Shhhloader is a SysWhispers Shellcode Loader that is currently a Work in Progress. It takes raw shellcode as input and compiles a C++ stub that has been integrated with SysWhispers in order to bypass AV/EDR. The included python builder will work on any Linux system that has Mingw-w64 installed.
The tool has been confirmed to successfully load Meterpreter and a Cobalt Strike beacon on fully updated systems with Windows Defender enabled. The project itself is still in a PoC/WIP state, as it currently doesn’t work with all payloads.
2/9/22 EDIT: Shhhloader now includes 5 different ways to execute your shellcode! See below for updated usage. Big thanks to @Snovvcrash and their DInjector project for inspiration! I highly recommend taking a look at it for more information regarding the shellcode injection techniques and code that this tool is now based on.
┳┻|
┻┳|
┳┻|
┻┳|
┳┻| _
┻┳| •.•) – Shhhhh, AV might hear us!
┳┻|⊂ﾉ
┻┳|
usage: Shhhloader.py [-h] [-p explorer.exe] [-m QueueUserAPC] [-nr] [-v] [-d] [-o a.exe] file
ICYGUIDER’S CUSTOM SYSWHISPERS SHELLCODE LOADER
positional arguments:
file File containing raw shellcode
optional arguments:
-h, –help show this help message and exit
-p explorer.exe, –process explorer.exe
Process to inject into (Default: explorer.exe)
-m QueueUserAPC, –method QueueUserAPC
Method for shellcode execution (Options: ProcessHollow, QueueUserAPC,
RemoteThreadContext, RemoteThreadSuspended, CurrentThread) (Default: QueueUserAPC)
-nr, –no-randomize Disable syscall name randomization
-v, –verbose Enable debugging messages upon execution
-d, –dll-sandbox Use DLL based sandbox checks instead of the standard ones
-o a.exe, –outfile a.exe
Name of compiled file
Tested and Confirmed Working on:
VirtualBox is a free, open-source, cross-platform virtualization application maintained by Oracle. It lets you run multiple…
PostgreSQL (also called Postgres) is a free, open-source, object-relational database management system with a strong reputation…
VMware Workstation Player is a mature, stable virtualization platform that lets you run multiple isolated operating…
A properly configured firewall is one of the most important layers of security for any internet-facing server. UFW (Uncomplicated Firewall) is a user-friendly front-end for managing iptables rules that ships pre-installed on Ubuntu. Its defaults are sensible: block all incoming connections, allow all outgoing connections. No outside traffic reaches your server unless you explicitly open a port. This guide covers how to configure a UFW firewall on Ubuntu 18.04, from setting default policies and application profiles to writing allow and deny rules for specific ports, IPs, and subnets. <strong>Prerequisite:</strong> You need sudo access. Configure UFW Firewall on Ubuntu: Defaults, SSH, and Application Profiles If UFW is not installed, add it with: bashsudo…
UFW (Uncomplicated Firewall) is a user-friendly front-end for managing iptables rules on Ubuntu. It ships pre-installed…
Apache Cassandra is a free, open-source NoSQL database designed for high availability and linear scalability with…