search

optiv / ScareCrow

ScareCrow - Payload creation framework designed around EDR bypass.
2.71k stars 503 forks source link

Feature Request: Add service as an output format #53

Open thespicybyte opened 2 years ago

thespicybyte commented 2 years ago

It'd be nice if there was a service binary option when building a payload that we can use with services.

Tylous commented 2 years ago

What's stopping them from being used with services now?

thespicybyte commented 2 years ago

A PE that is currently built with ScareCrow does not communicate with the service control manager which will cause the service to stop, thus killing the process. If we pass the -I flag and inject into another process then we're fine but I really want some of the features that aren't support with injection at the moment.

Tylous commented 2 years ago

I will look into this for future updates.