byt3bl33d3r/OffensiveNim

OffensiveNim

My experiments in weaponizing Nim for implant development and general offensive operations.

Table of Contents

• OffensiveNim
  • Table of Contents
  • Why Nim?
  • Examples in this repo that work
  • Examples that are a WIP
  • Compiling the examples in this repo
    • Easy Way (Recommended)
    • Hard way (For the bold)
  • Cross Compiling
  • Interfacing with C/C++
  • Creating Windows DLLs with an exported DllMain
    • Creating XLLs
  • Optimizing executables for size
  • Reflectively Loading Nim Executables
  • Executable size difference when using the Winim library vs without
  • Opsec Considerations
  • Writing Nim without the Nim Runtime
  • Converting C code to Nim
  • Language Bridges
  • Debugging
  • Setting up a dev environment
  • Pitfalls I found myself falling into
  • Interesting Nim libraries
  • Nim for implant dev links
  • Contributors

Why Nim?

• Compiles directly to C, C++, Objective-C and Javascript.
• Since it doesn't rely on a VM/runtime does not produce what I like to call "T H I C C malwarez" as supposed to other languages (e.g. Golang)
• Python inspired syntax, allows rapid native payload creation & prototyping.
• Has extremely mature FFI (Foreign Function Interface) capabilities.
• Avoids making you actually write in C/C++ and subsequently avoids introducing a lot of security issues into your software.
• Super easy cross compilation to Windows from *nix/MacOS, only requires you to install the mingw toolchain and passing a single flag to the nim compiler.
• The Nim compiler and the generated executables support all major platforms like Windows, Linux, BSD and macOS. Can even compile to Nintendo switch , IOS & Android. See the cross-compilation section in the Nim compiler usage guide
• You could technically write your implant and c2 backend both in Nim as you can compile your code directly to Javascript. Even has some initial support for WebAssembly's

Examples in this repo that work

Examples that are a WIP

Compiling the examples in this repo

This repository does not provide binaries, you're gonna have to compile them yourself. This repo was setup to cross-compile the example Nim source files to Windows from Linux or MacOS.

Easy Way (Recommended)

Use VSCode Devcontainers to automatically setup a development environment for you (See the Setting Up a Dev Environment section). Once that's done simply run make.

Hard way (For the bold)

Install Nim using your systems package manager (for Windows use the installer on the official website)

• brew install nim
• apt install nim
• choco install nim

(Nim also provides a docker image on Dockerhub)

You should now have the nim & nimble commands available, the former is the Nim compiler and the latter is Nim's package manager.

Install the Mingw toolchain needed for cross-compilation to Windows (Not needed if you're compiling on Windows):

• *nix: apt-get install mingw-w64
• MacOS: brew install mingw-w64

Finally, install the magnificent Winim library, along with zippy and nimcrypto

• nimble install winim zippy nimcrypto

Then cd into the root of this repository and run make.

You should find the binaries and dlls in the bin/ directory

Cross Compiling

See the cross-compilation section in the Nim compiler usage guide, for a lot more details.

Cross compiling to Windows from MacOs/*nix requires the mingw toolchain, usually a matter of just brew install mingw-w64 or apt install mingw-w64.

You then just have to pass the -d=mingw flag to the nim compiler.

E.g. nim c -d=mingw --app=console --cpu=amd64 source.nim

Interfacing with C/C++

See the insane FFI section in the Nim manual.

If you're familiar with csharps P/Invoke it's essentially the same concept albeit a looks a tad bit uglier:

Calling MessageBox example

type
    HANDLE* = int
    HWND* = HANDLE
    UINT* = int32
    LPCSTR* = cstring

proc MessageBox*(hWnd: HWND, lpText: LPCSTR, lpCaption: LPCSTR, uType: UINT): int32 
  {.discardable, stdcall, dynlib: "user32", importc: "MessageBoxA".}

MessageBox(0, "Hello, world !", "Nim is Powerful", 0)

For any complex Windows API calls use the Winim library, saves an insane amount of time and doesn't add too much to the executable size (see below) depending on how you import it.

