sliver icon indicating copy to clipboard operation
sliver copied to clipboard

Add Ekko / Sleep Obfuscation on beacon generation

Open armysick opened this issue 1 year ago • 0 comments

Description

Support in-memory sleep obfuscation of beacon for Windows. Issue also requested and talked about in discussion https://github.com/BishopFox/sliver/discussions/1171

Wanted solution Based on the work of https://github.com/scriptchildie/goEkko, adapted from https://github.com/Cracked5pider/Ekko, pause Go runtime and encrypt the beacon's memory region with the Ekko technique.

Add command argument -B / --sleep-obfuscation on generate beacon to support this feature.

Additional context Pull Request submitted in https://github.com/BishopFox/sliver/pull/1805

armysick avatar Oct 31 '24 14:10 armysick