OffensiveRust - Rust Weaponization for Red Team Engagements.

项目说明

<p align="center">
<img height="500" alt="Offensi" src="
</p>

Offensi

My experiments in weaponizing Rust for implant de and general offensi.

Table of Contents

Offensi

* Why Rust?
* Examples in this repo
* Compiling the examples
* Compiling the examples in this repo
* Cross Compiling
* Optimizing executables for size
* Pitfalls I found myself falling into
* Interesting Rust Libraries
* Opsec
* Other projects I have have made in Rust
* Projects in Rust that can be hepfull

Why Rust?

It is faster than languages like C/C++

It is multi-purpose language, bearing excellent communities

It has an amazing inbuilt dependency build management called Cargo

It is LL which makes it a very good candidate for bypassing static A

Super easy cross compilation to Windows from *nix/MacOS, only requires you to install the mingw toolchain, although certain libraries cannot be compiled successfully in other OSes.

Examples in this repo

| File | Description |
|--------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Allocate_With_Syscalls | It uses NTDLL functions directly with the ntapi Library |
| Create_DLL | Creates DLL and pops up a msgbox, Rust does not fully support this so things might get weird since Rust DLL do not have a main function |
| De | Opens dri and executing De |
| EnableDebugPri | Enable SeDebugPri in the current process |
| Shellcode_Local_inject | Executes shellcode directly in local process by casting pointer |
| Execute_With_CMD | Executes cmd by passing a command via Rust |
| ImportedFunctionCall | It imports minidump from dbghelp and executes it |
| Kernel_Dri | Kernel Dri for a simple buffer o |
| Named_Pipe_Client | Named Pipe Client |
| Named_Pipe_Server | Named Pipe Server |
| PEB_Walk | Dynamically resolve and invoke Windows APIs |
| Process_Injection_CreateThread | Process Injection in running process with CreateThread |
| Process_Injection_CreateRemoteThread | Process Injection in remote process with CreateRemoteThread |
| Process_Injection_Self_EnumSystemGeoID | Self injector that uses the EnumSystemsGeoID API call to run shellcode. |
| Unhooking | Unhooking calls |
| asm_syscall | Obtaining PEB address via asm |
| base64_system_enum | Base64 encoding/decoding strings |
| http-https-requests | HTTP/S requests by ignoring cert check for GET/POST |
| patch_etw | Patch ETW |
| ppid_spoof | Spoof parent process for created process |
| tcp_ssl_client | TCP client with SSL that ignores cert check (Requires openssl and perl to be installed for compiling) |
| tcp_ssl_server | TCP Server, with port parameter(Requires openssl and perl to be installed for compiling) |
| wmi_execute | Executes WMI query to obtain the AV/EDRs in the host |
| Windows.h+ Bindings | This file contains structures of Windows.h plus complete customized LDR,PEB,etc.. that are undocumented officially by Microsoft, add at the top of your file include!("../bindings.rs"); |
| UUID_Shellcode_Execution | Plants shellcode from UUID array into heap space and uses EnumSystemLocalesA Callback in order to execute the shellcode. |
| AMSI Bypass | AMSI Bypass on Local Process |
| Injection_AES_Loader | NtTestAlert Injection with AES decryption |
| Litcrypt_String_Encryption | Using the Litcrypt crate to encrypt literal strings at rest and in memory to defeat static AV. |
| Api Hooking | Api Hooking using detour library |
| memfd_create | Execute payloads from memory using the memfd_create technique (For Linux) |
| RC4_Encryption | RC4 Decrypted shellcode |
| Steal Token | Steal Token From Process|
| Keyboard Hooking | Keylogging by hooking keyboard with SetWindowsHookEx |
| memN0ps arsenal: shellcode_runner_classic-rs | Classic shellcode runner/injector using ntapi |
| memN0ps arsenal: dll_injector_classic-rs | Classic DLL Injection using windows-sys |
| memN0ps arsenal: module_stomping-rs | Module Stomping / Module O / DLL Hollowing using windows-sys |
| memN0ps arsenal: obfuscate_shellcode-rs | Simple shellcode XOR and AES obfuscator |
| memN0ps arsenal: process_hollowing-rs | Process Hollowing using ntapi |
| memN0ps arsenal: rdi-rs | Reflective DLL Injection using windows-sys |
| memN0ps: eagle-rs | Rusty Rootkit: Windows Kernel Driver in Rust for Red Teamers using winapi and ntapi |
| memN0ps: psyscalls-rs | Rusty Parallel Syscalls library using winapi |
| memN0ps: mmapper-rs | Rusty Manual Mapper using winapi |
| memN0ps: srdi-rs | Rusty Shellcode Reflective DLL Injection using windows-sys |
| memN0ps: mordor-rs - freshycalls_syswhispers | Rusty FreshyCalls / SysWhispers1 / SysWhispers2 / SysWhispers3 library using windows-sys |
| memN0ps: mordor-rs - hells_halos_tartarus_gate | Rusty Hell's Gate / Halo's Gate / Tartarus' Gate Library using windows-sys |
| memN0ps: pemadness-rs | Rusty Portable Executable Parsing Library (PE Parsing Library) using windows-sys |
| memN0ps: mimiRust | Mimikatz made in Rust by . The original author deleted their GitHub account, so it's been uploaded for community use. |
| memN0ps and trickster0: ekko-rs | Rusty Ekko - Sleep Obfuscation in Rust using windows-sys. |

