ClickForClickOnce - GitLite

KO | EN

gitlite — search

#ai #typescript #llm #go #golang #machine-learning #linux #macos #windows #cli #awesome-list #mcp #openai #open-source

ClickForClickOnce

(★ 97)

ClickForClickOnce - Generate configurable clickonce payloads

파일 탐색기

최종 버전 다운로드 (.zip)

- - builder.py
  - consts.py
  - hasher.py
  - logging.py
  - misc.py
  - models.py
  - mutator.py
- .python-version
- app.py
- pyproject.toml
- uv.lock
- .gitkeep
- .gitkeep
- index.html
- - PerfWatson2.exe.deploy
  - powershell_ise.exe.deploy
  - ServiceHub.Host.netfx.x64.exe.deploy
  - tzsync.exe.deploy
- - .gitkeep
  - icon.ico
  - Program.cs
  - project.application
  - project.csproj
  - project.exe.config.deploy
  - project.manifest
.gitignore
Caddyfile
ClickForClickOnce.pdf
docker-compose.yaml
Dockerfile
README.md
start.sh
WIKI.md

# 설치 가이드

1. 코드 내려받기

git clone https://github.com/whokilleddb/ClickForClickOnce

깃허브에서 프로젝트 코드 전체를 내 컴퓨터로 내려받습니다.

cd ClickForClickOnce

방금 내려받은 프로젝트 폴더 안으로 이동합니다.

2. Docker

쉬움 추천

사전 준비물

Git GitHub에서 프로젝트 코드를 내려받으려면 필요합니다.
Docker Desktop 컨테이너를 빌드하고 실행하려면 필요합니다. 설치 후 실행해서 백그라운드에 켜두세요.

$ sudo docker compose up --build -d

정의된 모든 컨테이너(서버, DB 등)를 한 번에 빌드하고 백그라운드에서 실행합니다.

✅ 터미널에 docker compose ps 를 입력해 컨테이너들이 Up 상태인지 확인하세요. README에 포트 번호가 적혀있다면 브라우저에서 http://localhost:포트번호 로 접속해보세요.

이 레포의 README에 적힌 실제 명령어를 그대로 가져왔습니다.

3. Python

쉬움

사전 준비물

Git GitHub에서 프로젝트 코드를 내려받으려면 필요합니다.
Python 3 설치 시 'Add Python to PATH' 옵션을 꼭 체크하세요 (Windows).

pip install .

PyPI에 배포된 패키지를 바로 설치합니다. 소스 클론이 필요 없습니다.

python <실행할 파일명>.py # README에서 정확한 실행 파일명을 확인하세요

파이썬 스크립트(또는 모듈)를 실행합니다.

✅ 에러 메시지 없이 실행되고 터미널에 안내 문구가 출력되면 정상입니다.

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# ClickForClickOnce

**ClickForClickOnce** project aims at providing a web-based interface for easily generating configurable and ready-to-deploy clickonce payloads. The project uses Microsoft signed binaries in it's ClickOnce deployments and then sideloads a payload DLL using AppDomainManager Injection. This repository is a part of my [WWHF Deadwood 2025](https://wildwesthackinfest.com/wild-west-hackin-fest-deadwood-2025/) toolshed talk. You can find the slides for the presentation [here](./ClickForClickOnce.pdf).

## Deployment

Deploying the project is as simple as:

```bash
$ git clone https://github.com/whokilleddb/clickforclickonce
$ cd clickforclickonce
$ sudo docker compose up --build -d 
```

## Features

- Execute your fav shellcode
- Drop files to disk - this supports environment variables 
- Run OS commands - this also supports env variables which are expanded at runtime
- Artificially inflating payloads - you can inflate the payload to increase it's size as some EDRs delay scanning of files over a certain size limit
- Multiple Exes to inject into

## EDR Tests

_As on: 28th September, 2025_

We did some internal testing with this tool during our engagements at BHIS and observered the following detections against EDRs:

| EDR Name | Works? |
|:------|:---------:|
| CrowdStrike |❌|
| SentinelOne |✅|
| Sophos |✅| 
| Microsoft Defender For Endpoint |✅| 
| Cylance |❌|

_Note: EDR detections are also largely dependent on OPSEC, C2 configuration, EDR tuning, etc. The provided should be consulted just as a general outline of results and not conclusive evidence._

## Notes

- Shellcode execution is achieved using a stripped down version of [DInvoke](https://github.com/rasta-mouse/DInvoke/) - taking only the parts we need. Execution redirection is achieved via `LdrCallEnclave`. The shellcode execution is delayed by 8 minutes. This is due to a 2 minute delay between certain actions. The delay helps with detections at times. 
- Inflation is achieved using two methods: Inflating the `.text` section or by adding an embedded resource file. Note that by default, the `.text` section is inflated by 10MBs as anything larger causes the compiler to run out of memory during compilation. You can change the 10MB limit by setting the `DATA_CS_SIZE_IN_MB` env variable. For example, to decrease the size to `5MB` set `DATA_CS_SIZE_IN_MB` to `5`.

## References

- [Exploring ClickOnce and .NET Hijacking for SSH Initial Access by Steve Borosh](https://www.youtube.com/watch?v=Zid7tB0Iyss)
- [https://github.com/rasta-mouse/DInvoke/](https://github.com/rasta-mouse/DInvoke/)
- [https://github.com/rvrsh3ll/Bolthole](https://github.com/rvrsh3ll/Bolthole)