In this demo, we're going to cover the shell cogeneration process with Donut.
We'll start with a lab overview so that you can see the environment
I'm using and replicate it on your own machine.
Next,
we're going to explore the options in Donut that we will use to
generate shell code from executables and DLLs.
Finally,
we'll explore the additional built‑in tools that will help us leverage the shell
code to execute programs on our targets and evade defenses.
Let's head over to our lab and get started with the overview.
The lab I am using consists of a Kali Linux machine and one
Windows 10 target running in VirtualBox.
The Windows target is a Microsoft developer image,
there's a link to obtain these in the demo files.
On my Kali Linux machine,
I'm running a Pupy server using Docker that I'll use in the last demo.
There's a link for obtaining this software in the demo files,
and I have another red team tools course on its use if you're interested.
Installing is only required in your environment if you
want to follow along in the last demo.
For Donut,
I used Git to clone the repository into a folder
called donut in my home directory.
Once cloned, you can run Donut directly from this directory.
The Windows developer image has a few tools that will help in the demos,
including Visual Studio Code.
I also downloaded Process Explorer, a Sysinternals tool.
There's a link to that as well in the demo files.
Now that our lab is ready, we can check out Donut's features.
By running Donut from the command line, we can view the command options.
The options we will leverage in this course are within the shell code section.
We have a few options that we will use to determine the payload output.
The first is ‑a, which selects the target architecture.
1 is x86, 2 is AMD64, and 3 is both, which is the default.
‑b sets the bypass level.
The default is continue upon fail.
‑o sets the output path.
The default is to set the file name two loader and place it
in the same directory Donut was run from.
‑f sets the output format.
Donut has eight formats to choose from.
For this course, we'll be using Base64 for both demos.
There are two built‑in programs that we will use in
other demos to inject our payloads, ProcessManager and DonutTest.
We'll use the DonutTest program for injection.
The only issue here is we cannot truly evade defenses.
As with most built‑in tools,
this program will trigger Windows Defender when we run it,
so we'll have to allow DonutTest to run in Defender.
Creating our own injector is beyond the scope of this course,
as our focus is on the shell code generation and use with Donut.
Let's move both of these programs to one of our
targets so we can finish the lab setup.
I have a payloads directory that I will use to stage the files we want to move.
Let's copy the programs to that directory.
Once we move the files to the payloads directory,
we can use Python's built‑in SimpleHTTPServer to enable us
to download our payloads on our target.
To do this, we'll run python ‑m SimpleHTTPServer,
followed by the port we want to run this on.
In my case, I'll use 8000.
Now we just need to go to our target, and then we can download the files.
Once we access our Kali Linux machine, we just click each one to download it,
and then we're all set to compile.
In its current state,
the DonutTest program will execute the Notepad and
Calculator programs using injection.
Let's compile the program and run it so we can enable the
function that triggers Windows Defender.
Let's also compile ProcessManager as well for the next step.
Now we need to use ProcessManager to select the process for injection.
To do that, all we do is just run ProcMgr.exe.
This built‑in tool with Donut gives us the process name of
every process running on the computer, the process ID,
the architecture, whether it's managed, the session that it's on,
and the integrity.
Scrolling through,
we can see a number of processes we may be able to inject our code into.
Free to the examples in this course, let's use explorer.exe,
currently running with the processor ID of 3092.
To run this, we just type Program.exe, followed by the process ID.
You should get a Windows Defender notification.
I already cleared it in my environment by allowing it.
Windows Defender will remove your program,
so once you clear the notification and allow future runs of this program,
you'll need to recompile from program.cs and run it again. On your second
run, you should see Notepad and Calculator like you do here.
Once you get to this step, you're all set to continue with this course.