Skip to content
/ Restless Public

A light C# implant that bypasses Windows Firewall and Defender

Notifications You must be signed in to change notification settings

M507/Restless

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

31 Commits
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

Restless

DISCLAIMERS

The information contained in this repo is for educational purposes ONLY! I DO NOT hold any responsibility for any misuse or damage of the information provided in my blog posts, discussions, activities, repositories, or exercises.

This is a low hanging fruit for Red-Blue themed competitions.

What is Restless?

Restless is a small in-memory implant using C#. It uses SharpPcap, which uses Npcap APIs internally. Npcap is a new standard library update to the old WinPcap library.

RestlessCLI is a C2 that controls Restless implants using ICMP-like packets. Restless implant listens for specific ICMP-like packets and applies instructions given by Restless-CLI.py. Restless Controller/Server can task clients to execute pre-baked or arbitrary commands.

alt text

Status

  • Restless implants have been tested on Windows7/10/12/16/19 and evaded detections on 10 :).
  • Restless implants bypass Windows Inbound firewall rules.
  • Server sends "encrypted" messages, Caesar Cipher; it can be adjusted using the SHIFT parameter.
  • Server uses raw sockets to send customized ICMP-like packets.
  • The server's CLI supports Command 2 All bots.
  • The final payload is 20.0 KB without modifications.
  • Integrated with pwnboard.

Files:

  • Config.py Where are the configuration parameters. (Have to be changed according to your system)
  • pwnAgent.py is a stand-alone script that updates pwnboard.
  • ips.conf Where all the targeted IPs should be placed.

Dependencies:

  • Dotnet core
  • Npcap