Skip to content

Latest commit

 

History

History
33 lines (23 loc) · 1.51 KB

README.md

File metadata and controls

33 lines (23 loc) · 1.51 KB
Raw

Restless

DISCLAIMERS

The information contained in this repo is for educational purposes ONLY! I DO NOT hold any responsibility for any misuse or damage of the information provided in my blog posts, discussions, activities, repositories, or exercises.

This is a low hanging fruit for Red-Blue themed competitions.

What is Restless?

Restless is a small in-memory implant using C#. It uses SharpPcap, which uses Npcap APIs internally. Npcap is a new standard library update to the old WinPcap library.

RestlessCLI is a C2 that controls Restless implants using ICMP-like packets. Restless implant listens for specific ICMP-like packets and applies instructions given by Restless-CLI.py. Restless Controller/Server can task clients to execute pre-baked or arbitrary commands.

alt text

Status

  • Restless implants have been tested on Windows7/10/12/16/19 and evaded detections on 10 :).
  • Restless implants bypass Windows Inbound firewall rules.
  • Server sends "encrypted" messages, Caesar Cipher; it can be adjusted using the SHIFT parameter.
  • Server uses raw sockets to send customized ICMP-like packets.
  • The server's CLI supports Command 2 All bots.
  • The final payload is 20.0 KB without modifications.
  • Integrated with pwnboard.

Files:

  • Config.py Where are the configuration parameters. (Have to be changed according to your system)
  • pwnAgent.py is a stand-alone script that updates pwnboard.
  • ips.conf Where all the targeted IPs should be placed.

Dependencies:

  • Dotnet core
  • Npcap