sujan1-3/nimcrab-rt
GitHub: sujan1-3/nimcrab-rt
redcrab-rt 是一款基于 Nim 的 Windows x64 红队植入框架，用于模拟高级攻击者行为。
Stars: 0 | Forks: 0
# redcrab-rt
授权的实验室和活动使用的红队植入框架。
## 概述
`redcrab-rt` 是一个基于 Nim 的 Windows x64 植入，具有 12 阶段初始化链、操作员级别的规避堆栈和具有域名前端支持的 HTTPS C2。它通过 `nim c` 编译为原生 Windows PE，并通过 `builder.py` 在构建时完全配置。
**这不是什么：**一个简单的反向 shell。执行的每个阶段——从将进程空心化到 `svchost.exe` 到睡眠掩码的 RC4 加密，再到在 `ntdll` 内部执行的间接系统调用——都是为了在现代 EDR 检查中生存。
## 快速开始
### 1. 环境准备
```
# Nim 2.x (https://nim-lang.org/install.html)
curl https://nim-lang.org/choosenim/init.sh -sSf | sh
choosenim stable
# winim — Windows API 绑定
nimble install winim
# 从 Linux/macOS 跨编译到 Windows
nimble install mingw-w64 # or use a Windows build machine
# 为构建者提供 Python 3
python3 --version
```
### 2. 设置您的 C2 监听器
```
# 终端 1 — HTTPS 监听器（socat + openssl，或 teamserver）
# 植入体向 /beacon 发送 POST 并读取命令；结果发送到 /result；数据发送到 /data
# 终端 2 — 如果使用 ngrok 进行 NAT 穿透：
ngrok http 443
# 注意转发后的 HTTPS 主机 — 例如 abc123.ngrok.io
```
### 3. 构建植入程序
```
python builder.py
```
提示值：
| 提示 | 示例 | 目的 |
|---|---|---|
| `C2 主机 (Host: header)` | `abc123.ngrok.io` | 实际 C2 服务器（作为 HTTP `Host:` 标头发送） |
| `前端域名 (SNI)` | `update.microsoft.com` | TLS 握手向网络呈现的 CDN/SNI |
| `C2 端口` | `443` | HTTPS 端口 |
| `信标间隔 (ms)` | `15000` | 基础信标睡眠的毫秒数 |
| `抖动 %` | `30` | 信标间隔的 ± 变化 |
| `工作时间开始` | `8` | 本地小时——信标开始活跃 |
| `工作时间结束` | `20` | 本地小时——信标静默 |
| `SLEEP_KEY` | *(空白 = 随机)* | 16 字节 RC4/XOR 睡眠掩码密钥 |
输出：`redcrab.exe` (Windows x64 PE)
### 4. 部署
1. 将 `redcrab.exe` 复制到目标
2. 执行——它通过 12 阶段初始化链静默运行
3. 您的监听器接收 `POST /beacon`，内容为 `id=-`
4. 在响应体中发送命令；输出通过 `POST /result` 返回
## 初始化链
执行遵循严格的 12 阶段序列。每个阶段必须成功，才能开始下一个阶段。
```
Phase 0 — NT function pointer resolution (indirect syscall table)
Phase 1 — SSN audit: verify critical syscall numbers match ntdll on disk
Phase 2 — Environment gate: sandbox / analysis / VM detection
Phase 3 — VEH guardian: installs Vectored Exception Handler → triggers
full destruct on any unexpected exception
Phase 4 — Ctrl handler: CTRL+C / SIGTERM → clean wipe
Phase 5 — Bypass layer: SAC bypass → ntdll re-read (EDR unhook) → ETW-Ti
+ AMSI 6-site patch
Phase 6 — Persistence: installs survival mechanism
Phase 6b — Token escalation: enable SeDebugPrivilege early
Phase 7 — Guardian thread: monitors for debuggers/tampering; triggers
resurrect → re-hollow if the primary image is wiped
Phase 8 — Obfuscated sleep: RC4 sleep-mask before hollowing
Phase 9 — Process hollowing: maps payload into suspended svchost.exe
Phase 10 — Post-injection concealment: module stomp + stack spoof +
secure zero of payload buffer
Phase 11 — C2 beacon loop: HTTPS POST with jitter + working-hours gate
Phase 12 — Clean exit: uninstall persistence + full destruct
```
## 架构
```
redcrab-rt/
├── builder.py ← patches build-time config, runs nim c
├── redcrab.nimble ← project manifest (requires winim >= 3.9.0)
└── src/
│
├── redcrab.nim ← WinMain entry + 12-phase init
├── defs.nim ← NT type definitions
