InvisibilityCloak

Proof-of-concept obfuscation toolkit for C# post-exploitation tools. This will perform the below actions for a C# visual studio project.

• Change the tool name
• Change the project GUID
• Obfuscate compatible strings in source code files based on obfuscation method entered by user
• Removes one-line comments (e.g. // this is a comment)
• Remove PDB string option for compiled release .NET assembly

Blog Post: https://securityintelligence.com/posts/invisibility-cloak-obfuscate-c-tools-evade-signature-based-detection

String Candidates Not Obfuscated

The below string candidates are not included in obfuscation

• Strings less than 3 characters
• Strings using string interpolation (e.g., Console.WriteLine($"Hello, {name}! Today is {date.DayOfWeek}, it's {date:HH:mm} now.");)
• Case statements as they need to be static values
• Const vars as they need to be static values
• Strings in method signatures as they need to be static values
• Line with " => " as used in switch statement and needs to be static value.
• is in an if statement when doing comparison as the values compared must be static
• Strings within Regexes
• Override strings as they need to be static values
• The below random edge cases for strings, as they have caused issues when encoding/decoding
  • String starting with or ending with '
  • ""' in the line
  • + @" in the line
  • """ in the line
  • "" in the line
  • Encoding.Unicode.GetString in the line
  • Encoding.Unicode.GetBytes in the line
  • Encoding.ASCII.GetBytes in the line
  • Line starting with " and ending with ")]. This is typically used for command line switches and needs to be static value.

Support Information

• Windows
• Linux (Debian-based systems)
• Python3

Arguments/Options

• -d, --directory - directory where your visual studio project is located
• -m, --method - obfuscation method (base64, rot13, reverse)
• -n, --name - name of your new tool
• -h, --help - help menu
• --version - get version of tool

Usage/Examples

Run InvisibilityCloak with string obfuscation

Base64 String Obfuscation

python InvisibilityCloak.py -d /path/to/project -n "TotallyLegitTool" -m base64

python InvisibilityCloak.py -d C:\path\to\project -n "TotallyLegitTool" -m base64

ROT13 String Obfuscation

python InvisibilityCloak.py -d /path/to/project -n "TotallyLegitTool" -m rot13

python InvisibilityCloak.py -d C:\path\to\project -n "TotallyLegitTool" -m rot13

Reverse String Obfuscation

python InvisibilityCloak.py -d /path/to/project -n "TotallyLegitTool" -m reverse

python InvisibilityCloak.py -d C:\path\to\project -n "TotallyLegitTool" -m reverse

Run InvisibilityCloak without string obfuscation

python InvisibilityCloak.py -d /path/to/project -n "TotallyLegitTool"

python InvisibilityCloak.py -d C:\path\to\project -n "TotallyLegitTool"

Signature-Based Detection Statistics

The below table shows the signature-based detection statistics between the unobfuscated and obfuscated versions of 20 popular public C# tools with InvisibilityCloak.

This is specifically for Microsoft Defender (free version), and accurate as of April 14th, 2022.

Tool	Link	Unobfuscated	Obfuscated w/ InvisibilityCloak
ADCSPwn	https://github.com/bats3c/ADCSPwn	Detected	Not Detected
Certify	https://github.com/GhostPack/Certify	Detected	Not Detected
Farmer	https://github.com/mdsecactivebreach/Farmer	Detected	Not Detected
Rubeus	https://github.com/GhostPack/Rubeus	Detected	Detected
SafetyKatz	https://github.com/GhostPack/SafetyKatz	Detected	Not Detected
Seatbelt	https://github.com/GhostPack/Seatbelt	Detected	Not Detected
SharpClipboard	https://github.com/slyd0g/SharpClipboard	Not Detected	Not Detected
SharPersist	https://github.com/mandiant/SharPersist	Not Detected	Not Detected
SharpExec	https://github.com/anthemtotheego/SharpExec	Detected	Not Detected
SharpGPOAbuse	https://github.com/FSecureLABS/SharpGPOAbuse	Detected	Not Detected
SharpHound	https://github.com/BloodHoundAD/SharpHound	Not Detected	Not Detected
SharpLogger	https://github.com/djhohnstein/SharpLogger	Detected	Not Detected
SharpMove	https://github.com/0xthirteen/SharpMove	Detected	Not Detected
SharpRDP	https://github.com/0xthirteen/SharpRDP	Detected	Detected
SharpSecDump	https://github.com/G0ldenGunSec/SharpSecDump	Detected	Not Detected
SharpUp	https://github.com/GhostPack/SharpUp	Not Detected	Not Detected
SharpView	https://github.com/tevora-threat/SharpView	Detected	Not Detected
SharpWMI	https://github.com/GhostPack/SharpWMI	Detected	Not Detected
StandIn	https://github.com/xforcered/StandIn	Detected	Not Detected
WireTap	https://github.com/djhohnstein/WireTap	Not Detected	Not Detected

Compiled C# Tool Size Statistics

The below table shows the file sizes of 20 popular public C# tools between the unobfucated and obfuscated versions using InvisibilityCloak with various string obfuscation methods.

Tool	Link	Unobfuscated	ROT13 String Obfuscation	Base64 String Obfuscation	Reverse String Obfuscation
ADCSPwn	https://github.com/bats3c/ADCSPwn	718 KB	728 KB	722 KB	720 KB
Certify	https://github.com/GhostPack/Certify	170 KB	198 KB	178 KB	176 KB
Farmer	https://github.com/mdsecactivebreach/Farmer	13 KB	17 KB	14 KB	13 KB
Rubeus	https://github.com/GhostPack/Rubeus	418 KB	605 KB	469 KB	455 KB
SafetyKatz	https://github.com/GhostPack/SafetyKatz	714 KB	716 KB	948 KB	715 KB
Seatbelt	https://github.com/GhostPack/Seatbelt	543 KB	904 KB	618 KB	608 KB
SharpClipboard	https://github.com/slyd0g/SharpClipboard	6 KB	7 KB	6 KB	7 KB
SharPersist	https://github.com/mandiant/SharPersist	231 KB	281 KB	248 KB	243 KB
SharpExec	https://github.com/anthemtotheego/SharpExec	30 KB	57 KB	36 KB	34 KB
SharpGPOAbuse	https://github.com/FSecureLABS/SharpGPOAbuse	70 KB	98 KB	79 KB	76 KB
SharpHound	https://github.com/BloodHoundAD/SharpHound	880 KB	897 KB	885 KB	883 KB
SharpLogger	https://github.com/djhohnstein/SharpLogger	19 KB	27 KB	20 KB	20 KB
SharpMove	https://github.com/0xthirteen/SharpMove	41 KB	100 KB	50 KB	49 KB
SharpRDP	https://github.com/0xthirteen/SharpRDP	322 KB	346 KB	326 KB	325 KB
SharpSecDump	https://github.com/G0ldenGunSec/SharpSecDump	42 KB	55 KB	45 KB	43 KB
SharpUp	https://github.com/GhostPack/SharpUp	35 KB	50 KB	40 KB	39 KB
SharpView	https://github.com/tevora-threat/SharpView	719 KB	856 KB	742 KB	738 KB
SharpWMI	https://github.com/GhostPack/SharpWMI	53 KB	92 KB	62 KB	61 KB
StandIn	https://github.com/xforcered/StandIn	162 KB	294 KB	197 KB	189 KB
WireTap	https://github.com/djhohnstein/WireTap	282 KB	292 KB	285 KB	284 KB

Roadmap

• Add support for C# projects with multiple C# project files (multi-project solutions)
• Obfuscation support for variable names and method names