InvisibilityCloak

Proof-of-concept obfuscation toolkit for C# post-exploitation tools. This will perform the below actions for a C# visual studio project.

• Change the tool name
• Change the project GUID
• Obfuscate compatible strings in source code files based on obfuscation method entered by user
• Removes one-line comments (e.g. // this is a comment)
• Remove PDB string option for compiled release .NET assembly

Blog Post: https://securityintelligence.com/posts/invisibility-cloak-obfuscate-c-tools-evade-signature-based-detection

String Candidates Not Obfuscated

The below string candidates are not included in obfuscation

• Strings less than 3 characters
• Strings using string interpolation (e.g., Console.WriteLine($"Hello, {name}! Today is {date.DayOfWeek}, it's {date:HH:mm} now.");)
• Case statements as they need to be static values
• Const vars as they need to be static values
• Strings in method signatures as they need to be static values
• Line with " => " as used in switch statement and needs to be static value.
• is in an if statement when doing comparison as the values compared must be static
• Strings within Regexes
• Override strings as they need to be static values
• The below random edge cases for strings, as they have caused issues when encoding/decoding
  • String starting with or ending with '
  • ""' in the line
  • + @" in the line
  • """ in the line
  • "" in the line
  • Encoding.Unicode.GetString in the line
  • Encoding.Unicode.GetBytes in the line
  • Encoding.ASCII.GetBytes in the line
  • Line starting with " and ending with ")]. This is typically used for command line switches and needs to be static value.

Support Information

• Windows
• Linux (Debian-based systems)
• Python3

Arguments/Options

• -d, --directory - directory where your visual studio project is located
• -m, --method - obfuscation method (base64, rot13, reverse)
• -n, --name - name of your new tool
• -h, --help - help menu
• --version - get version of tool

Usage/Examples

Run InvisibilityCloak with string obfuscation

Base64 String Obfuscation

python InvisibilityCloak.py -d /path/to/project -n "TotallyLegitTool" -m base64

python InvisibilityCloak.py -d C:\path\to\project -n "TotallyLegitTool" -m base64

ROT13 String Obfuscation

python InvisibilityCloak.py -d /path/to/project -n "TotallyLegitTool" -m rot13

python InvisibilityCloak.py -d C:\path\to\project -n "TotallyLegitTool" -m rot13

Reverse String Obfuscation

python InvisibilityCloak.py -d /path/to/project -n "TotallyLegitTool" -m reverse

python InvisibilityCloak.py -d C:\path\to\project -n "TotallyLegitTool" -m reverse

Run InvisibilityCloak without string obfuscation

python InvisibilityCloak.py -d /path/to/project -n "TotallyLegitTool"

python InvisibilityCloak.py -d C:\path\to\project -n "TotallyLegitTool"

Signature-Based Detection Statistics

The below table shows the signature-based detection statistics between the unobfuscated and obfuscated versions of 20 popular public C# tools with InvisibilityCloak.

This is specifically for Microsoft Defender (free version), and accurate as of April 14th, 2022.

| Tool | Link | Unobfuscated | Obfuscated w/ InvisibilityCloak | | ----------- | ----------- | ----------- | ----------- | | ADCSPwn | https://github.com/bats3c/ADCSPwn | Detected | Not Detected | | Certify | https://github.com/GhostPack/Certify | Detected | Not Detected | | Farmer | https://github.com/mdsecactivebreach/Farmer | Detected | Not Detected | | Rubeus | https://github.com/GhostPack/Rubeus | Detected | Detected | | SafetyKatz | https://github.com/GhostPack/SafetyKatz | Detected | Not Detected | | Seatbelt | https://github.com/GhostPack/Seatbelt | Detected | Not Detected | | SharpClipboard | https://github.com/slyd0g/SharpClipboard | Not Detected | Not Detected | | SharPersist | https://github.com/mandiant/SharPersist | Not Detected | Not Detected | | SharpExec | https://github.com/anthemtotheego/SharpExec | Detected | Not Detected | | SharpGPOAbuse | https://github.com/FSecureLABS/SharpGPOAbuse | Detected | Not Detected | | SharpHound | https://github.com/BloodHoundAD/SharpHound | Not Detected | Not Detected | | SharpLogger | https://github.com/djhohnstein/SharpLogger | Detected | Not Detected | | SharpMove | https://github.com/0xthirteen/SharpMove | Detected | Not Detected | | SharpRDP | https://github.com/0xthirteen/SharpRDP | Detected | Detected | | SharpSecDump | https://github.com/G0ldenGunSec/SharpSecDump | Detected | Not Detected | | SharpUp | https://github.com/GhostPack/SharpUp | Not Detected | Not Detected | | SharpView | https://github.com/tevora-threat/SharpView | Detected | Not Detected | | SharpWMI | https://github.com/GhostPack/SharpWMI | Detected | Not Detected | | StandIn | https://github.com/xforcered/StandIn | Detected | Not Detected | | WireTap | https://github.com/djhohnstein/WireTap | Not Detected | Not Detected |