├── utils.nim ← djb2 hash helpers
├── hashes.nim ← compile-time API hash table
│
├── ── Syscall layer ──────────────────────────────────────────────────
├── syscall.nim ← raw syscall stubs (inline asm)
├── indirect_syscall.nim ← HalosGate SSN resolution; executes inside ntdll
├── ssn_audit.nim ← verifies critical SSNs against on-disk ntdll
│
├── ── Evasion layer ──────────────────────────────────────────────────
├── pe_obfuscate.nim ← compile-time string XOR; import hash resolution
├── unhook.nim ← page-granular ntdll re-read; wipes EDR API hooks
├── etw_patch.nim ← EtwEventWrite ret-sled (6 sites) + AMSI patch
├── sac_bypass.nim ← Smart App Control: WDAC per-process policy clear
├── sleep.nim ← Foliage APC-chain RC4 sleep mask + heap XOR
├── stomp.nim ← module stomping into xpsservices.dll section
├── spoof.nim ← synthetic call stack frame spoofing
├── antidetect.nim ← sandbox / VM / analysis environment gates
│
├── ── Injection layer ────────────────────────────────────────────────
├── loader.nim ← in-memory PE mapper
├── hollow.nim ← process hollowing into svchost.exe
├── threadless_inject.nim ← EAT-hijack injection (no CreateThread telemetry)
├── ppldump.nim ← PPL removal via BYOVD kernel write primitive
│
├── ── Resilience layer ───────────────────────────────────────────────
├── guardian.nim ← VEH + watchdog thread; triggers destruct on tamper
├── watchdog.nim ← heartbeat loop; re-hollows if primary image wiped
├── resurrect.nim ← drops backup payload from NTFS ADS; re-executes
├── persist.nim ← installs + purges persistence mechanism
├── post_shutdown.nim ← WNF channel persistence across reboots
│
├── ── Credential / post-ex ───────────────────────────────────────────
├── token.nim ← lsass token theft; SeDebugPrivilege; revert
├── dpapi.nim ← CredMan + browser login + WiFi PSK extraction
├── keylog.nim ← WH_KEYBOARD_LL hook; ring buffer; C2 drain
├── lateral.nim ← WMI exec, SMB service exec, host-list spray
│
├── ── Collection ─────────────────────────────────────────────────────
├── screenshot.nim ← desktop BMP capture via GDI
├── webcam.nim ← webcam frame capture via Media Foundation
├── mic.nim ← microphone WAV recording via WASAPI
├── filetransfer.nim ← upload / download with chunked XOR I/O
│
├── ── Cleanup ────────────────────────────────────────────────────────
└── selfdestruct.nim ← multi-stage wipe: overwrite → truncate → rename
→ delete; Ctrl handler registration
```
## C2 协议
**传输：**通过 WinHTTP 的 HTTPS POST——流量配置文件与操作系统更新或浏览器流量无法区分。
**域名前端：**网络呈现的 TLS SNI 是 `FRONT_DOMAIN`（CDN 边缘或受信任的主机）。加密隧道内部的实际 `Host:` 标头指向 `C2_HOST`。网络监控器只能看到 CDN SNI。
**端点：**
| 方法 | 路径 | 方向 | 主体 |
|---|---|---|---|
| POST | `/beacon` | 植入程序 → C2 | `id=-\n` |
| POST | `/result` | 植入程序 → C2 | `id=...\nresult=\n
标签：Builder 配置, EDR 避免检测, Evasion Stack, HTTPS C2, Nim 语言, PE 编译, Windows x64, 域前置, 睡眠混淆, 端点可见性, 红蟹框架, 红队实战工具, 红队实验室工具, 红队植入, 进程空心化, 逆向工具, 间接系统调用