search

optiv / ScareCrow

ScareCrow - Payload creation framework designed around EDR bypass.
2.71k stars 503 forks source link

Binary loader build #58

Closed sly9it closed 2 years ago

sly9it commented 2 years ago

With raw msf shellcode unable to run

Tylous commented 2 years ago

Need more information in order to start troubleshooting this.

sly9it commented 2 years ago

Scarecrow is unable to create an running binary file from a metasploit shellcode (msf.bin) file

When binary is created it cannot run on windows on windows lab environment dont know why

Tylous commented 2 years ago

Is your shellcode staged or stageless?

sly9it commented 2 years ago

It is Staged

Tylous commented 2 years ago

Don't use staged shellcode. If you look at previous issues this is a known issue that staged shellcode creates problems with the binary mode in Scarecrow. Not all C2s framework's stage shellcode cause this issue but I know for sure that MSF's staged shellcode should A be avoided and doesn't play well with Scarecrows Binary mode loader.