Repository files navigation

Invoke-CradleCrafter is a PowerShell v2.0+ compatible PowerShell remotedownload cradle generator and obfuscator.

In the Fall of 2016 after releasing Invoke-Obfuscation, I continued updatingmy spreadsheet of PowerShell remote download cradles thinking that one day Imight add a "cradle selector" menu into Invoke-Obfuscation. This listconsisted of cradles that were obscure to me, and many of which were notprevelently (or at all) being observed in the wild.

However, since Invoke-Obfuscation was designed to obfuscate any arbitraryPowerShell command or script, there are certain obfuscation techniques thatI knew I needed to include with regards to building customized cradles thatwere not feasible to include in Invoke-Obfuscation.

This was the point that led me to shift this cradle research into a separateproject altogether, though you can always take output from Invoke-CradleCrafter and intput it into Invoke-Obfuscation and continue the fun.Since Invoke-CradleCrafter is much more tightly controlled, it has enabledme to include obfuscation techniques that are completely unlike anytechnique found in Invoke-Obfuscation.

Some of the new obfuscation techniques in this tool include tokenobfuscation through data type enumeration and wildcard matching, and thereordering of command structure by introducing additional variables andvariable syntaxes.

Lastly, the tool supports 10+ invocation syntaxes that extend beyond themost prevalent Invoke-Expression and IEX.

Invoke-CradleCrafter exists to aid Blue Teams and Red Teams in easilyexploring, generating and obfuscating PowerShell remote download cradles.In addition, it helps Blue Teams test the effectiveness of detections thatmay work for output produced by Invoke-Obfuscation but may fall short whendealing with Invoke-CradleCrafter since it does not contain any stringconcatenations, encodings, tick marks, type casting, etc.

Another important component of this research and tool development was toeffectively highlight the high-level behavior and artifacts left behindwhen each cradle is executed. I have tried to highlight this informationwhen you first enter a new cradle type in the interactive menus of the tool.

Ultimately, knowing more about each cradle's behavior and artifacts willhelp the Blue Team better detect these cradles. This knowledge should alsobenefit the Red Teamer in making more informed selections of which cradleto use in a given scenario.

While all of the cradles can be produced by directly calling the Out-Cradlefunction, the complexity of the moving pieces for all of the stackedobfuscated components makes using the Invoke-CradleCrafter function theeasiest way to explorer and visualize the cradle syntaxes and obfuscationtechniques that this framework currently supports.

The source code for Invoke-CradleCrafter is hosted at Github, and you maydownload, fork and review it from this repository(https://github.com/danielbohannon/Invoke-CradleCrafter). Please report issuesor feature requests through Github's bug tracker associated with this project.

To install:

Import-Module ./Invoke-CradleCrafter.psd1Invoke-CradleCrafter

Invoke-CradleCrafter is released under the Apache 2.0 license.

v1.0 - 2017-04-28 x33fcon (Gdynia, Poland): PUBLIC Release of Invoke-CradleCrafter.

v1.1 - 2017-05-11 NOPcon (Istanbul, Turkey):Added 3 new memory-based cradles:

• PsComMsXml
• PsInlineCSharp
• PsCompiledCSharpAdded 2 disk-based cradles:
• PsBits
• BITSAdmin

v1.1.1 - 2018-01-08:Added 1 new memory-based cradle:

• Certutil -pingAdded 1 new disk-based cradle:
• Certutil -urlcache

v1.1.2 - 2018-02-05:Added User-Agent strings to cradle info

• Thanks for the PR, @mgreen27!