m507 / restless

A light C# implant that bypasses Windows Firewall and Defender

Restless

DISCLAIMERS

The information contained in this repo is for educational purposes ONLY! I DO NOT hold any responsibility for any misuse or damage of the information provided in my blog posts, discussions, activities, repositories, or exercises.

This is a low hanging fruit for Red-Blue themed competitions.

What is Restless?

Restless is a small in-memory implant using C#. It uses SharpPcap, which uses Npcap APIs internally. Npcap is a new standard library update to the old WinPcap library.

RestlessCLI is a C2 that controls Restless implants using ICMP-like packets. Restless implant listens for specific ICMP-like packets and applies instructions given by Restless-CLI.py. Restless Controller/Server can task clients to execute pre-baked or arbitrary commands.

Status

• Restless implants have been tested on Windows7/10/12/16/19 and evaded detections on 10 :).
• Restless implants bypass Windows Inbound firewall rules.
• Server sends "encrypted" messages, Caesar Cipher; it can be adjusted using the SHIFT parameter.
• Server uses raw sockets to send customized ICMP-like packets.
• The server's CLI supports Command 2 All bots.
• The final payload is 20.0 KB without modifications.
• Integrated with pwnboard.

Files:

• Config.py Where are the configuration parameters. (Have to be changed according to your system)
• pwnAgent.py is a stand-alone script that updates pwnboard.
• ips.conf Where all the targeted IPs should be placed.

Dependencies:

• Dotnet core
• Npcap