search

sliverarmory / armory

The Official Sliver Armory
https://sliver.sh/
82 stars 11 forks source link

Adding Backstab extension #16

Open precurse-bf opened 2 years ago

precurse-bf commented 2 years ago

I'd like to get Backstab added to Armory. Backstab is used to kill EDR by leveraging the ProcExp driver, which is signed by Microsoft. The project is up here: https://github.com/Yaxser/Backstab.

I created this fork (https://github.com/precurse-bf/Backstab) to add GA workflow. Once I finish up extension.json it should be good to go.

c2biz commented 2 years ago

BOF version here https://github.com/Octoberfest7/KDStab

precurse-bf commented 2 years ago

Would it makes sense for me to add it to the C2-Tool-Collection repo @c2biz ? I need to add the latest mingw version to the Github actions workflow to compile, since ubuntu-latest doesn't have a version that can properly compile the BOF version of Backstab. I figured I'd see if that repo makes most sense before I begin working on that.