TrustMeBro - Authenticode signature manipulation toolkit for Re

项目说明

TrustMeBro

Authenticode signature manipulation toolkit for Red Team operations and security research. Covers signature stealing, metadata cloning, SIP hijacking across 19 file types, Win FinalPolicy bypass, PKCS#7 payload embedding, SIP execution surface implants, and analyst-triggered persistence via OID handlers.

A in Python (cross-platform) and C++ (Windows native).

📖 Wiki — Deep-di, SIP maps, OPSEC notes, detection rules, and research notes.

> [!CAUTION]
> Registry changes are cached per-process. After running hijack, sip-exec install, or clean, you must log out and log back in or start a new process to see the effect. If signtool or Get-AuthenticodeSignature still shows the old result, close the process and open a fresh one. FinalPolicy and SIP hijack changes survi.

Repository Structure

---

How It Works

SigFlip (C), for comparison

<p align="center">
<img src="docs/01-sigflip.svg" alt="SigFlip embeds payload in certificate table padding" width="700"/>
</p>

SigStash, Direct Mode

<p align="center">
<img src="docs/02-sigstash-direct.svg" alt="SigStash embeds payload inside PKCS#7 DER unsignedAttrs" width="700"/>
</p>

SigStash, Camouflage Mode

<p align="center">
<img src="docs/03-sigstash-camouflage.svg" alt="SigStash wraps payload in fake SPC_NESTED_SIGNATURE" width="700"/>
</p>

---

Smart App Control Bypass (Win11)

TrustMeBro includes a SIP hijack for Windows 11 Smart App Control (SAC). This is a separate GUID not included in the default hijack set. You must opt in with --sac.

GUID: {18B3C141-AE0D-40F9-9465-E542AFC1ABC7}

What SAC does: Smart App Control blocks unsigned or untrusted executables from running on Win11 machines with enforcement enabled. It checks the SIP result via SrpCheckSmartlockerEAandProcessToken in wintrust.dll.

What the bypass does: Redirects the SAC SIP's CryptSIPDll to ntdll!DbgUiContinue. SAC's returns success for all files. Unsigned, unknown executables run without the "Smart App Control blocked an app" prompt.

What was obser testing:

Before hijack: SAC correctly blocked an unsigned EXE

After hijack + reboot: the unsigned EXE ran, MessageBox displayed

SAC settings UI showed "On" during the bypass. Enforcement was silently disabled at the SIP level.

How it was found: Reverse engineered from Win11 24H2 wintrust.dll . The GUID sits in the builtin SIP table at .rdata offset 0x62410. Cross-references reveal three kernel EAs: $Kernel.Smartlocker.OriginClaim, $Kernel.Purge.Smartlocker.Valid, $Kernel.Smartlocker.Hash.

Usage:

The probe command reports whether SAC is active on the target:

> Win11 only. This GUID does not exist on Win10 or Server 2019. Using --sac on those systems writes a key that has no effect.

MITRE: T1553.003 (Subvert Trust Controls: SIP and Trust Provider Hijacking) + T1562.001 (Impair Defenses: Disable or Modify Tools)

---

C++ Usage

steal

Steal signature and metadata from a donor PE. File operations only, no registry changes.

After stealing, the signature will not until you run hijack or --finalpolicy.

hijack

Install SIP or FinalPolicy persistence on the local machine. Requires admin.

> Log out and log back in after running hijack, or open a new process. SIP DLLs are cached in each process at first use. FinalPolicy and SIP hijack survi.

embed

Embed payload into a signed PE's PKCS#7 signature. The Authenticode signature remains valid.

extract

Extract embedded payload from a signed PE.

sip-exec

Install, remove, or list payload DLLs on the SIP execution surface.

> The payload DLL loads in the next process that calls Win. Log out and log back in, or start a new process, to trigger it.

Named GUID aliases: pe, ps1, jscript, , wsf, cab, catalog, appx, appx-bundle, msi, ctl, esd, sac

probe

Query local Code Integrity enforcement state. No writes. No admin required.

Reports: CI enabled, test-signing, UMCI, debug mode, flight signing, HVCI, H, Smart App Control, audit mode.

clean

Remo artifacts. Requires at least one scope flag.