Compiling the examples in this repo

This repository does not provide binaries, you're gonna have to compile them yourself.

Install Rust
Simply download the binary and install.

This repo was compiled in Windows 10 so I would stick to it. As mentioned OpenSSL binaries will ha issues that will require OpenSSL and perl to be installed.
For the TCP SSL client/server I recommend static build due to dependencies on the hosts you will execute the binaries.
For creating a project, execute:
cargo new <name>
This will automatically create the structured project folders with:

Cargo.toml is the file that contains the dependencies and the configuration for the compilation.
main.rs is the main file that will be compiled along with any potential directories that contain libraries.

For compiling the project, go into the project directory and execute:
cargo build

This will use your default toolchain.
If you want to build the final "release" execute:
cargo build --release

For static binaries, in terminal before the build command execute:
"C:\Program Files (x86)\Microsoft Studio\2019\Community\\Build\.bat"
set RUSTFLAGS=-C target-feature=+crt-static

In case it does not feel easy for you to read my code the way it is written,
you can also you the below command inside the project directory to format it in a better way
cargo fmt

Certain examples might not compile and give you some error, since it might require a nightly
build of Rust with the latest features. To install it just do:
rustup default nightly

The easiest place to find the dependencies or Crates as they are called.

Cross Compiling

Cross-Compiling requires to follow the instructions here
By installing different toolchains, you can cross compile with the below command
cargo build --target <toolchain>

To see the installed toolchains on your system do:
rustup toolchain list

For checking all the a toolchains you can install in your system do:
rustup target list

For installing a new toolchain do:
rustup target add <toolchain_name>

Optimizing executables for size

This repo contains a lot of configuration options and ideas about reducing the file size.
Static binaries are usually quite big.

Pitfalls I found myself falling into

Careful of \0 bytes, do not forget them for strings in memory, I spent a lot of my time but windbg always helped resolving it.

Interesting Rust libraries

WINAPI

WINAPI2

Windows - This is the official Microsoft one that I have not played much with

OPSEC

E Rust has good ad it is quite difficult to get used to it and it ain't very intuitive.

Shellcode generation is another issue due to LLVM. I ha a few ways to approach this.

Donut sometimes does generate shellcode that works but depending on how the project is made, it might not.
In general, for shellcode generation the tools that are made should be made to host all code in .text segment,
which leads to this amazing repo.
There is a shellcode sample in this project that can show you how to structure your code for successfull shellcode generation.
In addition, this project also has a shellcode generator that grabs the .text segment of a binary and
and dumps the shellcode after executing some patches.
This project grabs from a specific location the binary so I made a fork that receives the path of the binary as an argument here.

Even if you remove all debug symbols, rust can still keep references to your home directory in the binary. The only way I' to remove this is to pass the following flag: --remap-path-prefix {your home directory}={some random identifier}. You can use bash to get your home directory and generate a random placeholder: --remap-path-prefix "$HOME"="$RANDOM". (By Yamakadi)

Although for the abo is another way to remove info about the home directory by adding at the top of Cargo.toml

cargo-features = ["strip"] .
Since Rust by default leaves a lot of things as strings in the binary, I mostly use this cargo.toml to avoid them and also reduce size
with build command
cargo build --release -Z build-std=std,panic_abort -Z build-std-features=panic_immediate_abort --target x86_64-pc-windows-msvc

[Yamakadi] , also pointed out that depending on the imported libraries, stripping is not always consistent on hiding the home directory, so a combination of his solution to remap the path and use teh abo would work best. Try to be aware and check your binaries before executing them to your engagements for potential strings that are not stripped properly.

Other projects I have have made in Rust

UDPlant - Basically a UDP reverse shell

EDR Detector - Detects the EDRs of the installed system according to the .sys files installed

Lenum - A simple unix enumeration tool

Projects in Rust that can be hepfull

houdini - Helps make your executable self-delete

项目信息

开发语言：Rust

Star 数：3029

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Rust Weaponization for Red Team Engagements.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。