etc

~ scripts and random things
git clone https://github.com/djnnvx/etc.git
README.md (2587B)
      1 # 🪞 Doppelganger – Mimic the Soul, Leave No Trace
      2 Doppelganger is an arcane tool designed to mimic LSASS, extract its secrets, and hide them in plain sight. It builds upon the forbidden arts of HollowReaper, using hollowed processes, kernel exploits, and spectral clones to bypass protection and exfiltrate credentials with stealth.
      3 
      4 ![Doppelganger_logo](https://github.com/user-attachments/assets/dc6f30fb-3f7d-41aa-9455-5d7d77717fb8)
      5 
      6 ## 📜 The Ritual
      7 ### 🩸 Doppelganger
      8 The soul thief. This shellcode:
      9 
     10 🛡️ Disables PPL using the cursed RTCore64.sys driver (BYOVD)
     11 
     12 🧬 Clones LSASS into a benign replica
     13 
     14 💾 Creates a Minidump from the clone
     15 
     16 🗝️ XOR-encrypts the dump and writes it to disk, leaving behind only a shadow
     17 
     18 ### 🧿 Utilities
     19 #### 💀 HollowReaper.c
     20 The vessel for your payload. This performs process hollowing, carving out a legitimate process and injecting your shellcode into its husk.
     21 🔧 Instructions for generating the shellcode to embed are provided in the HollowReaper project.
     22 
     23 #### 🔐 decrypt_xor_dump.py
     24 A local decryption utility. Use this to restore the original dump from its XOR-obfuscated form.
     25 
     26 ## ⚗️ The Components
     27 | File | Purpose |
     28 |------|---------|
     29 | Doppelganger | The shellcode: disable PPL, clone LSASS, dump and XOR |
     30 | HollowReaper.c |	Hollow a process and inject shellcode |
     31 | decrypt_xor_dump.py | Python tool to decrypt XOR dump |
     32 | RTCore64.sys | Vulnerable driver used for PPL bypass (BYOVD) |
     33 
     34 ## 🕯️ Usage Flow
     35 ### Standalone
     36 In order to use Doppelganger you must place RTCore64.sys in C:\Users\Public. Doppleganger can be used standalone or hollowed through HollowReaper.
     37 ```
     38 .\Doppelganger.exe
     39 ```
     40 --------------------------------------------------------------------------------
     41 ### Process Hollowed
     42 
     43 1️⃣ Compile Doppelganger
     44 
     45 2️⃣ Use Donut to convert it into shellcode
     46 ```
     47 .\donut.exe -a 2 -f 7 -i Doppelganger.exe
     48 ```
     49 3️⃣ XOR the shellcode and embed it into HollowReaper.c (look for util files in [HollowReaper](https://github.com/vari-sh/RedTeamGrimoire/tree/main/HollowReaper))
     50 
     51 4️⃣ Run HollowReaper to hollow a process and trigger Doppelganger (all files saved to C:\Users\Public)
     52 ```
     53 .\HollowReaper.exe "C:\windows\explorer.exe"
     54 ```
     55 5️⃣ Use decrypt_xor_dump.py to decrypt the dumped file offline
     56 ```
     57 python .\decrypt_xor_dump.py .\doppelganger.dmp
     58 ```
     59 
     60 ---------------------------------------------------------------------------------
     61 
     62 ## ⚠️ Disclaimer:
     63 This tool is provided for educational and research purposes only. Use responsibly. The arcane always watches. 🧿