ShenCode

A versatile tool for working with shellcodes.

Features

ShenCode is a framework for developing, analyzing and testing shellcodes. It comes with 3 operating modes:

  • Argument mode
    • shencode core output -i file.raw -s inspect
  • Interactive mode
    • shencode$ load output
    • shencode::core::output$
  • Task mode
    • Automate modules in different steps with json

Version 0.8.4

General usage

Help docs are currently not up to date. I am working on a new publishing system. This will be done in a few days.

Check out ShenCode Docs and the starter tutorial for more information.

CategoryModuleDescriptionDocsRefs
coredownloadDownload remote filesdownload
coreextractExtract a range of bytes from a fileextract
coreoutputInspect and display files in different formatsoutput
coresubprocExecute an external subprocesssubproc
coretaskExecute tasks to automate ShenCodetask
encoderalphanumAlphanumeric encoder to avoid null bytesalphanum
encoderbytebertAdvanced polymorphic encoderbytebert
encoderbyteswapNew XOR Encryption, Swapping BytesbyteswapBlog Post
encodermulticoderMulti-Algorithm encodermulticoder
encoderxorEncode payload with custom XOR keyxor
encoderxorpolyPolymorphic x64 in-memory decoderxorpolyBlog Post
injectdllInject dll into a processdll
injectinjectionInject shellcode into a processinjection
injectntinjectionInject with native windows APIntinjection
injectpsoverwriteProcess overwriting injectionpsoverwritehasherezade
obfuscatefeedHide shellcode bytes in a feed.xml filefeed
obfuscateqrcodeGenerate QR-Code from a fileqrcode
obfuscaterolhashROR13 to custom ROL hashingrolhash
obfuscateuuidGenerate UUIDs from shellcodeuuidBlog Post
payloadmsfvenomCreate payloads with msfvenommsfvenom
payloadwinexecCreate a shellcode with custom WinExec commandwinexec
stagermeterpreterDownload a meterpreter reverse tcp stagemeterpreter
stagersliverDownload a sliver stagesliver

How to use

Install
git clone https://github.com/psycore8/shencode
cd shencode
python -m venv .venv
<! ACTIVATE-VENV-SEE-BELOW !>
pip install .
shencode -h

To activate the virtual environment use the following command:

  • Windows - .venv\bin\activate
  • Linux - source .venv/bin/activate

Release Notes

  • general - Task file for starters tutorial
  • general - interactive mode
  • core/extract - deleted deprecated start_offset and end_offset arguments
  • core/output - assemble x64 instructions
  • encoder/alphanum - added variable padding option
  • inject/psoverwrite - fixed broken CFGuard mitigation
  • obfuscate/feed - customize feed parameters (author, title, subtitle, uri)
  • payload/winexec - new instructions producing 00 cmp rcx, 0
  • payload/winexec - xor rdx and rdi for correct stack alignment
  • stager/sliver - implemented new aes argument with nargs support

References