> Log out and log back in after cleanup. Already-running processes retain cached .

---

Python Usage

The Python tool operates remotely by default ( for registry operations). Add --local to run on the local Windows machine using winreg.

File operations (steal, embed, extract) always run locally on whate the script is on.

Requirements: Python 3.10+, asn1crypto (for embed/extract), objcopy (for metadata cloning), impacket (for remote hijack).

steal

hijack (remote)

> Target must log out and log back in or start a new process to see the changes.

hijack (local)

Run on the local Windows machine. No IP or credentials needed.

embed / extract

sip-exec

INF-based SIP Hijack

Quick local hijack without running the EXE:

---

Beacon Object Files (Cobalt Strike + Adaptix)

8 BOFs in a separate repo: TrustMeBOF

---

SigStash (Payload Loader and Self-Extracting Stub)

Loader (SigStash/loader.cpp)

Takes a carrier PE path as an argument. Supports direct OID and camouflage mode.

Self-Extracting Stub (SigStash/stub.c)

Reads its own PE from disk. Writes payload to %TEMP%\sigstash_out.bin. No arguments needed.

---

SIPExec (Lateral Mo)

Remote command execution FinalPolicy hijack. Stages a payload DLL on the target, hijacks the trust provider registry via WMI, triggers a WMI provider load that invokes WVT, and gets a shell over a named pipe inside wmiprvse.exe. No new process is created — code runs inside the existing WMI provider host.

SIP Execution Surface

<p align="center">
<img src="docs/06-sip-exec-surface.svg" alt="SIP execution surface — DLL loads during file-type routing" width="700"/>
</p>

SIPExec Lateral Mo Flow

<p align="center">
<img src="docs/09-sipexec-flow.svg" alt="SIPExec lateral mo chain" width="700"/>
</p>

MITRE: T1553.003 (SIP and Trust Provider Hijacking) + T1047 (WMI) + T1021.002 (SMB)

See sipexec/README.md for build instructions and all options.

---

FormatGhost (Standalone Tool)

Standalone at tools/FormatGhost/. Registers a DLL as a CryptDllFormatObject handler. The DLL loads when certutil -dump or any cert UI parses a PE with the registered OID. Requires admin. Requires user interaction to trigger. See tools/FormatGhost/README.md.

---

Experimental

Research prototypes. Not production-ready.

experimental/publisher-spoof/ generates self-signed certs with chosen CN for publisher name spoofing.

experimental/dual-signerinfo/ documents kernel SignerInfo parser di (docs only).

---

Detection Rules

YARA and Sigma rules in detection/. Test your payloads against these before deployment.

| File | Format | Detects |
|---|---|---|
| trustmebro_sip_hijack.yar | YARA | SIP hijack loaders and registry exports with DbgUiContinue |
| trustmebro_sip_hijack_registry.sigma | Sigma | SIP provider registry modification |
| trustmebro_finalpolicy_hijack.sigma | Sigma | FinalPolicy under non-standard action GUID |
| trustmebro_sigstash_embed.yar | YARA | SigStash tooling and signed PEs with large WIN_CERTIFICATE |

---

Building from Source

No external dependencies for C++ tools.

---

SIP GUID Reference

Full 19-GUID map with hijack results, handler DLLs, and file-type detection methods: docs/SIP_COMPLETE_MAP.md

---

Disclaimer

This tool is for educational purposes and authorized security testing only. Misuse to attack systems without consent is illegal. The authors are not responsible for damage caused by this software.

Credits

SigFlip by med0x2e. Payload embedding table padding (C).

SignatureKid by David Lee. Signature stealing research.

MetaTwin by ThreatExpress. Binary metadata cloning.

Matt Graeber. SIP and Trust Provider research documenting the W attack surface.

项目信息

开发语言：Python

Star 数：138

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Authenticode signature manipulation toolkit for Red Team operations and security research. Covers signature stealing, metadata cloning, SIP hijacking across 19 file types, WinVerifyTrust FinalPolicy bypass, PKCS#7 payload embedding, SIP execution surface implants, Smart App Control Bypass, and analyst-triggered persistence via OID handlers.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。