Even has COM support!!!

Creating Windows DLLs with an exported DllMain

Big thanks to the person who posted this on the Nim forum.

The Nim compiler tries to create a DllMain function for you automatically at compile time whenever you tell it to create a windows DLL, however, it doesn't actually export it for some reason. In order to have an exported DllMain you need to pass --nomain and define a DllMain function yourself with the appropriate pragmas (stdcall, exportc, dynlib).

You need to also call NimMain from your DllMain to initialize Nim's garbage collector. (Very important, otherwise your computer will literally explode).

Example:

import winim/lean

proc NimMain() {.cdecl, importc.}

proc DllMain(hinstDLL: HINSTANCE, fdwReason: DWORD, lpvReserved: LPVOID) : BOOL {.stdcall, exportc, dynlib.} =
  NimMain()
  
  if fdwReason == DLL_PROCESS_ATTACH:
    MessageBox(0, "Hello, world !", "Nim is Powerful", 0)

  return true

To compile:

nim c -d=mingw --app=lib --nomain --cpu=amd64 mynim.dll

Creating XLLs

You can make an XLL (an Excel DLL, imagine that) with an auto open function that can be used for payload delivery. The following code creates a simple for an XLL that has an auto open function and all other boilerplate code needed to compile as a link library. The POC compiles as a DLL, you can then change the extension to .xll and it will open in Excel and run the payload when double clicked:

#[
    Compile:
        nim c -d=mingw --app=lib --nomain --cpu=amd64 nim_xll.nim
        
    Will compile as a DLL, you can then just change the extension to .xll
]#

import winim/lean

proc xlAutoOpen() {.stdcall, exportc, dynlib.} =
    MessageBox(0, "Hello, world !", "Nim is Powerful", 0)

proc NimMain() {.cdecl, importc.}

proc DllMain(hinstDLL: HINSTANCE, fdwReason: DWORD, lpvReserved: LPVOID) : BOOL {.stdcall, exportc, dynlib.} =
  NimMain()

  return true

There are many other sneaky things that can be done with XLLs. See more examples of XLL tradecraft here.

Optimizing executables for size

Taken from the Nim's FAQ page

For the biggest size decrease use the following flags -d:danger -d:strip --opt:size

Additionally, I've found you can squeeze a few more bytes out by passing --passc=-flto --passl=-flto to the compiler. Also take a look at the Makefile in this repo.

These flags decrease sizes dramatically: the shellcode injection example goes from 484.3 KB to 46.5 KB when cross-compiled from MacOSX!

Reflectively Loading Nim Executables

Huge thanks to @Shitsecure for figuring this out!

By default, Nim doesn't generate PE's with a relocation table which is needed by most tools that reflectively load EXE's.

To generate a Nim executable with a relocation section you need to pass a few additional flags to the linker.

Specifically: --passL:-Wl,--dynamicbase

Full example command:

nim c --passL:-Wl,--dynamicbase my_awesome_malwarez.nim

Executable size difference when using the Winim library vs without

Incredibly enough the size difference is pretty negligible. Especially when you apply the size optimizations outlined above.

The two examples pop_bin.nim and pop_winim_bin.nim were created for this purpose.

The former defines the MessageBox WinAPI call manually and the latter uses the Winim library (specifically winim/lean which is only the core SDK, see here), results:

byt3bl33d3r@ecl1ps3 OffensiveNim % ls -lah bin
-rwxr-xr-x  1 byt3bl33d3r  25K Nov 20 18:32 pop_bin_32.exe
-rwxr-xr-x  1 byt3bl33d3r  32K Nov 20 18:32 pop_bin_64.exe
-rwxr-xr-x  1 byt3bl33d3r  26K Nov 20 18:33 pop_winim_bin_32.exe
-rwxr-xr-x  1 byt3bl33d3r  34K Nov 20 18:32 pop_winim_bin_64.exe

