OffensiveRust - Rust Weaponization For Red Team Engagements


[![](https://3.bp.blogspot.com/-WW8HVEs4db8/YZ3Ud9yQdyI/AAAAAAAA4XQ/JbQYCnOkMD4oWTbmvgtvT4QXOKk9-MiUgCK4BGAYYCw/s320/OffensiveRust_1_offensiverust-785423.png)](<https://3.bp.blogspot.com/-WW8HVEs4db8/YZ3Ud9yQdyI/AAAAAAAA4XQ/JbQYCnOkMD4oWTbmvgtvT4QXOKk9-MiUgCK4BGAYYCw/s1600/OffensiveRust_1_offensiverust-785423.png>) My experiments in weaponizing [Rust](<https://www.rust-lang.org/> "Rust" ) for implant development and general offensive operations. ## Why Rust? * It is faster than languages like C/C++ * It is multi-purpose language, bearing excellent communities * It has an amazing inbuilt dependency build [management](<https://www.kitploit.com/search/label/Management> "management" ) called Cargo * It is LLVM based which makes it a very good candidate for [bypassing](<https://www.kitploit.com/search/label/Bypassing> "bypassing" ) static AV detection * Super easy cross compilation to Windows from *nix/MacOS, only requires you to install the `mingw` toolchain, although certain libraries cannot be compiled successfully in other OSes. ## Examples in this repo File | Description ---|--- [Allocate_With_Syscalls](<https://github.com/trickster0/OffensiveRust/blob/master/Allocate_With_Syscalls/src/main.rs> "Allocate_With_Syscalls" ) | It uses NTDLL functions directly with the ntapi Library [Create_DLL](<https://github.com/trickster0/OffensiveRust/blob/master/Create_DLL/src/lib.rs> "Create_DLL" ) | Creates DLL and pops up a msgbox, Rust does not fully support this so things might get weird since Rust DLL do not have a main function [DeviceIoControl](<https://github.com/trickster0/OffensiveRust/blob/master/DeviceIoControl/src/main.rs> "DeviceIoControl" ) | Opens driver handle and executing DeviceIoControl [EnableDebugPrivileges](<https://github.com/trickster0/OffensiveRust/blob/master/EnableDebugPrivileges/src/main.rs> "EnableDebugPrivileges" ) | Enable SeDebugPrivilege in the current process [Shellcode_Local_inject](<https://github.com/trickster0/OffensiveRust/blob/master/Shellcode_Local_inject/src/main.rs> "Shellcode_Local_inject" ) | Executes shellcode directly in local process by casting pointer [Execute_With_CMD](<https://github.com/trickster0/OffensiveRust/blob/master/Execute_Without_Create_Process/src/main.rs> "Execute_With_CMD" ) | Executes cmd by passing a command via Rust [ImportedFunctionCall](<https://github.com/trickster0/OffensiveRust/blob/master/ImportedFunctionCall/src/main.rs> "ImportedFunctionCall" ) | It imports minidump from dbghelp and executes it [Kernel_Driver_Exploit](<https://github.com/trickster0/OffensiveRust/blob/master/Kernel_Driver_Exploit/src/main.rs> "Kernel_Driver_Exploit" ) | Kernel Driver exploit for a simple buffer overflow [Named_Pipe_Client](<https://github.com/trickster0/OffensiveRust/blob/master/Named_Pipe_Client/src/main.rs> "Named_Pipe_Client" ) | Named Pipe Client [Named_Pipe_Server](<https://github.com/trickster0/OffensiveRust/blob/master/Named_Pipe_Server/src/main.rs> "Named_Pipe_Server" ) | Named Pipe Server [Process_Injection_CreateThread](<https://github.com/trickster0/OffensiveRust/blob/master/Process_Injection_CreateThread/src/main.rs> "Process_Injection_CreateThread" ) | Process Injection in remote process with CreateRemoteThread [Unhooking](<https://github.com/trickster0/OffensiveRust/blob/master/Unhooking/src/main.rs> "Unhooking" ) | Unhooking calls [asm_syscall](<https://github.com/trickster0/OffensiveRust/blob/master/asm_syscall/src/main.rs> "asm_syscall" ) | Obtaining PEB address via asm [base64_system_enum](<https://github.com/trickster0/OffensiveRust/blob/master/base64_system_enum/src/main.rs> "base64_system_enum" ) | Base64 encoding/decoding strings [http-https-requests](<https://github.com/trickster0/OffensiveRust/blob/master/http-https-requests/src/main.rs> "http-https-requests" ) | HTTP/S requests by ignoring cert check for GET/POST [patch_etw](<https://github.com/trickster0/OffensiveRust/blob/master/patch_etw/src/main.rs> "patch_etw" ) | Patch ETW [ppid_spoof](<https://github.com/trickster0/OffensiveRust/blob/master/ppid_spoof/src/main.rs> "ppid_spoof" ) | Spoof parent process for created process [tcp_ssl_client](<https://github.com/trickster0/OffensiveRust/blob/master/tcp_ssl_client/src/main.rs> "tcp_ssl_client" ) | TCP client with SSL that ignores cert check (Requires openssl and perl to be installed for compiling) [tcp_ssl_server](<https://github.com/trickster0/OffensiveRust/blob/master/tcp_ssl_server/src/main.rs> "tcp_ssl_server" ) | TCP Server, with port parameter(Requires openssl and perl to be installed for compiling) [wmi_execute](<https://github.com/trickster0/OffensiveRust/blob/master/wmi_execute/src/main.rs> "wmi_execute" ) | Executes WMI query to obtain the AV/EDRs in the host [Windows.h+ Bindings](<https://github.com/trickster0/OffensiveRust/blob/master/bindings.rs> "Windows.h+ Bindings" ) | This file contains structures of Windows.h plus complete customized LDR,PEB,etc.. that are undocumented officially by Microsoft, add at the top of your file include!