mgeeky-Penetration-Testing-Tools

mirror of https://github.com/mgeeky/Penetration-Testing-Tools.git synced 2024-12-23 01:21:03 +01:00

History

Mariusz B. / mgeeky ddb2282e0a update		2022-07-13 22:44:17 +02:00
..
MSKernel32Leaf.cer	added self-signed threat	2022-07-13 22:39:40 +02:00
MSKernel32PCA.cer	added self-signed threat	2022-07-13 22:39:40 +02:00
MSKernel32Root.cer	added self-signed threat	2022-07-13 22:39:40 +02:00
README.md	update	2022-07-13 22:44:17 +02:00
sigcheck64.exe	added self-signed threat	2022-07-13 22:39:40 +02:00
sigcheck.exe	added self-signed threat	2022-07-13 22:39:40 +02:00
Sign-Artifact.ps1	added self-signed threat	2022-07-13 22:39:40 +02:00

Easy-to-use test-it-yourself sign-your-malware

A Powershell script that signs input Executable file with fake Microsoft code-signing certificate to demonstrate risks of Code Signing attacks.

Script was shamelessly borrowed from Matt Graeber, @mattifestation and his research titled Code Signing Certificate Cloning Attacks and Defenses All credits go to Matt - I merely copied it preserverance purposes.

As of 13/07/2022 this dumb trick still gets off the shelf malware evade detection of at least 8 modern security scanners.

What	Result
Mythic Apollo.exe before fake-signing	30/70
Mythic Apollo.exe after fake-signing with Microsoft code-signing certificate	22/70

PS C:\> . .\Sign-Artifact.ps1
PS C:\> Sign-Artifact -InputFile malware.exe -OutputFile nomalware.exe -Verbose