If you import the entire Winim library with import winim/com it adds only around ~20ish KB which considering the amount of functionality it abstracts is 100% worth that extra size:

byt3bl33d3r@ecl1ps3 OffensiveNim % ls -lah bin
-rwxr-xr-x  1 byt3bl33d3r  42K Nov 20 19:20 pop_winim_bin_32.exe
-rwxr-xr-x  1 byt3bl33d3r  53K Nov 20 19:20 pop_winim_bin_64.exe

Opsec Considerations

Because of how Nim resolves DLLs dynamically using LoadLibrary using it's FFI none of your external imported functions will actually show up in the executables static imports (see this blog post for more on this):

If you compile Nim source to a DLL, seems like you'll always have an exported NimMain, no matter if you specify your own DllMain or not (??). This could potentially be used as a signature, don't know how many shops are actually using Nim in their development stack. Definitely stands out.

Writing Nim without the Nim Runtime

Since Nim is heavily flagged by Anti-Virus solutions, one way around this is writing Nim programs without the Nim runtime. Writing Nim-less Nim is a talk given on the steps outlining how to write Nim code without the Nim and C runtime, source code from this talk is available here. The talk follows and expands on zimawhit3's work with Bitmancer.

The premise is to rely on winim's type definitions and leverage code writing that would not result in Nim's runtime being used.

Converting C code to Nim

https://github.com/nim-lang/c2nim

Used it to translate a bunch of small C snippets, haven't tried anything major.

Language Bridges

• Python integration https://github.com/yglukhov/nimpy

  • This is actually super interesting, especially this part. With some modification could this load the PythonxXX.dll from memory?

• Jave VM integration: https://github.com/yglukhov/jnim

Debugging

Use the repr() function in combination with echo, supports almost all (??) data types, even structs!

See this blog post for more

Setting up a dev environment

This repository supports VSCode Devcontainers which allows you to develop in a Docker container. This automates setting up a development environment for you.

1. Install VSCode and Docker desktop
2. Clone this repo and open it in VSCode
3. Install the Visual Studio Code Remote - Containers extension
4. Open the command pallete and select Remote-Containers: Reopen in Container command

VScode will now build the Docker image (will take a bit) and put you right into your pre-built Nim dev environment!

Pitfalls I found myself falling into

• When calling winapi's with Winim and trying to pass a null value, make sure you pass the NULL value (defined within the Winim library) as supposed Nim's builtin nil value. (Ugh)

• To get the OS handle to the created file after calling open() on Windows, you need to call f.getOsFileHandle() not f.getFileHandle() cause reasons.

• The Nim compiler does accept arguments in the form -a=value or --arg=value even tho if you look at the usage it only has arguments passed as -a:value or --arg:value. (Important for Makefiles)

• When defining a byte array, you also need to indicate at least in the first value that it's a byte array, bit weird but ok (https://forum.nim-lang.org/t/4322)

Byte array in C#:

byte[] buf = new byte[5] {0xfc,0x48,0x81,0xe4,0xf0,0xff}

Byte array in Nim:

var buf: array[5, byte] = [byte 0xfc,0x48,0x81,0xe4,0xf0,0xff]

Interesting Nim libraries

• https://github.com/dom96/jester
• https://github.com/pragmagic/karax
• https://github.com/Niminem/Neel
• https://github.com/status-im/nim-libp2p
• https://github.com/PMunch/libkeepass
• https://github.com/def-/nim-syscall
• https://github.com/tulayang/asyncdocker
• https://github.com/treeform/ws
• https://github.com/guzba/zippy
• https://github.com/rockcavera/nim-iputils
• https://github.com/FedericoCeratto/nim-socks5
• https://github.com/CORDEA/backoff
• https://github.com/treeform/steganography
• https://github.com/miere43/nim-registry
• https://github.com/status-im/nim-daemon

Nim for implant dev links

• https://web.archive.org/web/20210117002945/https://secbytes.net/implant-roulette-part-1:-nimplant/
• https://securelist.com/zebrocys-multilanguage-malware-salad/90680/
• https://github.com/MythicAgents/Nimplant
• https://github.com/elddy/Nim-SMBExec
• https://github.com/elddy/NimScan

Contributors

Virtual hug to everyone who contributed ❤️