Skip to content

NimPlant v1.4 - Black Hat Edition

Latest
Latest
Compare
Choose a tag to compare
@chvancooten chvancooten released this 03 Aug 18:55
· 1 commit to main since this release
v1.4
bffd0bc
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.

NimPlant is back for Black Hat season! This release adds a fully-featured Rust implant besides the "classic" Nim version. The Rust implant is written from scratch and is designed to be more conscious about memory management (e.g. configuration parsing), while supporting all the goodies that the Nim version does¹. The release also adds Docker for all your (cross-)compilation or server hosting needs - without the dependency issues!

New features

  • Added fully-featured, Rust-based implant 🦀🎉
  • Added Dockerfile to allow easy compilation and server portability without dependency issues
    • Docker image is published to chvancooten/nimplant by CI/CD
    • Added example docker-compose.yml that demonstrates how to use Nginx as reverse proxy

Enhancements

  • Replace manual argument parsing with argparse in nimplant.py helper script (939ed19)
  • Various enhancements to CI/CD pipeline

Bugfixes

  • Improve argument parsing and transmission (close #21)
  • Fix bug with server exit logic when nimplants are late (74a581f)
  • Fix bug where jitter was set incorrectly (ee98e2d)

Other

  • Added strings_test.yar to allow opsec checks on disk and/or in-memory
  • Added VS Code devcontainer configuration
  • Update dependencies for GUI and Python components

Full Changelog: v1.3...v1.4

¹ Sleep masking not yet supported for the Rust implant.

Assets 2
Loading