Thread by @an0n_r0

Built a special JS stager for Cobalt Strike (or for anything else).

Actually it is based on C# .NET, and it is super simple (full source is on the screenshot) because it uses the PE mapper from DInvoke.

Currently managed to bypass Defender.

Sharing some details in this thread.

First, I started from a stageless Cobalt Strike beacon payload generated using my custom Artifact Kit, already including some advanced evasion features what I didn't want to rewrite again.

That's why I turned to PE staging instead of the common shellcode loading technique.

Luckily, DInvoke (besides other super features) supports manual PE mapping of unmanaged code from managed .NET projects out-of-the-box.

thewover.github.io/Dynamic-Invoke/

The only difficulty in using DInvoke is that it is flagged by most AV products.

My final goal was to create a JS initial payload. Here comes GadgetToJScript in the picture.

github.com/med0x2e/Gadget…

It is an awesome tool for building JS payloads from .NET assemblies, but there were issues about packaging the stager assembly and the DInvoke module together.

What worked for me after a long trial and error process: used ILMerge for linking the SimpleStager.exe and DInvoke.dll assemblies together.

github.com/dotnet/ILMerge

Other solutions (Costura Fody or ConfuserEx compressor) were failing in the GadgetToJScript deserialization phase.

After merging the assemblies, applied ConfuserEx 2 for obfuscation in order to make the job of AV harder.

mkaring.github.io/ConfuserEx/

Had to play with various features (what to add and what not) in order to make GadgetToJScript deser. working (and AV happy at the same time :) ).

Finally, the SimpleStager with DInvoke, merged with ILMerge, obfuscated with ConfuserEx 2, and packed into JS with GadgetToJScript, bypassed Defender with my Cobalt Strike stageless DLL payload (of course built with custom Artifact Kit including advanced evasion features).

As a sidenote, for GadgetToJScript against Defender, some basic tweak to the default template was needed. Nothing fancy, just a slight modification. :)

https://twitter.com/an0n_r0/status/1633620693504913408

Last note: for convenience, the whole build process could be automated by adding NuGet packages and/or including dependent projects and adding the appropriate configuration in the Visual Studio Solution.