search

optiv / ScareCrow

ScareCrow - Payload creation framework designed around EDR bypass.
2.71k stars 503 forks source link

Output to the user is incorrect when using the -O <file> option #67

Closed leebaird closed 1 year ago

leebaird commented 1 year ago

Output to the user is incorrect when using the -O option.

Example: ./Scarecrow -I beacon.bin -domain www.cisco.com -Loader msiexec -O msiexec.js

Output shows: Signing combase.dll With a Fake Cert

Kali Linux 2022.3 rolling

Tylous commented 1 year ago

Hi Lee

This is working as intended. All non-binary mode loaders require a DLL. So it builds and then stores the DLL in the file you define in the -O flag so that you can deliver and execute said DLL programmatically. In this case, when that JS file runs it will use msiexec (since you specified it) to run and load the DLL. Scarecrow generates the name randomly based on legitimate DLLs found on any windows system.