Listen to this Post
Introduction:
The offensive security landscape is witnessing a significant evolution with the release of Kharon v0.1, an advanced Command and Control (C2) agent designed specifically for evasion-centric operations. Built to operate within the AdaptixC2 framework, Kharon integrates sophisticated anti-forensic techniques like sleep obfuscation, heap encryption, and indirect syscalls directly into its core, representing a new generation of post-exploitation tools that challenge modern Endpoint Detection and Response (EDR) systems. This article provides a technical deep dive into its architecture, evasion mechanisms, and practical implementation for red team operators.
Learning Objectives:
- Understand the core evasion techniques implemented in Kharon, including stack spoofing and indirect syscalls.
- Learn how to configure and deploy Kharon within the AdaptixC2 framework for operational testing.
- Master the integration of Kharon with Extension-Kit and post-exploitation modules for advanced adversary emulation.
You Should Know:
1. Timer-Based Sleep Obfuscation and Heap Encryption
Sleep obfuscation is a critical technique for evading EDR sandboxes and automated analysis systems that detect beacons based on regular sleep intervals. Kharon implements timer-based evasion that alters the thread’s wait time dynamically, breaking signature-based detection.
Step-by-step guide:
- Kharon’s sleep obfuscation works by replacing standard `Sleep()` API calls with a custom implementation that uses the `WaitForSingleObject` API on a timer, making the sleep pattern irregular and harder to profile.
- To verify and test sleep evasion on a Windows system, you can use the following PowerShell command to monitor thread states:
Get-Process -Name "notepad" | ForEach-Object { $_.Threads | Select-Object Id, WaitReason, ThreadState } - For heap encryption, Kharon encrypts heap memory regions during idle periods, preventing memory scanning tools from extracting sensitive configuration data. This is typically implemented using XOR or AES encryption on critical memory sections.
2. Stack Spoofing with Indirect Syscalls
Stack spoofing manipulates the call stack to hide the true execution flow, while indirect syscalls bypass user-mode API hooks placed by EDR solutions by directly invoking kernel-mode system calls.
Step-by-step guide:
- Traditional EDR solutions hook Windows APIs like
NtAllocateVirtualMemory. Kharon bypasses this by retrieving the System Service Number (SSN) and calling the `syscall` instruction directly from the `ntdll.dll` module. - A typical indirect syscall implementation in C for x64 systems would look like:
UINT_PTR pNtAllocateVirtualMemory = (UINT_PTR)GetProcAddress(GetModuleHandleA("ntdll"), "NtAllocateVirtualMemory"); ASM_JMP_INDIRECT(pNtAllocateVirtualMemory); // Custom assembly trampoline - Stack spoofing is achieved by crafting a fake stack frame using ROP-like techniques before returning to the legitimate code path, effectively obscuring the call trace visible to EDR stack walking algorithms.
3. BOF API Proxy for Spoofed Execution
Beacon Object Files (BOF) are a popular method for executing post-exploitation code in memory. Kharon enhances this with an API proxy that intercepts and spoofs API calls, providing an additional layer of indirection.
Step-by-step guide:
- The BOF API proxy works by creating a wrapper around common BOF functions that redirects execution through a series of decoy calls before reaching the actual implementation.
- To integrate a custom BOF with Kharon’s proxy, you would modify the BOF’s entry point to call the proxy initialization function first:
ifdef BOF include "proxy.c" void go(IN PCHAR Args, IN ULONG Length) { PROXY_INIT(); // Original BOF code here } endif - This mechanism allows operators to execute standard BOFs from repositories like PostEx-Arsenal without modification, while gaining the evasion benefits of Kharon’s execution chain.
4. Agent Configuration and Process Handling
Kharon provides extensive configuration options for controlling agent behavior, including parent-process spoofing and controlled process creation flows that are essential for evading parent-child process analysis.
Step-by-step guide:
- The config command in Kharon allows operators to specify the parent process ID (PPID) for spawned processes, enabling techniques like spawning from `explorer.exe` or `svchost.exe` to appear legitimate.
