RemoteShellcodeExec

A simple PoC of executing shellcode from a remote-hosted bin file using Winhttp. This is demo of the relevant blog post: Shellcodes are dead, long live fileless shellcodes.

TL;DR

• Executing the shellcode from a remote-hosted server, will make the executable file itself drastically reduce it's entropy.
• Implemented a simple heap encryption, to avoid the shellcode being visible
• Profit (0/26 detections)

Demo

https://user-images.githubusercontent.com/37262788/222574293-9dc8a0e5-0fe1-48bf-96c9-b7dc70a9898b.mp4

Credits

https://decoded.avast.io/threatintel/decoding-cobalt-strike-understanding-payloads/
https://twitter.com/teamcymru_S2/status/1604091964386705409
https://www.huntress.com/blog/hackers-no-hashing-randomizing-api-hashes-to-evade-cobalt-strike-shellcode-detection