Brute Ratel C4 Blogs

Keep yourself updated with the latest tactics and techniques using Brute Ratel C4.

  • PE Reflection: The King is Dead, Long Live the King

    Research Feature-update

    Reflective DLL injection remains one of the most used techniques for post-exploitation and to get your code executed during initial access. The initial release of reflective DLLs by Stephen Fewer provided a great base for a lot of offensive devs to build their tools which can be executed in memory. Later came in PowerShell and C# reflection which use CLR DLLs to execute managed byte code in memory. C# and PowerShell reflection are both subject to AMSI scan which perform string based detections on the byte code, which is not a lot different from your usual Yara rule detection. Reflective DLLs however provide a different gateway which at a lower level allows you to customize how the payload gets executed in memory. Most EDRs in the past 3-4 years have upgraded their capabilities to detect the default process injection techniques which utilize Stephen Fewer’s reflective loader along with his Remote Process Execution technique using the CreateRemoteThread API.

  • Update v0.4.2 - Chaos Theory


    This is a minor update to Brute Ratel C4 v0.4.1 (Chaos Theory) which was released a few days back. This update brings a minor feature release and a few UI bug fixes on Commander. The next major release will be focusing on Credential Harvesting. So, I decided to add the process mitigation policy feature as a minor update along with some bug fixes before I move to the next major release.

  • Release v0.4.1 - Chaos Theory


    Brute Ratel C4 v0.4.1 (Chaos Theory) is now available for download and provides a major update towards process injection, memory allocation, thread execution and Adversary Simulations. Multiple other commands for discovery and lateral movement and graphical changes for ease of use have also been added to the Badger and the Commander UI.

  • Release v0.3 - Pivots, Rotations and Payloads


    Brute Ratel C4 v0.3 (Vendetta) is now available for download and provides a major update towards lateral movement and payload generation capabilities. We have officially started providing trial licenses of 7 days now which wasn’t possible earlier due to the way the licensing system was programmed.

  • Release v0.2 - Big Things Have Small Beginnings


    Brute Ratel C4 v0.2 (Prometheus) is now available for download and provides a major update towards process injections and adversary simulations. Along with this release, we have started providing access to an Active Directory trial lab to test the features of injection and pivoting of BRC4 over the test environment.

  • Executing Position Independent Shellcode from Object Files in Memory

    Research Feature-update

    Reflective DLL and shellcode injection remain one of the most used techniques for threat actors as well as Red Teamers for post exploitation since the executions happen only in memory and they don’t have to drop anything to disk. However, most of the offsec-tools use shellcode injection only for initial access or for exploitation of vulnerable services and processes. Reflective DLLs and C# executables which can be loaded directly into memory are more often the choice of adversaries for post-exploitation tasks, since writing them is a less tedious task than writing assembly code as we have to manage the stack and registers ourselves in assembly. However, what if we can write the shellcode in a higher language like C? In this blog, we will delve into the dark corners of linkers and compilers to write a position independent code in C and extract it’s shellcode.