MYASO

Meet Yet Another Shellcode Obfuscator!

Evade AV by hiding cmd/shellcode/... payloads inside images and simply running them.

Installation

Linux

apt update
apt install -y gcc libc-dev g++-mingw-w64-i686 g++-mingw-w64-x86-64 libgdiplus mono-devel golang-go
git clone https://github.com/adeadfed/myaso
cd myaso
pip3 install -r requirements.txt

Docker

git clone https://github.com/adeadfed/myaso
cd myaso
docker build -t myaso:latest .

Usage

Generate image

myaso embed -a sc.bin [-i image.bmp] [-a <algorithm>] -o evil_image.bmp

In Docker:

docker run --rm -it -v `pwd`:/mnt/ myaso embed -f /mnt/your_shellcode.bin -o /mnt/stego.png -a LSB

Generate runner

myaso bake

You will be asked all the details interactively. At the end you'll be offered to save the configuration, which you can then use with:

myaso bake [--def saved_definition.yml]

[banner]

? Desired stego algorithm:  LSB
? Desired runner language:  C++
? Desired runner arch:  x64
? Desired payload type:  Shellcode
? Desired image source:  (Use arrow keys)
 ❯ ImageFile
   HTTPX
  ...

In Docker:

docker run --rm -it -v `pwd`:/mnt/ myaso bake 

(Set output to your mount dir!)

[banner]

? Desired stego algorithm:  LSB
...
? Output runner file:  /mnt/your_runner.exe
? Save config to file?  Yes
? Location:  /mnt/your_config.yml

Execute shellcode

c:\> reader.exe happy_cat.bmp PAYLOAD_BYTES

Feature support

Supported stego algorithms:

| Algorithm | C++ | C# | Go | PS | VBA | |-----------|-----|----|----|----|-----| | LSB | ✓ | ✓ | ✓ | ✓ | ✓ | | LSBX | ✓ | ✓ | ✓ | ✓ | ✓ | | LSBM | ✓ | ✓ | ✓ | ✓ | ✓ | | ColorCode | ✓ | ✓ | ✓ | ✓ | ✓ |

Supported payload types:

| Payload | C++ | C# | Go | PS | VBA | |-----------|-----|----|----|----|-----| | CMD | ✓ | ✓ | ✓ | ✓ | ✓ | | Shellcode | ✓ | ✓ | ✓ | ✓ | ✓ | | PE | WIP | | | | |

Supported image formats:

| Image format | C++ | C# | Go | PS | VBA | |--------------|-----|----|----|----|-----| | PNG | ✓ | ✓ | ✓ | ✓ | | | BMP | ✓ | ✓ | ✓ | ✓ | ✓ | | JPEG | | | | | |

Supported payload delivery methods:

| Payload delivery | C++ | C# | Go | PS | VBA | |------------------|-----|----|----|----|-----| | HTTP | ✓ | ✓ | ✓ | ✓ | | | Local file | ✓ | ✓ | ✓ | ✓ | | | Document | | | | | ✓ |

Notes

roadmap

Is it any good?

yes.