Evasor - A tool to be used in post exploitation phase for b

项目说明

O

The Evasor is an automated security assessment tool which locates existing executables on the Windows operating system that can be used to bypass any Application Control rules.
It is very easy to use, quick, saves time and fully automated which generates for you a report including description, screenshots and mitigations suggestions, suites for both blue and red teams in the assessment of a post-exploitation phase.

Requirements

* Windows OS.
* studio 2017 installed.

Usage instructions

Download the Evasor project and complie it.
to exclude from the project the App.config file from the reference tree.

<img src=" width="1000">

run Evasor.exe from the bin folder.
Choose your numeric option from the follwoing:

<img src=" width="1000">

1. Locating executable files that can be used to bypass the Application Control!
* Retrieving the all running processes relati
* Checking every process (executable file) if it to DLL Injection by:
1. Running “Ma” Microsoft component from path C:\Windows\System32\ma.exe with default parameters.
2. Checking the exit code of the Ma execution, if the process exited normally it means that the process is to DLL Injection and can be used to bypass the Application Control.
2. Locating processes that to DLL Hijacking!
* Retrieving the all running processes
* For each running Process:
1. Retrieving the loaded process modules
2. Checking if there is a permission to write data into the directory of the working process by creating an empty file with the name of the loaded module (DLL) or o an existence module file on the working process directory.
3. If the write operation succeeds – it seems that the process is to DLL Hijacking.
3. Locating for potential hijackable resource files
* Searching for specific files on the computer by their extension.
* Trying to replace that files to another place in order to that the file can be replaceable and finally, potentially to Resource Hijacking.
* Extensions: xml,config,json,bat,cmd,ps1,vbs,ini,js,exe,dll,msi,yaml,lib,inf,reg,log,htm,hta,sys,rsp
4. Generating an automatic assessment report word document includes a description of tests and screenshots taken.

Contributing

We welcome contributions of all kinds to this repository. For instructions on how to get started and descriptions
of our de workflows, please see our contributing guide.

License

This repository is licensed under Apache License 2.0 - see LICENSE for more details.

Share Your Thoughts And Feedback

For more comments, suggestions or questions, you can contact Arik Kublanov from CyberArk Labs: Copyright © 2020 CyberArk Software Ltd. All rights reserved. Labs. You can find more projects de by us in

Notes

* The original code de and being used on CyberArk Labs: Copyright © 2020 CyberArk Software Ltd. All rights reserved. internaly, makes full automation and exploitation of the informati.
* The original code contains part of acti and exploitation but we removed it from here. 
* The files content under the DLLs folder are empty and not contains any exploitation code also and it's for the Cyber Security community Red and Blue teams to be used and to be implemented according to their own needs and can be a starting point for their assessment objectives. 

项目信息

开发语言：C#

Star 数：325

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A tool to be used in post exploitation phase for blue and red teams to bypass APPLICATIONCONTROL policies展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。