# LightsOut | Generate An Obfuscated DLL That Will Disable AMSI And ETW

**URL:** <https://onehack.st/t/lightsout-generate-an-obfuscated-dll-that-will-disable-amsi-and-etw/265726>\
**Category:** Tools & Scripts\
**Tags:** tools, programming\
**Created:** [November 25, 2023, 9:19pm UTC](https://onehack.st/t/lightsout-generate-an-obfuscated-dll-that-will-disable-amsi-and-etw/265726 "2023-11-25T21:19:05Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![WhiteHat](https://onehack.st/user_avatar/onehack.st/whitehat/32/162514_2.png) [@WhiteHat](https://onehack.st/u/WhiteHat)\
**Post date:** [November 25, 2023, 9:19pm UTC](https://onehack.st/t/lightsout-generate-an-obfuscated-dll-that-will-disable-amsi-and-etw/265726/1 "2023-11-25T21:19:05Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/b/5/b53993daaa78d33c848342624d36bd9dd0574420.png)

# LightsOut

LightsOut will generate an obfuscated DLL that will disable AMSI & ETW while trying to evade AV. This is done by randomizing all WinAPI functions used, xor encoding strings, and utilizing basic sandbox checks. Mingw-w64 is used to compile the obfuscated C code into a DLL that can be loaded into any process where AMSI or ETW are present (i.e. PowerShell).

LightsOut is designed to work on Linux systems with `python3` and `mingw-w64` installed. No other dependencies are required.

Features currently include:

- XOR encoding for strings
- WinAPI function name randomization
- Multiple sandbox check options
- Hardware breakpoint bypass option

```auto
 _______________________
| |
| AMSI + ETW |
| |
| LIGHTS OUT |
| _______ |
| || || |
| || _____ || |
| |/ /|| |
| / / || |
| / ____ / /-' |
| | ____ |/ |
| |
| @icyguider |
| |
| RG|
`-----------------------'
usage: lightsout.py [-h] [-m <method>] [-s <option>] [-sa <value>] [-k <key>] [-o <outfile>] [-p <pid>]

Generate an obfuscated DLL that will disable AMSI & ETW

options:
  -h, --help show this help message and exit
  -m <method>, --method <method>
                        Bypass technique (Options: patch, hwbp, remote_patch) (Default: patch)
  -s <option>, --sandbox <option>
                        Sandbox evasion technique (Options: mathsleep, username, hostname, domain) (Default: mathsleep)
  -sa <value>, --sandbox-arg <value>
                        Argument for sandbox evasion technique (Ex: WIN10CO-DESKTOP, testlab.local)
  -k <key>, --key <key>
                        Key to encode strings with (randomly generated by default)
  -o <outfile>, --outfile <outfile>
                        File to save DLL to

Remote options:
  -p <pid>, --pid <pid>
                        PID of remote process to patch

```

**Intended Use/Opsec Considerations**

This tool was designed to be used on pentests, primarily to execute malicious powershell scripts without getting _blocked_ by AV/EDR. Because of this, the tool is very barebones and a lot can be added to improve opsec. Do not expect this tool to completely evade detection by EDR.

**Usage Examples**

You can transfer the output DLL to your target system and load it into powershell various ways. For example, it can be done via P/Invoke with LoadLibrary:

