search

connormcgarr / LittleCorporal

LittleCorporal: A C# Automated Maldoc Generator
226 stars 61 forks source link

Issue with generating maldoc using sliver stageless shellcode #5

Closed carlnykvist closed 2 years ago

carlnykvist commented 2 years ago

Hi,

I'm trying to generate a maldoc using sliver stageless shellcode, but I get the below error.

[+] Embedded shellcode in Loader.cs! [+] Generated C# Loader artifact! [-] Error! Unable to generate Donut artifact.

I am running it like this: .\LittleCorporal.exe shellcode.bin explorer.exe It works for cobaltstrike stageless, but why doesn't it work with sliver stageless shellcode?

connormcgarr commented 2 years ago

Hi. Do you have Windows Defender enabled? If so, it will delete Donut and this error could occur. Could you also provide the exact steps to reproduce your issue? Do you have any supporting screenshots? If you can give me more information to reproduce I would be more than happy to help :)

carlnykvist commented 2 years ago

Windows Defender is disabled. So I generate sliver shellcode according to the below: generate_shellcode

Then I try to run LittleCorporal with it but as you see below, I get an error. I also included when using cobalt strike shellcode in the same picture to show you that the Donut binary is there on my system and that it works with cobalt strike shellcode.

tool

connormcgarr commented 2 years ago

What happens when you manually run the .NET artifact (LittleCorporal_Loader.exe)? Does your implant phone home?

carlnykvist commented 2 years ago

How would I run it to get a phone home using LittleCorporal_Loader.exe?

connormcgarr commented 2 years ago

It's an exe, you should be to just run it. I would also recommend reading the README to see how the project builds -- the older artifact is the site injection capability.

connormcgarr commented 2 years ago

Haven't heard additional details on this, so closing - per my last comment. Please re-open a new issue if problem persists. This seems like a Silver problem.