Phantom-Evasion icon indicating copy to clipboard operation
Phantom-Evasion copied to clipboard

Additional Options needed - keep alive

Open anonymouz4 opened this issue 6 years ago • 6 comments

  • Issue 1 Something I noticed was that if the reverse_tcp meterpreter session died, it didn't spawn/create a new one. If this isn't in it yet, it is really important to add this quick. I know there is a post-exploitation module that should implement this but I'm not sure if that works correctly.

Rerunning the reverse_tcp shellcode every x second needs to be in the File itself! Any persistence as second file is not good. Starting the main file itself is very cpu intense due to the av bypass methods. Thats why it needs to be inside! Like this:

main(){

    junkcode()
    custom_shellcode="..."

    for(;;) {
      execute_shellcode()
      delay(10000);
    }

}

Keeping the process alive is important, but its also important that the process itself reconnects if errors happen, otherwise the process would be still alive but with broken connection >> no shell

-
-

–> Will be implemented

  • Issue 2 It would be nice to add other options besides LHost and LPort like PrependMigrate and PrependMigrateProc, just like you would in msfvenom.

    I tried to bypass this by creating c shellcode with msfvenom and choosing it instead of the default meterpreter in Phantom-Evasion but it didn't work. (compiling worked but didn't connect) I pasted the shellcode as oneline. Was that the correct way? (see this other issue)

anonymouz4 avatar Jun 10 '18 22:06 anonymouz4

I will include the possibility to add custom msfvenom option in the next release.

oddcod3 avatar Jun 11 '18 17:06 oddcod3

Will there be updates on a keepalive feature as described in the question? @oddcod3

anonymouz4 avatar Jun 15 '18 22:06 anonymouz4

@oddcod3 Any plans when the next release will come?

anonymouz4 avatar Jul 09 '18 18:07 anonymouz4

@anonymouz4 version 1.2 will be released approximately at the end of this month!

oddcod3 avatar Jul 10 '18 12:07 oddcod3

@oddcod3 I thought this would be in version 1.2? Because I can't see anything about this in the release notes?

anonymouz4 avatar Aug 08 '18 07:08 anonymouz4

@anonymouz4 this is a partial update , 1.2.1 will be released in few days with two keepalive modules (write lock & createmutex) and other stuffs i did not inclueded yet!

oddcod3 avatar Aug 08 '18 11:08 oddcod3