- A typical process creation flow with PPID spoofing can be achieved through the following Windows API sequence:
CreateProcessA(NULL, "cmd.exe", NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &si, &pi); UpdateProcThreadAttribute(..., PROC_THREAD_ATTRIBUTE_PARENT_PROCESS, ...); ResumeThread(pi.hThread);
- Kharon supports multiple execution modes: inline (executing within the current process) and fork (creating a new process), providing flexibility for different operational scenarios.
5. Integration with Extension-Kit and Module Ecosystem
Kharon’s compatibility with the Extension-Kit project and its own module repository enables operators to extend its capabilities with specialized post-exploitation functionality.
Step-by-step guide:
- To integrate Kharon with Extension-Kit, clone both repositories and build the necessary dependencies:
git clone https://github.com/entropy-z/Kharon git clone https://github.com/entropy-z/Extension-Kit cd Kharon && make release
- The PostEx-Arsenal repository provides numerous modules for lateral movement, credential dumping, and in-memory execution that are compatible with Kharon. For example, to execute a .NET assembly in memory using Kharon:
Import-Module ./Invoke-KharonDotNet.ps1 Invoke-KharonDotNet -AssemblyBytes $bytes -EntryPoint Main
- This integration creates a powerful ecosystem where operators can leverage existing tools while benefiting from Kharon’s advanced evasion capabilities.
6. AdaptixC2 Framework Operation
Understanding how Kharon operates within the AdaptixC2 framework is essential for effective deployment in red team exercises.
Step-by-step guide:
- AdaptixC2 provides the command and control infrastructure that Kharon agents call back to. After compiling Kharon, operators configure the C2 server address and listener settings in the agent configuration file.
- A typical deployment workflow involves:
- Setting up the AdaptixC2 server on a compromised VPS with proper redirector configuration.
- Compiling Kharon with the appropriate server address and encryption keys.
- Deploying the agent through initial access vectors like phishing or web exploitation.
- Managing agents through the AdaptixC2 web interface or CLI.
– Network communication can be obfuscated using HTTPS or custom encryption protocols supported by both AdaptixC2 and Kharon.
7. Operational Security Considerations
While Kharon provides advanced evasion capabilities, operators must still follow proper tradecraft to maintain operational security during engagements.
Step-by-step guide:
- Always use Kharon’s encryption features for both in-memory data and network communications to prevent interception.
- Regularly rotate C2 infrastructure and use domain fronting where possible to hide the actual C2 server.
- Implement proper logging and cleanup procedures to remove artifacts of Kharon execution after operations:
Windows command to clear event logs wevtutil el | ForEach-Object {wevtutil cl "$_"} - Test Kharon against the target organization’s specific EDR solutions in a lab environment before deployment to ensure compatibility and evasion effectiveness.
What Undercode Say:
- Kharon represents a significant advancement in evasion technology, moving beyond simple signature bypasses to comprehensive execution path obfuscation.
- The integration with established tools like Extension-Kit and PostEx-Arsenal demonstrates a mature approach to red team tooling that emphasizes interoperability over isolated solutions.
- Defenders should focus on behavioral detection rather than static signatures, particularly monitoring for unusual indirect syscall patterns and memory encryption activities.
- The open-source nature of Kharon allows both red and blue teams to study its techniques, accelerating the evolution of offensive and defensive capabilities.
- Organizations should implement multi-layered defense strategies including network monitoring, endpoint behavioral analysis, and strict application control to counter advanced C2 frameworks like Kharon.
Prediction:
The release of Kharon v0.1 signals a new phase in the cat-and-mouse game between attackers and defenders. As evasion techniques become more sophisticated and integrated directly into C2 frameworks, we can expect to see increased adoption of these methods in real-world attacks, particularly by advanced persistent threat groups. This will force EDR vendors to develop more advanced detection capabilities focused on behavioral analysis rather than static signatures. Additionally, the modular design and compatibility with existing toolkits will lead to rapid evolution and customization of Kharon-derived tools in the wild, potentially lowering the barrier to entry for sophisticated attacks and necessitating more proactive defense postures across the industry.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Josu%C3%A9 M – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
