RustRedOps - Repository for advanced Red Team techniques focuse

项目说明

RustRedOps

!Rust
!Platform
!License
!Forks
!Stars

</br>

<p align="center">
<img height="200" width=350 alt="RustRedOps" src="rust.png">
</p>

</br>

RustRedOps is a repository that houses tools and projects related to Red Team operations, de in Rust. This repository is dedicated to pro effective and efficient tools for security professionals and penetration testers who want to perform security assessments and intrusion tests.

Contents

The repository is organized into several projects, each with its own purpose and functionality. Here are some examples of the projects included:

1. APC Injection
- This project exploits the Asynchronous Code Injection (APC) technique to execute malicious code in target processes.

2. API Hooking
- Demonstration on API hooking which is a programming technique that allows you to intercept and manipulate calls to Windows API functions.

3. Anti-Debug
- Techniques Anti-Debugging.

4. API Hammering
- API Hammering consists of carrying out actions to delay the malware.

5. Anti-Analysis
- Techniques Anti-Analysis.

6. Binary Info
- This is just a simple demonstration in case you want to include metadata in your Rust binary or change the associated icon.

7. Block DLL Policy
- A the loading of DLLS not signed by Microsoft.

8. Create Driver
- It's a project to demonstrate how to create a simple dri rust.

9. Create DLL
- It's a project to demonstrate how to create dll using rust.

10. Callback Code Execution
- Demonstration of shellcode execution .

11. Create UEFI
- It's a project to demonstrate how to create uefi using rust.

12. Compile Encrypt String
- Encrypting strings at compile time and decrypting them at runtime.

13. COM (Component Object Model)
- Techniques using COM interfaces.

14. Extract WIFI
- Extracting WIFI passwords using winapis is a customized form of the netsh command.

15. Encryption (Shellcode)
- Encrypting / Decrypting a shellcode using AES and RC4.

16. Enumeration Process
- Enumerating processes with Rust.

17. Execute Command
- Running commands with Rust.

18. Hells / Halos / Tartarus Gate
- Reco ssn through the Hells / Halos / Tartarus Gate techniques

19. IAT Obfuscation
- IAT obfuscation by replacing GetProcAddress and GetModuleHandle.

20. IAT Camouflage
- Technique for exporting APIs (without executing them) in order to camouflage the IAT and avoid a malicious appearance.

21. Local Payload Execution
- This project addresses the direct execution of malicious payloads in a system's local en.

22. Mapping Injection
- Code injection technique that le memory mapping, with the same underlying method applied to either local or remote processes

23. Function Stomping Injection
- In replacing legitimate functions with malicious code.

24. Thread Hijacking
- Focuses on hijacking existing threads to execute arbitrary code.

25. Local PE Injection
- Running a PE file in memory.

26. Minidump
- Dumping the lsass.exe process.

27. Module Stomping
- The Module Stomping technique focuses on injecting a shellcode into the entrypoint of the mapped or loaded DLL.

28. NTDLL Unhooking
- Running NTDLL Unhooking through a suspended process.

29. Named Pipe Server / Client
- A simple project showing how we can communicate between processes using named pipes.

30. Module O
- Module O is a technique that maps a target DLL and replaces its contents with an EXE / DLL file and then executes it.

31. Obfuscation Shellcode
- Shellcode obfuscation using IPV4, IPV6, MAC and UUIDs.

32. PPID Spoofing
- Demonstrating the PPID Spoofing technique.

33. Parsing PE Headers
- The code is focused on parsing the PE header of any Windows executable file.

34. ETW
- Patching ETW.

35. AMSI
- Patching AMSI.

36. Payload Execution Control
- Controlling payload execution through Mutex, Events and Semaphores.

37. Process Argument Spoofing
- Exploits the technique of masking or altering the arguments of a process to hide malicious activity.

38. Process Injection
- Injects a DLL or shellcode into a remote process and executes.

39. Payload Placement
- Storing a shellcode in the .text section and then executing it.

40. Process Hypnosis
- This technique focuses on controlling the execution flow of a program that is being debugged and obtaining relevant information from it, such as the creation of new threads, loaded modules, exceptions and much more. Or e a shellcode.

41. Payload Execution Fibers
- Running shellcode using Fibers.

42. Payload Staging
- This project focuses on demonstrating how to perform shellcode retrie an HTTP request and a Registry key

43. Process Ghosting
- Loading a PE file using the Process Ghosting technique.

44. Process Herpaderping
- Obscuring the intentions of a process by modifying the contents of the disk after the image has been mapped.

45. CRT
- It focuses on minimizing the use of the CRT (C Runtime Library) during runtime and applying additional flags to strip away unnecessary information from the binary.

46. Self Deletion
- Technique for deleting the running binary.

47. String Hashing
- Creating string hashes to perform hiding.

48. Syscalls
- Running direct and indirect syscall.

49. Threadless Injection
- Performing Threadless Injection using Rust.

50. WMI
- Running WMI (Windows Management Instrumentation) queries.

51. WebAssembly Shellcode
- Running shellcode through WebAssembly.

Other Rust Offensi

Here are some other examples of projects I've done with Rust:

shadow-rs

- Windows Kernel Rootkit.

coffeeldr

- COFF Loader.

rustclr

- Host CLR and run .NET binaries.

dinvk

- Dynamically invoke arbitrary code (Dinvoke).

runas

- A runas implementation with extra features.

uwd

- Call Stack Spoofing.

hypnus

- Memory Obfuscation.

Resources

Each indi project can include a features section that details the project's main features and functionalities.

You can view the installation instructions, usage and examples for each project in their respecti.

Requirements

Rust: Rust is a modern and secure programming language used to develop the tools in this repository.

Cargo: Cargo is Rust's package manager and compiler, essential for compiling and running projects.

How to get started

Follow these steps to start using the projects in this repository:

1. Clone this repository on your local machine:

2. Na to the directory of the project you are interested in:

3. Follow the project-specific installation and usage instructions as described in the README inside this directory.

Contributing to RustRedOps

To contribute to RustRedOps, follow these steps:

1. Fork this repository.
2. Create a branch: git checkout -b <branch_name>.
3. Make your changes and commit them: git commit -m '<commit_message>'.
4. Push your changes to your branch: git push origin <branch_name>.
5. Create a pull request.

Alternatively, consult the GitHub documentation on how to create a pull request.

References

I would like to express my sincere gratitude to the creators of remarkable projects and fascinating techniques, who provided me with the tools and inspiration needed to create this extraordinary repository.

* MemN0ps
* hasherezade
*
* NUL0x4C
* mrd0x
* Cracked5pider
* trickster0
* BlWasp
* CCob

License

RustRedOps is licensed under either of

Apache License, 2.0, (LICENSE-APACHE or

<)

MIT license (LICENSE-MIT or <)

at your option.

Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in RustRedOps
by you, as defined in the Apache-2.0 license, shall be dually licensed as abo any
additional terms or conditions.

Contributors

![contributors ]()

项目信息

开发语言：Rust

Star 数：1904

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Repository for advanced Red Team techniques focused on Rust展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。