Changelog

Verifying this release

Every archive is covered by checksums.txt. The checksum file is signed
keyless with cosign — the signature is in checksums.txt.sig and the
ephemeral certificate in checksums.txt.pem, with the transparency-log
entry in Rekor. Full commands (and the Authenticode / SmartScreen note for
Windows) are in docs/SIGNING.md.

⚠️ OBLITERATUS ships offensive modules (credential collection, injection,
persistence). Windows Defender / SmartScreen will flag the unsigned
executables. That is expected: the binaries are not Authenticode-signed.
Verify against the checksums above, and run only on systems you are
authorised to test.

OBLITERATUS 2.0.1

A focused patch release for the two gated modules that could fail without telling you why. If you downloaded 2.0.0, replace it — the binaries differ.

Fixed in this release

• elevate — --enable-collect now elevates up front. The SAM/SYSTEM hive exports need SeBackupPrivilege, the LSASS minidump needs SeDebugPrivilege, and the browser App-Bound key unwrap spawns a SYSTEM helper — none of them can work with a filtered token. In 2.0.0 you discovered that only when a dump came back empty. The UAC relaunch now happens at startup, so the module is either fully usable or absent.

  • The relaunched child is tagged with an internal -elevation-attempted marker, so a token that never elevates (prompt declined, or policy strips the Administrators group) fails loudly instead of looping on UAC prompts. The marker is stripped before flag parsing and never appears in -h.
  • The other modules stay usable unelevated (HKCU Run keys, own-process ETW/AMSI patching, remote WinRM/SCM) and are not force-elevated — no UAC prompt you did not ask for.

• SAM — every failure rendered as "no SAM material (needs elevation)". handleSAMStream logged the real error and then broadcast a bare sam_done regardless, so the dashboard painted that misleading empty state even when the token was already elevated. The real cause never left the server log. Failures now stream as a sam_error event carrying the actual message, and the dashboard renders it.

• LSASS — a failed dump emitted nothing at all. handleLSASS logged and returned without broadcasting, so the dashboard waited forever for a lsass_done that never arrived. Failures now emit lsass_error.

Verification

gofmt clean, go vet clean on Windows and Linux, full test suite green, cross-builds for windows/{386,amd64,arm64}, linux/amd64 and darwin/arm64.

New regression coverage that runs on CI without elevation: TestStripMarker (6 cases, including that the input slice is never mutated), TestSAMTerminalEvents and TestLSASSTerminalEvents (a failure must produce exactly one error event and never a bare done).

Exercised live against a real host:

• LSASS with an invalid PID, captured over the WebSocket channel — {"type":"lsass_error","error":"...OpenProcess PID 999999: The parameter is incorrect..."} reaches the dashboard. In 2.0.0 the same request produced silence.
• SAM, elevated: sam_chunk with 7 accounts followed by sam_done — no regression.
• Non-elevated context (a scheduled task with a filtered token) plus the marker: exits with --enable-collect needs an elevated token and the UAC relaunch did not provide one — no UAC loop, no half-working module.
• Non-elevated without the marker: the UAC elevation request is issued as intended.

Assets

• obliteratus.exe — windows/amd64, stripped (-s -w), 11,898,880 bytes
• SHA-256: 15abc0902429c469d1c2fafbfa3e0d7aee07ae338bd6a36ebc9c763f16134cce

Disclaimer

For authorized security assessment, research and education on systems you own or are contracted to test. The credential-collection, persistence, evasion, lateral-movement and injection modules are deliberately locked; unlocking them is an explicit acknowledgement that your engagement permits their use.

OBLITERATUS 2.0.0

The v2 modular rewrite, feature-complete: the Mimikatz attack-surface audit plus five gated offensive modules.

OBLITERATUS answers one question — would Mimikatz work against this host? — and answers it with evidence, mapping every finding to the Mimikatz module and MITRE technique it corresponds to.

Defensive core (always on)

• 12 Mimikatz-mapped audit checks with JSON/CSV export and a documented exit-code contract (1 = a CRITICAL/HIGH control is failing)
• Loopback-only dashboard with a per-run 256-bit crypto/rand token, Host allow-list, POST-only mutations, CSP and module gating

Gated modules

Each route answers 403 with the flag that would unlock it until that flag is passed explicitly.

Fixed in this release

• persist — scheduled tasks were never listed. The parser read HostName (column 0) as the task name and Author (column 7) as the action; the real columns are 1 (TaskName) and 8 (Task To Run). On top of that, csv.ReadAll aborted the entire stream on schtasks' non-conforming CSV output (a task action containing quotes is written as ""C:\...exe" /c"" without doubling them), so the module returned zero scheduled tasks on every host. It now parses the correct columns, tolerates malformed rows, and de-duplicates the per-trigger repeats that /V emits.
• persist — WMI removal silently did nothing while answering OK. The WQL filter was built as ("Name=" + 'x'), which PowerShell evaluates to the unquoted query Name=x — invalid WQL, swallowed by $ErrorActionPreference='SilentlyContinue'. The __EventFilter and CommandLineEventConsumer survived removal; only the binding was deleted, because it is matched with -like rather than WQL. Removal now quotes the value inside the query, targets both the verbatim and the prefixed name, and verifies the consumer is gone before reporting success.
• ui — the Relay view had no VIEW_META entry, leaving its title and description blank.
• tests — the schtasks fixture encoded the same wrong column assumption as the code, so it passed while the bug shipped. It now uses output captured from a real schtasks run, and the Windows-only tests moved behind a build tag so go vet ./... compiles on non-Windows.

Verification

gofmt clean, go vet clean on Windows and Linux, full test suite green, cross-builds for windows/{386,amd64,arm64}, linux/amd64 and darwin/arm64.

Every module was exercised live against a real host: fail-closed 403s, DNS-rebinding rejection, 405 on wrong verbs, ETW/AMSI patching with idempotent re-patch, and persistence add/list/remove round-trips verified directly against the registry, the Task Scheduler and root\subscription — with no residue left behind.

Assets

• obliteratus.exe — windows/amd64, stripped (-s -w), 11,893,248 bytes
• SHA-256: 332514b7d1d8dc005559f469c3fa9c4675f42a022c7dfe697ea8766a9bf879be

Disclaimer

For authorized security assessment, research and education on systems you own or are contracted to test. The credential-collection, persistence, evasion, lateral-movement and injection modules are deliberately locked; unlocking them is an explicit acknowledgement that your engagement permits their use.