator.

2. Enable all access token pri.

3. Duplicate the access token from e.g. Local Security Authority Subsystem Service (lsass.exe) and run a new instance of the Invoker.

4. Within the new Invoker instance, open the Command Prompt and run whoami, you should now see nt authority\system.

5. Enable all access token pri once again.

6. Close the old Invoker instance.

Images

<p align="center"><img src=" alt="Invoker"></p>

<p align="center">Figure 1 - Invoker</p>

<p align="center"><img src=" alt="Bytecode Injection"></p>

<p align="center">Figure 2 - Bytecode Injection</p>

<p align="center"><img src=" alt="Elevated Pri"></p>

<p align="center">Figure 3 - Elevated Pri</p>

项目信息

开发语言：C++

Star 数：312

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Penetration testing utility and antivirus assessment tool.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。