pullgoscript

KO | EN

gitlite — search

#agent #security #chatbot #api #http #git #ai #pdf #electron #graphql

(★ 16)

A lightweight Command & Control (C2) framework specialized for Windows environments, designed for Red Team operations and post-exploitation research.

File Explorer

ZIP Download

- SKILL.md
- .gitkeep
- research_signal.bin
- install_sliver.sh
- - main.go
  - obliteratus.exe.manifest
  - syscalls.asm
  - syscalls_amd64.s
- - bin.jpg
  - notfound.png
  - obliteratus.png
- - index.html
.gitattributes
.gitignore
context.md
go.mod
HALOS_GATE.md
Makefile
README.md

# Use via CDN

jsDelivr

jsDelivr serves any public GitHub repository as a CDN with zero setup. Pick a version and a file to get a ready-to-paste link and snippet.

Version

File

Link

Example

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

### High-Fidelity Evasion & Identity Nexus Synchronization for Windows NT

![Go](https://img.shields.io/badge/Go-00ADD8?style=for-the-badge&logo=go&logoColor=white)
![Assembly](https://img.shields.io/badge/Assembly-00599C?style=for-the-badge&logo=cplusplus&logoColor=white)
![License](https://img.shields.io/badge/Audit-Research-blue)
![EDR-Evasion](https://img.shields.io/badge/EDR--Evasion-Elite-green?style=for-the-badge)

**OBLITERATUS** is a sophisticated security orchestration engine designed for advanced post-exploitation research and defensive evasion testing. It implements a multi-layered stealth architecture to minimize the "Signature of Intent" while performing deep forensic analysis and identity correlation across modern Windows environments.

---

## ⚡ Technical Core & Evasion Layer

### 🔬 Low-Level Execution Bridge ([Halo's Gate](HALOS_GATE.md))
- **Indirect Syscalls:** Custom ASM bridge (`EnergyFlow`) dynamically resolves System Service Numbers (SSNs) and identifies syscall gadgets within `ntdll.dll`. See [HALOS_GATE.md](HALOS_GATE.md) for technical deep-dive.
- **Stack Hygiene:** Strict adherence to Windows x64 calling conventions and shadow space management to mitigate stack-based anomaly detection.

### 🛡️ Memory Hardening (W^X Strategy)
- **Phase Transitioning:** Eliminates the `RWX` (Read-Write-Execute) footprint. Memory pages are allocated as `PAGE_READWRITE` (0x04) during initial sync and transmuted to `PAGE_EXECUTE_READ` (0x20) using `NtProtectVirtualMemory` immediately before execution.
- **Handle Sanitization:** Precise lifecycle management via `NtClose`, preventing process-to-target linkage leakage in the kernel object table.

### 🧠 Identity Nexus & Intelligence
- **Semantic Correlation:** Advanced "Identity Nexus" module that performs a Bayesian-like join between session cookies and saved credentials. It identifies **Critical Compromise Nodes** where an active session matches a stored identity, bypassing MFA requirements.
- **App-Bound Research (v20):** Integrated COM-based suitor module that interacts with the `Google Chrome Elevation Service` (`IElevator`) to research bypasses for modern Chromium encrypted stores.
- **VFS Forensic Sanitization:** Utilizes memory-backed SQLite processing to perform triple-copy snapshots (DB+WAL+SHM) with zero disk persistence in `%TEMP%`.

### 🔒 Zero-Trust Orchestration
- **Ephemeral Tokenization:** All orchestration endpoints are shielded by a PID-based ephemeral token (`X-Signal-Token`), preventing unauthorized local process interference.
- **Automatic UAC Elevation:** The binary self-elevates to Administrator on startup via `ShellExecuteW` with the `runas` verb, ensuring all privileged operations (registry writes, COM interfaces, memory manipulation) succeed without manual elevation.
- **Handshake Protocol:** The C2 interface is hidden behind a simulated Apache 404 facade.

 <img src="src/img/notfound.png" alt="OBLITERATUS Facade" width="60%">
 
 The system remains dormant behind a 404 facade until the specific interaction sequence (3-click handshake or F2) is executed.

---

## 🖥️ Operational Interface (Master Console)
Featuring a **KaliOS-inspired Dark Theme** with XFCE panel design and custom SVG dock icons:
- **System Optimizer:** One-click kernel-level module to disable Windows Telemetry (`AllowTelemetry`), Error Reporting (`Disabled`), and Tracking (`Start_TrackProgs`) with `DiagTrack` service shutdown.
- **Processes:** Real-time process enumeration with search filtering and PID selection.
- **Architect Module:** Centralized node for process selection and signal synchronization (Quantum Sync, Nexus Correlation, Passwords, Cookies).
- **Decrypter:** Real-time visualization of correlated credentials and active session tokens with CSV export.
- **Terminal Console:** Integrated command execution terminal with live output streaming via WebSocket.
- **Hex Live-Viewer:** Low-level buffer monitoring for payload integrity verification.

---

## 🚀 Deployment & Reconstruction

### Compilation Protocol
1.  **Environment:** Go 1.21+ required.
2.  **Dependency Sync:**
    ```powershell
    go mod tidy
    ```
3.  **Stealth Build:** 
    ```bash
    go build -ldflags="-s -w -H=windowsgui" -o bin/obliteratus.exe ./src/go
    ```

### Operational Use
The binary automatically requests Administrator privileges via UAC on startup:
1. Run `bin/obliteratus.exe` — UAC prompt will appear automatically.
2. Connect via `http://localhost:8080`.
3. Execute **Handshake Protocol** (3-click or F2) to initialize the signal.
4. Status badge will display **[ADMIN]** confirming elevated privileges.

---

## ⚠️ Disclaimer
**OBLITERATUS** is intended strictly for authorized security auditing, research, and educational purposes. The developer assumes no responsibility for unauthorized use. Accessing private data without explicit permission is illegal and unethical.

---
*Engineering Cyber-Resilience through Offensive Innovation.*

pullgoscript

Owner Repos

File Explorer

# Use via CDN

Was this content helpful?

Recent Feedback

pullgoscript

Owner Repos

File Explorer

# Use via CDN

Was this content helpful?

Recent Feedback

Download README