cradle

cradle is a small(-ish) toolkit that allows beacon developers to test their beacon's footprint against a system they own. In its current version, it's pretty much complete, with just a bit of fine-tuning, and a few more features left to implement. Currently, cradle-agent only supports Windows binaries, as I'm still figuring out how it would work on Linux.

Binaries

The binaries included within this project are the Cradle agent and cli tools. Each one is currently located in its own repository, linked below

cradle-agent

Warning

As mentioned above, cradle-agent currently only supports Windows The main execution engine. Does the heavy lifting

• Repository: https://github.com/AzathothC2/cradle-agent

cradle-cli

The "default" client that connects to the agent. Nothing much to say about it, really. If you want to develop your own client for cradle, you can look at the cradle-shared library

• Repository: https://github.com/AzathothC2/cradle-cli

Libraries

• cradle-hooks: The main hooking library for the agent and its plugins
• cradle-net: This library allows plugins (and the cradle agent) to track network connections and data
• cradle-plugin-api If you want to develop a plugin for cradle, refer to this repository as it contains the necessary information

Plugins

As of now the built-in plugins for cradle are still in a private repository, as I feel that they need to be cleaned up before release. However, I will mention which plugins those are:

• cradle-netserver: Spins up a local server and hooks onto functions from ws2_32.dll and redirects all traffic sent from the process (sockets included) to the local server for analysis
• cradle-dynamics: Logs and monitors the runtime behavior of the target process. Includes checking for debug strings, loaded DLLs, exceptions, etc.
• cradle-netmonitor: Logs and monitors network behaviors, without modifying the data (unlike cradle-netserver)
• cradle-threatcheck: Runs my Rust port of Rasta Mouse's ThreatCheck tool

How it works

The cradle-agent binary loads user-supplied plugins that execute the specified checks
It emits events throughout the entire lifespan of the process (including before it runs, i.e suspended) that plugins can register to and use.