kuwaitist/astral_projectionCobalt Strike UDRL that performs advanced module stomping using VEH to intercept calls, unmap modules during sleep, and remap fresh modules to evade IOCs.
Astral Projection is a Cobalt Strike UDRL (User-Defined Reflective Loader), that performs advanced module stomping.
The UDRL loads a module using LoadLibraryExW, then manipulates its internals by setting VEH to intercept strategic calls that allow it to steal the section handle of the sacrificial DLL and upgrade its access rights for later use in the sleep mask. During sleep it unmaps the module while keeping PEB entries intact, then remaps a fresh module to avoid any IOCs while sleeping.
This project is built with Crystal Palace. Some of the code was adopted from the Crystal-Kit project.
A technical blog post covering the techniques used in detail can be found here
stage {
set sleep_mask "false";
set cleanup "true";
transform-obfuscate { }
}
post-ex {
set cleanup "true";
set smartinject "true";
}
crystalpalace.jar to your Cobalt Strike client directory.Astral_Projection.cna.