Compiled C# Tool Size Statistics

The below table shows the file sizes of 20 popular public C# tools between the unobfucated and obfuscated versions using InvisibilityCloak with various string obfuscation methods.

| Tool | Link | Unobfuscated | ROT13 String Obfuscation | Base64 String Obfuscation | Reverse String Obfuscation | | ----------- | ----------- | ----------- | ----------- | ----------- | ----------- | | ADCSPwn | https://github.com/bats3c/ADCSPwn | 718 KB | 728 KB | 722 KB | 720 KB | | Certify | https://github.com/GhostPack/Certify | 170 KB | 198 KB | 178 KB | 176 KB | | Farmer | https://github.com/mdsecactivebreach/Farmer | 13 KB | 17 KB | 14 KB | 13 KB | | Rubeus | https://github.com/GhostPack/Rubeus | 418 KB | 605 KB | 469 KB | 455 KB | | SafetyKatz | https://github.com/GhostPack/SafetyKatz | 714 KB | 716 KB | 948 KB | 715 KB | | Seatbelt | https://github.com/GhostPack/Seatbelt | 543 KB | 904 KB | 618 KB | 608 KB | | SharpClipboard | https://github.com/slyd0g/SharpClipboard | 6 KB | 7 KB | 6 KB | 7 KB | | SharPersist | https://github.com/mandiant/SharPersist | 231 KB | 281 KB | 248 KB | 243 KB | | SharpExec | https://github.com/anthemtotheego/SharpExec | 30 KB | 57 KB | 36 KB | 34 KB | | SharpGPOAbuse | https://github.com/FSecureLABS/SharpGPOAbuse | 70 KB | 98 KB | 79 KB | 76 KB | | SharpHound | https://github.com/BloodHoundAD/SharpHound | 880 KB | 897 KB | 885 KB | 883 KB | | SharpLogger | https://github.com/djhohnstein/SharpLogger | 19 KB | 27 KB | 20 KB | 20 KB | | SharpMove | https://github.com/0xthirteen/SharpMove | 41 KB | 100 KB | 50 KB | 49 KB | | SharpRDP | https://github.com/0xthirteen/SharpRDP | 322 KB | 346 KB | 326 KB | 325 KB | | SharpSecDump | https://github.com/G0ldenGunSec/SharpSecDump | 42 KB | 55 KB | 45 KB | 43 KB | | SharpUp | https://github.com/GhostPack/SharpUp | 35 KB | 50 KB | 40 KB | 39 KB | | SharpView | https://github.com/tevora-threat/SharpView | 719 KB | 856 KB | 742 KB | 738 KB | | SharpWMI | https://github.com/GhostPack/SharpWMI | 53 KB | 92 KB | 62 KB | 61 KB | | StandIn | https://github.com/xforcered/StandIn | 162 KB | 294 KB | 197 KB | 189 KB | | WireTap | https://github.com/djhohnstein/WireTap | 282 KB | 292 KB | 285 KB | 284 KB |

Roadmap

• Add support for C# projects with multiple C# project files (multi-project solutions)
• Obfuscation support for variable names and method names