trustedsec/unicorn
Unicorn
Unicorn is a collection of utilities for generating malicious HTA files, VBA macros, encoded PowerShell commands, and memory-resident shellcode injection frameworks. It provides tools to create payloads designed to achieve remote code execution by bypassing security controls.
The project focuses on weaponizing office documents through VBA macros and formulas, generating HTA attack vectors, and creating encoded PowerShell payloads. It includes a shellcode injection framework to wrap external shellcode for direct execution in system memory.
The toolkit covers binary-to-base64 conversion for certificate-based file transfers and methods for avoiding disk-based detection. It also includes capabilities for PowerShell script encoding and version downgrade attacks to bypass execution policies and security restrictions.
Features
- Weaponized Documents - Creates malicious macros and formulas in Office documents to trigger remote code execution.
- PowerShell Payloads - Creates encoded PowerShell commands and memory injection payloads to bypass security controls.
- Office Macro Payloads - Generates VBA code for spreadsheets or documents that executes commands automatically upon opening.
- Shellcode Injection - Provides a framework for wrapping shellcode into commands for direct execution in system memory.
- VBA Macro Embedding - Embeds malicious command strings inside Office document VBA macros to trigger automatic execution.
- Payload Encoders - Transforms standard PowerShell scripts into encoded commands to bypass security controls when embedded in macros.
- Shellcode Injection Wrappers - Parses formatted shellcode exports to wrap them into injection commands for direct execution in memory.
- Memory-Resident Execution - Generates PowerShell commands that inject code directly into system memory to avoid disk-based antivirus detection.
- PowerShell Policy Bypasses - Uses encoded commands and HTA files to circumvent execution policies and run unsigned code.
- HTA Application Execution - Generates HTML Application (HTA) files that leverage the browser environment to execute system commands.
- HTA Attack Vector Generators - Builds HTML and HTA files that execute commands through web browsers to establish remote shells.
- In-Memory Payload Execution - Injects shellcode directly into volatile memory to establish remote access and evade disk-based antivirus.
- Memory Injection Techniques - Implements methods for injecting shellcode directly into system memory to bypass disk-based security monitoring.
- Office Macro Payload Generators - Generates VBA code and document formulas that trigger command execution when opened in office applications.
- Macro-less Document Payloads - Creates automated formulas for documents that achieve remote code execution without using macros.
- Binary Data Exfiltration - Converts binary data into base64 certificates to transfer tools across networks without triggering security alerts.
- Certificate-Based Payload Delivery - Wraps binary data within certificates to sneak executable code past security filters during file transfers.
- Covert Binary Transfers - Provides functionality to convert binary files into base64 certificates for covert transfer and local decoding.
- HTML Application Payloads - Creates HTA files that trigger command execution through a web browser.
- Version Downgrade Attacks - Forces target systems to use older PowerShell versions to circumvent modern security restrictions and logging.
- Exploit Development - Generator for shellcode across various attack vectors.
- Payload Generation - Generates PowerShell-based payloads.
Star history
How this analysis was created: This summary and feature list were written by an AI model that read the project's README and public documentation pages. Each feature links to the documentation it came from; stars, license and language come straight from the GitHub API. The model does not read the source code, and the analysis is refreshed when the project is re-analysed. Learn more on our About page.
