Project Ares is a Proof of Concept (PoC) loader written in C/C++ based on the Transacted Hollowing technique

Last update: Dec 14, 2022

Related tags

Overview

Project Ares

Project Ares Injector

Project Ares Injector is a Proof of Concept (PoC) loader written in C/C++ based on the Transacted Hollowing technique. The loader injects a PE into a remote process and features:

PPID spoofing
CIG to block non-Microsoft-signed binaries
Dynamic function resolution without LoadLibrary() or GetProcAddress() APIs
API hashing
Unhooks NTDLL by refreshing the .text section with a clean version from disk
Minimized use of WIN32 APIs
Basic sandbox detection
AES256 CBC encrypted payload loaded from PE resources

The loader is currently only 64-bit and only supports 64-bit payloads.

Project Ares Cryptor

Cryptor is a basic console application meant to encrypt the payload before adding it as a PE resource to the Injector. It takes a single <filepath> argument to the payload on disk, which is then encrypted and written to disk as payload.bin.

Usage

Change the encryption key in Injector/main.cpp at line 329 to a 16-byte value
Change the encryption key in Cryptor/main.cpp at line 34 to match the encryption key in Injector

Optionally, the initialization vectors can be modified, they should be 16-bytes as well:

const uint8_t iv[] = { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f };

Use Cryptor.exe to encrypt your x64 payload of choice
Add payload.bin as a resource to Injector, make sure to name it payload_bin or modify Injector/main.cpp line 324 to match the given name:

HRSRC rc = FindResource(NULL, MAKEINTRESOURCE(IDR_PAYLOAD_BIN1), L"PAYLOAD_BIN");

Profit

Note:

The default spawned process is svchost.exe The default spoofed parent process is explorer.exe

2048 written in C and compiled to WebAssembly

2048.wasm 2048 written in C and compiled to WebAssembly Play Use the arrow keys ( ᐊ ᐅ ᐃ ᐁ ) to slide the tiles. press n to play over. Usage Compile C

48 Nov 1, 2022

A simple web browser written for learning purposes in C++

AWB: Abbix's web browser pls send help AWB is a simple web browser written for learning purposes in C++, it features a custom engine named orca render

9 Jul 8, 2021

Pipy is a tiny, high performance, highly stable, programmable proxy written in C++

Pipy is a tiny, high performance, highly stable, programmable proxy. Written in C++, built on top of Asio asynchronous I/O library, Pipy is extremely lightweight and fast, making it one of the best choices for service mesh sidecars.

538 Dec 23, 2022

A Hidden and Undetectable Remote Access Tool written in C++ and Server in Python3

Spyware-RAT A Hidden and Undetectable Remote Access Tool written in C++ and Server in Python3 This program utilizes the standard winsock library for s

44 Dec 25, 2022

zrp is a nat-passthrough reverse proxy written in modern c++.

zrp is a nat-passthrough reverse proxy written in modern c++. A major use case is to expose a local server via a remote server with public IP.

12 Oct 27, 2022

Professional ARP Spoofer written with C

professional-arp-spoofer Professional ARP Spoofer written with C Note: You can sniff the traffic between any two machines in the network with the help

7 Mar 3, 2022

Pushpin is a reverse proxy server written in C++ that makes it easy to implement WebSocket, HTTP streaming, and HTTP long-polling services.

Pushpin is a reverse proxy server written in C++ that makes it easy to implement WebSocket, HTTP streaming, and HTTP long-polling services. The project is unique among realtime push solutions in that it is designed to address the needs of API creators. Pushpin is transparent to clients and integrates easily into an API stack.

3.2k Jan 2, 2023

A Rust crate that simplifies the integration of Rust and eBPF programs written in C.

This crate simplifies the compilation of eBPF programs written in C integrating clang with Rust and the cargo build system with functions that can be

19 Mar 16, 2022

AREG IoT SDK (or AREG SDK) is a real-time asynchronous communication framework written in C++ for embedded development that enables thin servers run on connected Things and provide device specific services at the edge of IoT network.

AREG IoT SDK to simplify multitasking programming Bring your product to live service enabled Introduction AREG IoT SDK (or AREG SDK) is an Object Remo

81 Jan 6, 2023

Comments

Weak encryption [ risk: medium ]

Very cool project, I have one suggestion.

CBC mode has a risk of collision, considered a weak security mode for AES context; my suggestion is to use mode GCM instead of CBC. https://github.com/Cerbersec/Ares/blob/main/Ares/Cryptor/aes.c#L501

Reference: https://vulncat.fortify.com/en/detail?id=desc.semantic.cpp.weak_encryption_insecure_mode_of_operation
wontfix

opened by CoolerVoid 1

Project Ares is a Proof of Concept (PoC) loader written in C/C++ based on the Transacted Hollowing technique

Related tags

Overview

Project Ares

Project Ares Injector

Project Ares Cryptor

Usage

You might also like...

2048 written in C and compiled to WebAssembly

A simple web browser written for learning purposes in C++

Pipy is a tiny, high performance, highly stable, programmable proxy written in C++

A Hidden and Undetectable Remote Access Tool written in C++ and Server in Python3

zrp is a nat-passthrough reverse proxy written in modern c++.

Professional ARP Spoofer written with C

Pushpin is a reverse proxy server written in C++ that makes it easy to implement WebSocket, HTTP streaming, and HTTP long-polling services.

A Rust crate that simplifies the integration of Rust and eBPF programs written in C.

AREG IoT SDK (or AREG SDK) is a real-time asynchronous communication framework written in C++ for embedded development that enables thin servers run on connected Things and provide device specific services at the edge of IoT network.

Comments

Weak encryption [ risk: medium ]

Owner

Cerbersec

An extensible, cross-platform, single-header C/C++ OpenGL loader library.

A lightweight plugin loader for Bedorck Dedicated Server

WslinkClient is a client intended to communicate with Wslink, which is a unique loader running as a server

The C++ REST SDK is a Microsoft project for cloud-based client-server communication in native code using a modern asynchronous C++ API design. This project aims to help C++ developers connect to and interact with services.

A Linux Host-based Intrusion Detection System based on eBPF.

tiny HTTP parser written in C (used in HTTP::Parser::XS et al.)

:hocho: Strictly RFC 3986 compliant URI parsing and handling library written in C89; moved from SourceForge to GitHub

An easy to use and powerful open source websocket library written in C.

A network library for client/server games written in C++

An easy-to-learn, high performance network io library written in modern cpp (c++11), It borrows concepts from Netty, and with well defined internal modules, It enables you to write rpc, http/https,websocket application with just few lines。