search

TheWover / donut

Generates x86, x64, or AMD64+x86 position-independent shellcode that loads .NET Assemblies, PE files, and other Windows payloads from memory and runs them with parameters
BSD 3-Clause "New" or "Revised" License
3.53k stars 628 forks source link

Generated Shellcode from 0.9.3 does not work on Win7 #119

Closed GitamarM closed 4 months ago

GitamarM commented 1 year ago

I had the need to validate my Injectors and tools for an upcoming engagement. After deploying all my tools to win7 lab (including all kbs, and updated to the max) my injectors did not work. at first I thought I missed something regarding the change in architecture or API but after validating that all was well I have started to suspect donut is causing the problem. after using my injectors with known shellcodes that have been tested on win7 my suspicion grew.

I have been working with donut 0.9.3 from the release binaries.

At one of my tests I have downloaded the demo injectors from the release section as well , and the c# injector seemed to open the calc shellcode it comes with without any problem.

this baffled me , so I dug a bit deeper and found that the version of the executable which comes with that zip is 0.9.2

when I generated shellcodes from that version of donut the same injectors worked 100% fine.

shellcode from 0.9.3 will cause the injected process to throw an access violation .

I usually like to check for the bug in the source myself but unfortunately I have some time restraints at the moment.

for now I'm good, since I can still use 0.9.2 and that is not an issue but I think its worth the check.

TheWover commented 1 year ago

Can you retest with what's in dev branch and see if you get the same issue?