Kharon is a fully PIC agent that operates without a reflective loader and includes evasion features such as sleep obfuscation, heap obfuscation during sleep, stack spoofing with indirect syscalls, BOF API proxy for spoofed/indirect BOF API executions, and AMSI/ETW bypass.
Kharon is compatible with the Extension-Kit and supports its own modules, available in the PostEx-Arsenal.
Modules can be loaded into the client using the kh_modules.axs script.
-
Copy
agent_kharonandlistener_kharon_httpinto:AdaptixC2/AdaptixServer/extenders -
Inside of AdaptixServer folder run:
go work use extenders/agent_kharon go work use extenders/listener_kharon_http go work sync -
Change directory to
AdaptixC2and run:make extenders -
Copy the
src_beaconandsrc_loaderfrom theAdaptixServer/extenders/agent_kharonto thedist/extenders/agent_kharon -
Set
dist/extenders/agent_kharon/config.jsondist/extenders/listener_kharon_http/config.jsoninprofile.json
Example (profile.json):
"extenders": [
"extenders/beacon_listener_http/config.json",
"extenders/beacon_listener_smb/config.json",
"extenders/beacon_listener_tcp/config.json",
"extenders/beacon_agent/config.json",
"extenders/gopher_listener_tcp/config.json",
"extenders/gopher_agent/config.json",
"extenders/agent_kharon/config.json",
"extenders/listener_kharon_http/config.json"
]
Click to expand
- VirtualAlloc
- VirtualAllocEx
- WriteProcessMemory
- ReadProcessMemory
- LoadLibraryA
- VirtualProtect
- VirtualProtectEx
- NtSetContextThread
- SetThreadContext
- NtGetContextThread
- GetThreadContext
- CLRCreateInstance
- CoInitialize
- CoInitializeEx
Click to expand
- BeaconDataParse
- BeaconDataInt
- BeaconDataExtract
- BeaconDataShort
- BeaconDataLength
- BeaconOutput
- BeaconPrintf
- BeaconAddValue
- BeaconGetValue
- BeaconRemoveValue
- BeaconVirtualAlloc
- BeaconVirtualProtect
- BeaconVirtualAllocEx
- BeaconVirtualProtectEx
- BeaconIsAdmin
- BeaconUseToken
- BeaconRevertToken
- BeaconOpenProcess
- BeaconOpenThread
- BeaconFormatAlloc
- BeaconFormatAppend
- BeaconFormatFree
- BeaconFormatInt
- BeaconFormatPrintf
- BeaconFormatReset
- BeaconFormatToString
- BeaconWriteAPC
- BeaconDripAlloc
- BeaconGetSpawnTo