inceptor - Template-Driven AV/EDR Evasion Framework

项目说明

:triangular_flag_on_post: This is the public repository of Inceptor, for latest and updates please consider supporting us through

<h1 align="center">
<br>
<img src=./images/inceptor-logo.png >
<br>
</h1>

:triangular_flag_on_post: Sponsors

If you want to sponsors this project and have the latest updates on Inceptor, latest issues fixed, latest features, please support us on

Official Discord Channel

Come hang out on Discord!

![Porchetta Industries]()

Table of content

* O
* Installation
* Usage

News

NW: We're currently working to improve the template engine! As soon as we release the next , instructions on how
to use, customize, and extend the tool, will be a in the [Wiki][13].

O

Modern Penetration testing and Red Teaming often requires to bypass common AV/EDR appliances in order to execute code
on a target. With time, defenses are becoming more complex and inherently more difficult to bypass consistently.

Inceptor is a tool which can help to automate great part of this process, hopefully requiring no further effort.

Features

Inceptor is a template-based PE packer for Windows, designed to help penetration testers and red teamers to bypass
common AV and EDR solutions. Inceptor has been designed with a focus on usability, and to allow extensive user
customisation.

To have a good o of what it was implemented and why, it might be useful to tak a look to the following resources:

* The path to code execution in the era of EDR, Next-Gen AVs, and AMSI
* Inceptor - Bypass AV-EDR solutions combining well known techniques

Shellcode Transformation/Loading

Inceptor is able to convert existing EXE/DLL into shellcode using open-source con:

* Donut: Donut is "The Con". This tool is more like a piece of art by [TheWover][3],
and can be used to transform Nati, DLL, and .Net binaries into position independent code shellcode.
* sRDI: By [Monoxgas][4], this tool can convert existing naticcve DLL into PIC, which can then be injected as regular shellcode.
* Pe2Sh: By [Hasherazade][5], this tool can convert an existing native
EXE into PIC shellcode, which can also be run as a normal EXE.

LI Encoders vs LD Encoders

Inceptor can encode, compress, or encrypt shellcode using different means. While de the tool, I started differentiating
between what I call loader-independent (LI) encoding, and loader-dependent (LD) encoding.

Loader-independent encoding is a type of encoding not managed by the template chosen by the user (loader). This usually
means that the decoding stub is not part of the template, but embedded in the shellcode itself.
Inceptor offers this kind of feature using the open-source tool sgn, which is used to
make the payload polymorphic and undetectable using common signature detection.

E at it is, Shikata-Ga-Nai is not really suitable for certain templates. For this reason,
Inceptor also implements Loader-dependent encoders, which are designed to let the loader taking care of
the decoding. As such, LD encoders install the decoding stub directly in the template.
This kind of encoders, as implemented within Inceptor, are also "Chainable", meaning they can be chained together to
encode a payload.

While using a chain of encoders can sometimes improve the obfuscation of a gi,
this technique can also expose multiple decoding routines, which can help Defenders to design
signatures against them. For this reason, Inceptor offers multiple ways to obfuscate the final
artifacts, hardening the RE process.

At the time of writing, the public of Inceptor has been provided with the following encoders/compressors/encryptors:

Inceptor can an encoding chain both statically and dynamically, statically checking the decoders'
input/output types, and also dynamically the implementation with an independent implementation.

At any time, a user can easily a chain using the chain-.py utility.

A Mechanisms

Inceptor also natively implements A mechanisms, and as such, it offers the possibility to include A
features to the payload in the form of "modules" (plugins).

The plugins which can be embedded are:

* [x] AMSI bypass
* [x] WLDP bypass
* [x] ETW bypass
* [x] Sandbox (Beha) Deception

EDR E Mechanisms

Inceptor also implements EDR E mechanisms, such as full unhooking, direct syscall in and manual DLL mapping.
Direct Syscalls are implemented in C# using the outstanding "[DInvoke][9]" project,
again by [TheWover][1].
In C/C++, Syscalls are implemented using [SysWhispers][7] and [SysWhispers2][8] projects, by [Jackson_T][6]. In addition,
Inceptor has built-in support for x86 Syscalls as well.

As the A features, these features can be enabled as modules, with the only difference that they require
operating on a template which supports them. The techniques implemented so far are:

* [x] Full Unhooking
* [x] Manual DLL Mapping
* [x] Direct Syscalls

Obfuscation

Inceptor supports payload obfuscation by using external utils, such as ConfuserEx
and Chameleon, and provides support for C/C++ obfuscation using LL, which
is an IR-based obfuscator using the LL platform.

Code Signing

Another feature of Inceptor is that it can code sign the resulting binary/dll by using the tool [CarbonCopy][10]
Usually, files signed with code signing certificates are less strictly analysed. Many anti-malware products
don't / these certificates.

Workflow

The full workflow can be summarized in the following high-level, and simplified scheme:

!Workflow

<!-- install -->

Installation

Inceptor has been designed to work on Windows. The update-config.py utility can locate the required Microsoft binaries
and update the configuration accordingly. It might be required to install Microsoft Build Tools, the Windows SDK,
and Studio, update-config.py will guide the user on how to install the required dependencies.

<!-- installstop -->

Useful Notes

#### Default Loaders

The current of Inceptor locates a specific template using a simple naming con (don't change template names),
and the set of arguments given by the user. Among the arguments, there is also the loader (-t). If not specified, the loader
will be picked-up as a function of the file to pack, following this simple schema:

#### Template name con

It's very important to understand also the template name con, to avoid misinterpreting an artifact behaviour.

* Classic: a classic template usually means it uses the / and CreateThread/CreateRemoteThread
API to allocate and execute arbitrary code
* Dinvoke: if a template contains only dinvoke (e.g classic-dinvoke.cs), it means it uses dynamic function resolution
feature of dinvoke
* din: a template containing dinvoke followed by another keyword is using a particular feature of
dinvoke, like manual_mapping, o, or syscalls
* Syscalls: as the name suggest, this template is using syscalls
* PE Load: this template tries to map a full PE into memory, without transforming it
* Assembly Load: this template tries to execute a .NET assembly using reflection

<!-- usage -->

Usage

<!-- usagestop -->

Next De

* New Template Engine
* New Templates
* New Encoders
* C# Code-Based obfuscation

Resources

* Inceptor - Bypass AV-EDR solutions combining well known techniques
* A tale of EDR bypass methods

[1]:
[2]:
[3]:
[4]:
[5]:
[6]:
[7]:
[8]:
[9]:
[10]:
[11]:
[12]:
[13]:

项目信息

开发语言：Assembly

Star 数：1828

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Template-Driven AV/EDR Evasion Framework展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。