Cloak

Generate Secure, Polymorphic, Evasive Payloads

Quick Start

The easiest way to run Cloak is with Docker. If you wish to install it locally, check the wiki for installation instructions

git clone https://github.com/HackLike-co/Cloak.git
cd Cloak
sudo docker build . --tag cloak
sudo docker run --publish 8080:8080 cloak

You can then navigate to http://127.0.0.1:8080/cloak to start generating payloads!

Features

• Convienent Web UI
• View Generated Payloads
• Simple to use REST API (Documentation Coming Soon...)

Input Formats

• Shellcode
• PE
• DLL

Output Formats

• EXE
• DLL

Execution Options

• Fibers
• CreateThreadPoolWait
• Injection
  • Local Thread
  • Remote Thread*
  • Local Thread Hijack (CreateThread)
  • Local Thread Hijack (EnumThread)
  • Remote Thread Hijack*
  • APC
  • EarlyBird APC*
  • EarlyCascade

Evasion

• Direct Syscalls*
• Indirect Syscalls*
• Callstack Spoofing
• Chunking
• Payload Encryption/Encoding
  • AES
  • RC4
  • Base64
  • Base32
• AMSI Patching* (HWBP)
• ETW Patching* (HWBP)
• DLL Unhooking*
• IAT Camouflage*
• API Hashing (Compile Time)
• String Hashing*
• Anti-Debug*
  • Debugger Detection (Kinda)
  • Self-Delete
• Anti-VM
  • VM Detection
    • TPM Check
    • CPU Count
    • RAM
    • Resolution
  • Execution Delay
    • API Hammering
    • WaitForSingleObject
• File Bloating*
• Entropy Reduction*
• Custom Binary Metadata
• Custom Binary Icon
• Modify Creation Date/Time

Guardrails

• Hostname
• Domain Joined*
• Domain Name*
• Subnet*

*v1.0 Goals

Community

Discord

Known Issues

• SetThreadpoolWait doesn't play nicely for API Hashing, need to figure out why
• Checking the amount of memory acts funky in if statement

References

This project was inspired by the amazing EvadeX from PhantomSec and OST from Outflank. If you and your team has the funds, I highly recommend them.

• tiny-AES-c
• VX-API
• Rad98 Hooking Engine

If you want to learn more, I recommend ired.team, Maldev Academy or White Knight Labs