[![image](https://private-user-images.githubusercontent.com/79864975/242732844-75358813-e1bf-4a2b-8059-d539ac97c510.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTEiLCJleHAiOjE3MDA5NDU3OTUsIm5iZiI6MTcwMDk0NTQ5NSwicGF0aCI6Ii83OTg2NDk3NS8yNDI3MzI4NDQtNzUzNTg4MTMtZTFiZi00YTJiLTgwNTktZDUzOWFjOTdjNTEwLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFJV05KWUFYNENTVkVINTNBJTJGMjAyMzExMjUlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjMxMTI1VDIwNTEzNVomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTFiNzEwN2E3MWQ4NDAxMzBiMTE4MzAzNTUwODViMzVmNWY2MzQ0OWYxODQ2YjYyNjYxMjRhNTEyMDU0MDFlYmImWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.6_THZEg8dwzDAj5c0TcnvJcbbw90xfOJ_YuJGAfrD3Y)](https://private-user-images.githubusercontent.com/79864975/242732844-75358813-e1bf-4a2b-8059-d539ac97c510.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTEiLCJleHAiOjE3MDA5NDU3OTUsIm5iZiI6MTcwMDk0NTQ5NSwicGF0aCI6Ii83OTg2NDk3NS8yNDI3MzI4NDQtNzUzNTg4MTMtZTFiZi00YTJiLTgwNTktZDUzOWFjOTdjNTEwLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFJV05KWUFYNENTVkVINTNBJTJGMjAyMzExMjUlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjMxMTI1VDIwNTEzNVomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTFiNzEwN2E3MWQ4NDAxMzBiMTE4MzAzNTUwODViMzVmNWY2MzQ0OWYxODQ2YjYyNjYxMjRhNTEyMDU0MDFlYmImWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.6_THZEg8dwzDAj5c0TcnvJcbbw90xfOJ_YuJGAfrD3Y)

Or even easier, copy powershell to an arbitrary location and side load the DLL!

[![image](https://private-user-images.githubusercontent.com/79864975/242733093-e79c8cca-5e4e-4fb8-a4b5-4b888006b4cf.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTEiLCJleHAiOjE3MDA5NDU3OTUsIm5iZiI6MTcwMDk0NTQ5NSwicGF0aCI6Ii83OTg2NDk3NS8yNDI3MzMwOTMtZTc5YzhjY2EtNWU0ZS00ZmI4LWE0YjUtNGI4ODgwMDZiNGNmLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFJV05KWUFYNENTVkVINTNBJTJGMjAyMzExMjUlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjMxMTI1VDIwNTEzNVomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPThmYTY5ZDg4MjBiNzlhNTU4NjFjMmExNDI5NjY2ZjhhM2FlMDA5YzFlNGJlY2U0NjJmMDMzODM4YjgxMzQ5MWYmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.l4HFXs66j0a0hoxVqbEiNr2DvttBDw6DR2N8Fq92ABM)](https://private-user-images.githubusercontent.com/79864975/242733093-e79c8cca-5e4e-4fb8-a4b5-4b888006b4cf.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTEiLCJleHAiOjE3MDA5NDU3OTUsIm5iZiI6MTcwMDk0NTQ5NSwicGF0aCI6Ii83OTg2NDk3NS8yNDI3MzMwOTMtZTc5YzhjY2EtNWU0ZS00ZmI4LWE0YjUtNGI4ODgwMDZiNGNmLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFJV05KWUFYNENTVkVINTNBJTJGMjAyMzExMjUlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjMxMTI1VDIwNTEzNVomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPThmYTY5ZDg4MjBiNzlhNTU4NjFjMmExNDI5NjY2ZjhhM2FlMDA5YzFlNGJlY2U0NjJmMDMzODM4YjgxMzQ5MWYmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.l4HFXs66j0a0hoxVqbEiNr2DvttBDw6DR2N8Fq92ABM)

**Greetz/Credit/Further Reference:**

- [@RastaMouse](https://twitter.com/_RastaMouse) for their blog post on patching AMSI: [https://rastamouse.me/memory-patching-amsi-bypass/](https://rastamouse.me/memory-patching-amsi-bypass/)
- [@CCob/EthicalChaos](https://twitter.com/_EthicalChaos_) for their blog post on patchless AMSI bypasses via hardware breakpoints: [https://ethicalchaos.dev/2022/04/17/in-process-patchless-amsi-bypass/](https://ethicalchaos.dev/2022/04/17/in-process-patchless-amsi-bypass/)
- [@rad9800](https://twitter.com/rad9800) for their code which this tool uses to bypass AMSI and ETW with hardware breakpoints: [https://github.com/rad9800/misc/tree/main/hooks](https://github.com/rad9800/misc/tree/main/hooks)

## GitHub:

> **[GitHub - icyguider/LightsOut: Generate an obfuscated DLL that will disable AMSI...](https://github.com/icyguider/LightsOut)**
>
> Generate an obfuscated DLL that will disable AMSI & ETW