Regarding opsec and strip/remap-path-prefix

[yamakadi]

Hi @trickster0!

I just noticed the addition regarding strip in the readme and wanted to check if we are seeing different results.

I use an almost identical Cargo.toml with strip, etc. but even then the home directory is left in the binary. That was what I meant with even if you remove all debug symbols.

This is something that bit me before and that's how I ended up with the --remap-path-prefix solution. It looks like trim-path was proposed as an alternative to passing --remap-path-prefix and --remap-cwd-prefix as a flag during build at !3127, but it hasn't been merged yet.

If we see a difference, it could be due to different dependencies as mentioned in this issue. Or, maybe OS? I mostly compile on a Mac using x86_64-pc-windows-gnu as the target.

Anyway, I just wanted to check and see if we are on the same page.

[trickster0]

I mostly use msvc, try to use the same flags for cargo and write the write arguments for cargo build and let me know cause I'm my case , it is totally fine without home dir

[yamakadi]

I tried the arguments, etc. you suggested (the only difference from mine were trim-path and the build-std flags) before I posted the issue. I also updated to the latest version to see if anything had changed. You can see my default configuration below.

# .cargo/config.toml

[profile.release]
codegen-units = 1
panic = "abort"
lto = true
opt-level = "z"
strip = "symbols"

# Cargo.toml
# cargo-features = ["strip"] isn't necessary since Rust 1.58

[package]
name = "something"
version = "0.1.0"
edition = "2021"

# standard [[bin]] and [dependencies], etc.

cargo build --release --target=x86_64-pc-windows-gnu -Z build-std=std,panic_abort -Z build-std-features=panic_immediate_abort 

If you are not seeing any references to the home directory, it could be due to different dependencies.
I ran the current samples with your suggested configuration and both with and without the build-std flags.
http-https-requests seem to have the most instances of username. reqwest, openssl, and wmi are the likely culprits.

Package	#	# with build-std
Allocate_With_Syscalls	0	0
Create_DLL.dll	0	0
DeviceIoControl	0	0
EnableDebugPrivileges	0	0
Exec_Shellcode_In_Memory	0	0
Execute_Without_Create_Process	0	0
ImportedFunctionCall	0	0
Kernel_Driver_Exploit	0	0
Named_Pipe_Client	0	0
Named_Pipe_Server	0	0
Process_Injection_CreateThread	0	0
UUID_Shellcode_Execution	0	0
asm_syscall	0	0
base64_system_enum	3	0
http-https-requests	522	395
patch_etw	0	0
ppid_spoof	0	0
rust-unhooking	0	0
tcp_ssl_client	6	1
tcp_ssl_server	6	1
wmi_execute	5	3

This issue will be solved eventually when trim-paths is merged into standard (likely in the next edition, 2024?) but in the meantime, strip isn't enough for every case. It might be better to reword the section in the readme.

[yamakadi]

@trickster0 Anyway, this is your package and your advice in the readme. If you are comfortable with leaving it as it is, I don't mind. I just thought you should know.

[trickster0]

Hey, yup I checked it and you are right depending on the libraries imported it still might include the path, so i updated the readme. thx man.

[yamakadi]

Thank you! Apologies if I came off standoffish 😅

[trickster0]

You did but that is okay 😅 I had to check and verify yet.