InvisibilityCloak — Proof-of-concept obfuscation toolkit for C# post-exploitation tools | Kitploit
Tools / GitHub / h4wkst3r / invisibilitycloak
h4wkst3r/invisibilitycloak InvisibilityCloak Proof-of-concept obfuscation toolkit for C# post-exploitation tools
Discover the most used tools by our community.
Last 7 Days Last 30 Days
InvisibilityCloak
Proof-of-concept obfuscation toolkit for C# post-exploitation tools. This will perform the below actions for a C# visual studio project.
Change the tool name
Change the project GUID
Obfuscate compatible strings in source code files based on obfuscation method entered by user
Removes one-line comments (e.g. // this is a comment)
Remove PDB string option for compiled release .NET assembly
Blog Post: https://securityintelligence.com/posts/invisibility-cloak-obfuscate-c-tools-evade-signature-based-detection
String Candidates Not Obfuscated
The below string candidates are not included in obfuscation
Strings less than 3 characters
Strings using string interpolation (e.g., Console.WriteLine($"Hello, {name}! Today is {date.DayOfWeek}, it's {date:HH:mm} now.");)
Case statements as they need to be static values
Const vars as they need to be static values
Strings in method signatures as they need to be static values
Line with " => " as used in switch statement and needs to be static value.
is in an if statement when doing comparison as the values compared must be static
Strings within Regexes
Override strings as they need to be static values The below random edge cases for strings, as they have caused issues when encoding/decoding
String starting with or ending with '
""' in the line+ @" in the line""" in the line"" in the lineEncoding.Unicode.GetString in the lineEncoding.Unicode.GetBytes in the lineEncoding.ASCII.GetBytes in the lineLine starting with " and ending with ")]. This is typically used for command line switches and needs to be static value.
Windows
Linux (Debian-based systems)
Python3
Arguments/Options
-d, --directory - directory where your visual studio project is located-m, --method - obfuscation method (base64, rot13, reverse)-n, --name - name of your new tool-h, --help - help menu--version - get version of tool
Usage/Examples
Run InvisibilityCloak with string obfuscation Base64 String Obfuscation
python InvisibilityCloak.py -d /path/to/project -n "TotallyLegitTool" -m base64
python InvisibilityCloak.py -d C:\path\to\project -n "TotallyLegitTool" -m base64
python InvisibilityCloak.py -d /path/to/project -n "TotallyLegitTool" -m rot13
python InvisibilityCloak.py -d C:\path\to\project -n "TotallyLegitTool" -m rot13
Reverse String Obfuscation
python InvisibilityCloak.py -d /path/to/project -n "TotallyLegitTool" -m reverse
python InvisibilityCloak.py -d C:\path\to\project -n "TotallyLegitTool" -m reverse
Run InvisibilityCloak without string obfuscation python InvisibilityCloak.py -d /path/to/project -n "TotallyLegitTool"
python InvisibilityCloak.py -d C:\path\to\project -n "TotallyLegitTool"
Signature-Based Detection Statistics The below table shows the signature-based detection statistics between the unobfuscated and obfuscated versions of 20 popular public C# tools with InvisibilityCloak.
This is specifically for Microsoft Defender (free version), and accurate as of April 14th, 2022.
The below table shows the file sizes of 20 popular public C# tools between the unobfucated and obfuscated versions using InvisibilityCloak with various string obfuscation methods.
Roadmap
Add support for C# projects with multiple C# project files (multi-project solutions)
Obfuscation support for variable names and method names
h4wkst3r/invisibilitycloak
