👹rust-shellcode👹

This project provides the underlying support for bypass av of offensive activities.
The available Shellcode loaders include:

asm
create_fiber
create_remote_thread
create_remote_thread_native
create_thread
create_thread_native
early_bird
etwp_create_etw_thread
memmap2_transmute
nt_queue_apc_thread_ex_local
rtl_create_user_thread

Build

This is a rust project, you need install rust first.
Then, you can build with follow command:

cargo build --release

Binarys in target/release

How to use

This project is just a basic demo, you need to choose the right loading method, encrypt the shellcode, download the shellcode from the internet, or use it with ETW patch, unhooking, etc.

asm

shellcode execute locally.

link shellcode to .text section
inline asm using asm! macro
call shellcode

create_fiber

shellcode execute locally.

convert current thread to fiber using ConvertThreadToFiber
alloc memory using VirtualAlloc
copy shellcode to allocated memory using std::ptr::copy
create a fiber using CreateFiber
jump shellcode using SwitchToFiber
jump back

create_remote_thread

shellcode execute remotely.
inject explorer.exe by default.

get pid by process name using crate sysinfo
get handle using OpenProcess
alloc remote memory using VirtualAllocEx
copy shellcode to allocated memory using WriteProcessMemory
change memory permission to executable using VirtualProtectEx
execute shellcode using CreateRemoteThread
close opened handle using CloseHandle

create_remote_thread_native

shellcode execute remotely.
inject explorer.exe by default.
this is same with create_remote_thread, but without crate windows-sys
using crate libloading get functions from dlls.

create_thread

shellcode execute locally.

alloc remote memory using VirtualAlloc
copy shellcode to allocated memory using std::ptr::copy
change memory permission to executable using VirtualProtect
execute shellcode using CreateThread
waiting thread exit using WaitForSingleObject

create_thread_native

shellcode execute locally.
this is same with create_thread, but without crate windows-sys
using crate libloading get functions from dlls.

early_bird

shellcode execute remotely.
create and inject svchost.exe by default.

create a process using CreateProcessA
alloc remote memory using VirtualAllocEx
copy shellcode to allocated memory using WriteProcessMemory
change memory permission to executable using VirtualProtectEx
execute process using QueueUserAPC
resume process's thread using ResumeThread
close opened handle using CloseHandle

etwp_create_etw_thread

shellcode execute locally.

get EtwpCreateEtwThread funtion from ntdll using LoadLibraryA and GetProcAddress
alloc remote memory using VirtualAlloc
copy shellcode to allocated memory using std::ptr::copy
change memory permission to executable using VirtualProtect
execute shellcode using EtwpCreateEtwThread
waiting thread exit using WaitForSingleObject

memmap2_transmute

shellcode execute locally.

alloc memory using crate memmap2
copy shellcode using copy_from_slice function from MmapMut struct
change memory permission to executable using make_exec funtion from MmapMut struct
convert memory pointer to fn type using transmute
execute fn

nt_queue_apc_thread_ex_local

shellcode execute locally.

get NtQueueApcThreadEx funtion from ntdll using LoadLibraryA and GetProcAddress
alloc remote memory using VirtualAlloc
copy shellcode to allocated memory using std::ptr::copy
change memory permission to executable using VirtualProtect
get current thread handle using GetCurrentThread
execute shellcode using NtQueueApcThreadEx

rtl_create_user_thread

shellcode execute remotely.
inject explorer.exe by default.

get RtlCreateUserThread funtion from ntdll using LoadLibraryA and GetProcAddress
get pid by process name using crate sysinfo
get handle using OpenProcess
alloc remote memory using VirtualAllocEx
copy shellcode to allocated memory using WriteProcessMemory
change memory permission to executable using VirtualProtectEx
execute shellcode using RtlCreateUserThread
close opened handle using CloseHandle