chacal - Golang anti-vm framework for Red Team and Penteste

项目说明

Chacal

Golang anti- for Red Team and Pentesters

<p align="center">
<a href="
<img src=" alt="Logo" width="190" height="160">
</a>

<p align="center">
Let Chacal hidde your malware in your assalt operation!
<br />
<br />
<br />
</p>
</p>

<!-- TABLE OF CONTENTS -->
<details open="open">
<summary>Table of Contents</summary>
<ol>
<li>
<a href="#About-the-project">About The Project</a>
</li>
<li>
<a href="#Getting-started">Getting Started</a>
<ul>
<li><a href="#Dependencies">Dependencies</a></li>
<li><a href="#Installation">Installation</a></li>
</ul>
</li>
<li>
<a href="#Usage">Usage</a>
<ul>
<li><a href="#Anti-Debugging">Anti-Debugging </a></li>
<li><a href="#Anti-Memory">Anti-Memory</a></li>
<li><a href="#Anti-VM">Anti-VM</a></li>
</ul>
</li>
<li><a href="#Contact">Contact</a></li>
<li><a href="#Update">Contact</a></li>
</ol>
</details>

<!-- ABOUT THE PROJECT -->

About The Project

Chacal is an anti- written in Golang in order to support Red Team and Pentesters in your assalts, in Windows en!<br/>
!!I'm not responsible for your acts!!

<!-- GETTING STARTED -->

Getting Started

Firstly, make sure that your dependencies are satisfied.

Dependencies

Chacal has 3 dependencies:
* wmi

* go-ole

* go-ps

Installation

In your prompt type

Usage

Into your program, import the packages used by Chacal

Anti-Debugging

"github.com/p3tr0/antidebug" <br/>
Antidebug package implement strategies to avoid common programs that are used for debugging.

#### Process
antidebug.ByProcessWatcher() return boolean <br/>
This function look for common programs used for inspect process, like processhacker.exe, procmon.exe, xdbg.exe, etc. <br/>
Example:

#### Timming
antidebug.ByTimmingDiff(time, int) return boolean<br/>
Compare whether the difference between initial and end time is bigger than difference allowed (in seconds).
When debugging, some analisys use to take some time into a function.
Grab the time just in the begging of the function and later in the end, before go out, and ask Chacal to compare.<br/>
Example:

Anti-Memory

"github.com/p3tr0/antimem" <br/>
Antimem package implement strategies to avoid common programs that are used for inspect memory process.

#### Memory
antimem.ByMemWatcher() return boolean <br/>
This function look for common programs used for inspect memory, like rammap.exe, dumpit.exe, etc. <br/>
Example:

Anti-VM

"github.com/p3tr0/antivm" <br/>
Anti implement strategies to avoid en.

#### Disk size
anti( int ) return boolean <br/>
Check total size disk, in GB. <br/>
Example:

#### disk
anti() boolean <br/>
Check whether may be on disk. <br/>
Example:

#### Known MAC Address
anti() boolean <br/>
Look for known MAC Address. <br/>
Example:

Contact

LinkedIn: Test your OSINT skills ;)

Update

* 06-26-2021 : New process and MAC address added.

项目信息

开发语言：Go

Star 数：125

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Golang anti-vm framework for Red Team and Pentesters展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。