Skip to content

Home

Jump to bottom
Deranged0tter edited this page Apr 16, 2025 · 3 revisions

Cloak

Generate Secure, Polymorphic, Evasive Payloads

Installation

Installation

Features

All of the following will be implemented by v1.0

Input Formats

  • Shellcode
  • PE
  • DLL

Output Formats

  • EXE
  • DLL

Execution Options

  • Fibers
  • CreateThreadPoolWait
  • Injection
    • Local Thread
    • Remote Thread*
    • Local Thread Hijack (CreateThread)
    • Local Thread Hijack (EnumThread)
    • Remote Thread Hijack*
    • APC
    • EarlyBird APC*
    • EarlyCascade

Evasion

  • Direct Syscalls*
  • Indirect Syscalls*
  • Callstack Spoofing
  • Chunking
  • Payload Encryption/Encoding
    • AES
    • RC4
  • AMSI Patching* (HWBP)
  • ETW Patching* (HWBP)
  • DLL Unhooking*
  • IAT Camouflage*
  • API Hashing (Compile Time)
  • String Hashing*
  • Anti-Debug*
    • Debugger Detection (Kinda)
    • Self-Delete
  • Anti-VM
    • VM Detection
      • TPM Check
      • CPU Count
      • RAM
      • Resolution
    • Execution Delay
      • API Hammering
      • WaitForSingleObject
  • File Bloating*
  • Entropy Reduction*
  • Custom Binary Metadata
  • Custom Binary Icon
  • Modify Creation Date/Time

Guardrails

  • Hostname
  • Domain Joined*
  • Domain Name*
  • Subnet*

*v1.0 Goals

References

This project was inspired by the amazing EvadeX from PhantomSec and OST from Outflank. If you and your team has the funds, I highly recommend them. This is just a shitty knock off because it seemed like a fun project.

If you want to learn more, I recommend ired.team and/or Maldev Academy

Clone this wiki locally