TheWover/donut
Donut
Donut is a toolset for loading and executing payloads in memory, featuring a position-independent shellcode generator, an in-memory payload injector, and a .NET assembly loader. It is designed to convert executable files and scripts into shellcode that can be executed within the memory space of a remote process without writing files to disk.
The project specializes in security evasion through memory-based patching and payload obfuscation using symmetric block ciphers and compression. It includes a remote payload stager to retrieve encrypted modules from HTTP or DNS servers during runtime, reducing the initial on-disk footprint.
The system covers a broad range of capabilities including reflective assembly loading into dedicated memory domains, host process enumeration for injection targets, and multi-format code export for integration into different programming languages. It also provides static and dynamic libraries to embed these code generation and management functions into external software projects.
Features
- Executable-to-Shellcode Converters - Converts executables and scripts into position-independent shellcode for in-memory execution without file system access.
- Shellcode Generators - Generates architecture-specific shellcode targeting x86, x64, or both architectures simultaneously.
- .NET Assembly Shellcode Generators - Converts .NET assemblies into position-independent shellcode for in-memory execution.
- Obfuscated - Generates shellcode with encryption and compression for stealthy delivery and evasion of static analysis.
- Process Injection Payloads - Loads generated shellcode into a target process to execute a .NET assembly entirely from memory.
- Hash-Based API Resolvers - Provides runtime Windows API resolution via hashed function names for position-independent shellcode execution.
- Unmanaged Process Hostings - Uses the Unmanaged CLR Hosting API to load the Common Language Runtime into a process that does not already host it.
- AMSI Bypasses - Patches Antimalware Scan Interface and Windows Lockdown Policy at runtime to prevent detection of dynamically executed code.
- In-Memory Payload Execution - Loads the .NET CLR into unmanaged processes and executes assemblies entirely from memory.
- CLR Hosting Loaders - Loads the .NET CLR into unmanaged processes to execute managed assemblies entirely from memory.
- In-Memory Process Injection - Loads shellcode into a remote process to execute .NET assemblies, EXEs, DLLs, and scripts from memory.
- Managed Assembly Loaders - Loads and executes .NET assemblies directly from memory in isolated AppDomains within unmanaged processes.
- AMSI and WLDP Patchers - Patches AMSI and WLDP in memory at runtime to prevent detection of dynamically executed code.
- Security Software Evasion - Bypasses AMSI and WLDP protections at runtime to prevent detection of dynamically executed code.
- Hash-Based API Resolutions - Resolves Windows API addresses at runtime using hashed function names to enable position-independent execution.
- AppDomain Isolations - Uses .NET AppDomains to isolate payloads and enable full memory unloading after execution.
- .NET Assembly Loaders - Loads and executes .NET assemblies in isolated memory domains without disk access or standard CLR paths.
- Payload Compression Algorithms - Compresses input files with aPLib or Windows compression algorithms before shellcode generation.
- Data Compression Algorithms - Compresses payload data using aPLib, LZNT1, Xpress, or Xpress Huffman algorithms to reduce size.
- Multi-Format Code Exports - Exports generated shellcode as C, Ruby, Python, PowerShell, Base64, C#, or hexadecimal source code.
- PE/COFF Loaders - Loads unmanaged EXE and DLL files from memory using a custom PE loader that handles delayed imports and TLS.
- DNS Shellcode Execution - Stores the generated module on an HTTP or DNS server so the loader fetches and executes it remotely.
- Multi-Format Shellcode Exporters - Exports generated shellcode as C, Ruby, Python, PowerShell, Base64, C#, or hexadecimal source code.
- Programmatic Interfaces - Provides a C library API and a command-line generator so external tools can produce shellcode dynamically on a server or agent.
- Shellcode Payload Compressors - Compresses shellcode payloads using aPLib, LZNT1, Xpress, or Xpress Huffman algorithms.
- Loader Obfuscators - Randomizes strings and optionally encrypts the loader to evade signature-based detection.
- Shellcode - Protects generated payloads with 128-bit symmetric encryption using the Chaskey block cipher.
- Compressors - Compresses shellcode payloads using aPLib, LZNT1, or Xpress algorithms to reduce module size.
- Module Encryptors - Encrypts generated shellcode modules using Chaskey block cipher with random keys.
- In-Memory Payload Encryptors - Encrypts .NET assemblies in memory with Chaskey cipher and erases decrypted copies after loading.
- Scripting Language Executions - Runs VBScript and JScript files in memory using the IActiveScript interface with minimal Windows Script Host support.
- Remote Payload Stagers - Downloads an encrypted Donut Module from a specified URL at runtime instead of embedding it in the shellcode.
- Symmetric Encryption - Protects payload modules with 128-bit Chaskey symmetric block cipher encryption and random keys.
- Payload Hosting - Embeds a download URL in the shellcode so the .NET assembly is fetched from a remote server at runtime.
- CLR Runtime Version Selectors - Selects .NET CLR runtime versions for loading, with fallback to available versions.
- File Format Analysis - Generates shellcode to load .NET assemblies and PE files from memory.
- Initial Access Frameworks - In-memory execution of various file types and assemblies.
- Payload Development - In-memory execution of various file types and assemblies.
- Shellcode Injection - Generates position-independent shellcode from .NET assemblies and PE files.
- Windows Post Exploitation - Executes arbitrary code in-memory to avoid writing files to disk.
