search

bytecode77 / living-off-the-land

Fileless attack with persistence
https://bytecode77.com/living-off-the-land
BSD 2-Clause "Simplified" License
279 stars 52 forks source link

Is it possible to make LOTL starting 2 exes? #4

Closed badmanagerbmx closed 3 years ago

badmanagerbmx commented 3 years ago

Hi,

Thank for your work, it's working perfectly for me, but the issue I have right now is that I have one exe that is a stager, but it supposed to start the rootkit that it downloaded before, but it gets blocked by AV.

It seems quite normal to me, because it was my stager that was starting another exe, but I could not figure a solution for me.

Can you help me?

bytecode77 commented 3 years ago

Are you trying to use the Living Off The Land PoC to evade detection of the r77 Rootkit? If it's regarding the detection of r77, there is already an open issue, which I'll be investigating this week. I hope I'm able to fix it soon.

r77 is actually using the technique that the LOTL PoC implements, except it uses scheduled tasks instead of registry startup - and has an improved RunPE. You won't achieve AV evasion by encapsulating the rootkit in the LOTL demo, but I'm working on evasion of r77 at the moment. LOTL is actually just a reference implementation for a fileless persistence. If you need to implement fileless persistence for a project of yours, you can use lots of the code in the LOTL project.

But tell me, what exactly is your intention? You said you want to start two executables. That's possible (add a new line here), but what is your goal?

badmanagerbmx commented 3 years ago

Hi,

My goal is to start a stager first, that will download the files of the rookit. Its works fine. My second exe is the rootkit I downloaded, but when the stager try to execute it, even any other regular exe, it's blocked by Windows AV, and I get 1223 error..

That's the reason I asked if it was possible to start 2 exes with Living off the land exe. BR

bytecode77 commented 3 years ago

When I understand you correctly, you're trying to implement a workaround against the detection of r77 prior to an r77 update that fixes the issue.

However, using the LOTL demo to start the installer or both stager executables won't help you with this for following reasons:

Hence, it's inevitable to fix detection issues. There is no easy workaround. It's definitely good practice to start Install.exe using RunPE rather than dropping the file. But if the stager is failing due to AV detection, then I need to fix this, as it is an internal component that's not working correctly.

But as I mentioned before, evading AV detection is a daunting task and definitely not something that I can fix with a few lines of code by tomorrow. It's currently the number 1 priority for the r77 project.

What I will try next is to fiddle with the Powershell commandline of the stager, as well as the name of the scheduled tasks to see, if there is a signature based detection involved.

badmanagerbmx commented 3 years ago

Hi,

Well, I don't really get why you're talking about r77, is this an other project? Can you tell me more?

BR

bytecode77 commented 3 years ago

I just assumed that you were talking about r77, because your description somehow perfectly matched - my bad for not asking.

r77 is another project of mine, hosted here on GitHub. It's a rootkit that uses the techniques from my LOTL PoC, except using scheduled tasks instead of the registry key to retain elevated privileges across reboots.

Is this question related to issue #5 ?

badmanagerbmx commented 3 years ago

Hi,

I think we could close this issue, since the better in this situation is to make my rootkit persistent, it will be started at the next boot.