("../bindings.rs"); [UUID_Shellcode_Execution](<https://github.com/trickster0/OffensiveRust/blob/master/UUID_Shellcode_Execution/src/main.rs> "UUID_Shellcode_Execution" ) | Plants shellcode from UUID array into heap space and uses `EnumSystemLocalesA` Callback in order to execute the shellcode. ## Compiling the examples in this repo This repository does not provide binaries, you're gonna have to compile them yourself. [Install Rust](<https://www.rust-lang.org/tools/install> "Install Rust" ) Simply download the binary and install. This repo was compiled in [Windows 10](<https://www.kitploit.com/search/label/Windows%2010> "Windows 10" ) so I would stick to it. As mentioned OpenSSL binaries will have depencency issues that will require OpenSSL and perl to be installed. For the TCP SSL client/server I recommend static build due to dependencies on the hosts you will execute the binaries. For creating a project, execute: `cargo new <name>` This will automatically create the structured project folders with: project ├── Cargo.toml └── src └── main.rs Cargo.toml is the file that contains the dependencies and the configuration for the compilation. main.rs is the main file that will be compiled along with any potential directories that contain libraries. For compiling the project, go into the project [directory](<https://www.kitploit.com/search/label/Directory> "directory" ) and execute: `cargo build` This will use your default toolchain. If you want to build the final "release" version execute: `cargo build --release` For static binaries, in terminal before the build command execute: `"C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\VC\Auxiliary\Build\vcvars64.bat"` `set RUSTFLAGS=-C target-feature=+crt-static` In case it does not feel easy for you to read my code the way it is written, you can also you the below command inside the project directory to format it in a better way `cargo fmt` Certain examples might not compile and give you some error, since it might require a nightly build of Rust with the latest features. To install it just do: `rustup default nightly` The easiest place to find the dependencies or [Crates](<https://crates.io/> "Crates" ) as they are called. ## Cross Compiling Cross-Compiling requires to follow the instructions [here](<https://rust-lang.github.io/rustup/cross-compilation.html> "here" ) By installing different toolchains, you can cross compile with the below command `cargo build --target <toolchain>` To see the installed toolchains on your system do: `rustup toolchain list` For checking all the available toolchains you can install in your system do: `rustup target list` For installing a new toolchain do: `rustup target add <toolchain_name>` ## Optimizing executables for size This [repo](<https://github.com/johnthagen/min-sized-rust> "repo" ) contains a lot of configuration options and ideas about reducing the file size. Static binaries are usually quite big. ## Pitfalls I found myself falling into Careful of \0 bytes, do not forget them for strings in memory, I spent a lot of my time but windbg always helped resolving it. ## Interesting Rust libraries * WINAPI * [WINAPI2](<https://github.com/MauriceKayser/rs-winapi2> "WINAPI2" ) * Windows - This is the official Microsoft one that I have not played much with ## OPSEC * Even though Rust has good advantages it is quite difficult to get used to it and it ain't very intuitive. * Shellcode generation is another issue due to LLVM. I have found a few ways to approach this. [Donut](<https://github.com/TheWover/donut> "Donut" ) sometimes does generate shellcode that works but depending on how the project is made, it might not. In general, for shellcode generation the tools that are made should be made to host all code in .text segment, which leads to this amazing [repo](<https://github.com/b1tg/rust-windows-shellcode> "repo" ). There is a shellcode sample in this project that can show you how to structure your code for successfull shellcode generation. In addition, this project also has a shellcode generator that grabs the .text segment of a binary and and dumps the shellcode after executing some patches. This project grabs from a specific location the binary so I made a fork that receives the path of the binary as an argument [here](<https://github.com/trickster0/rust-windows-shellcode-custom> "here" ). * Even if you remove all debug symbols, rust can still keep references to your home directory in the binary. The only way I've found to remove this is to pass the following flag: `--remap-path-prefix {your home directory}={some random identifier}`. You can use bash variables to get your home directory and generate a random placeholder: `--remap-path-prefix "$HOME"="$RANDOM"`. (By [Yamakadi](<https://github.com/yamakadi> "Yamakadi" )) * Although for the above there is another way to remove info about the home directory by adding at the top of Cargo.toml `cargo-features = ["strip"]` . * Since Rust by default leaves a lot of things as strings in the binary, I mostly use this [cargo.toml](<https://github.com/trickster0/OffensiveRust/blob/master/cargo.toml> "cargo.toml" ) to avoid them and also reduce size with build command `cargo build --release -Z build-std=std,panic_abort -Z build-std-features=panic_immediate_abort --target x86_64-pc-windows-msvc` ## Other projects I have have made in Rust * [UDPlant](<https://github.com/trickster0/UDPlant> "UDPlant" ) \- Basically a UDP reverse shell * [EDR Detector](<https://github.com/trickster0/EDR_Detector> "EDR Detector" ) \- Detects the EDRs of the installed system according to the .sys files installed * [Lenum](<https://github.com/trickster0/Lenum> "Lenum" ) \- A simple unix [enumeration](<https://www.kitploit.com/search/label/Enumeration> "enumeration" ) tool ## Projects in Rust that can be hepfull * [houdini](<https://github.com/yamakadi/houdini> "houdini" ) \- Helps make your executable self-delete **[Download OffensiveRust](<https://github.com/trickster0/OffensiveRust> "Download OffensiveRust" )**