donut-shellcode
Generates position-independent shellcode from memory and runs them
Site oficial:
https://github.com/TheWover/donut
Empacotamento:
https://gitlab.com/kalilinux/packages/donut-shellcode
Versão no Kali: 1.1-0kali3 · Arquiteturas: any all · Comandos: 1
Metapacotes:
kali-linux-default
kali-linux-everything
kali-linux-headless
kali-linux-large
Documentação do Kali:
https://www.kali.org/tools/donut-shellcode/
Donut is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies. A module created by Donut can either be staged from a HTTP server or embedded directly in the loader itself. The module is optionally encrypted using the Chaskey block cipher and a 128-bit randomly generated key. After the file is loaded and executed in memory, the original reference is erased to deter memory scanners. The generator and loader support the following features: - Compression of input files with aPLib and LZNT1, Xpress, Xpress Huffman via RtlCompressBuffer. - Using entropy for API hashes and generation of strings. - 128-bit symmetric encryption of files. - Patching Antimalware Scan Interface (AMSI) and Windows Lockdown Policy (WLDP). - Patching command line for EXE files. - Patching exit-related API to avoid termination of host process. - Multiple output formats: C, Ruby, Python, PowerShell, Base64, C#, Hexadecimal.
sudo apt install donut (86 KB)
Dependências: libc6
Escolha um comando ao lado para ver a descrição e a ajuda completa.
donut
root@kali:~# donut -h
[ Donut shellcode generator v1 (built Feb 12 2026 14:39:18)
[ Copyright (c) 2019-2021 TheWover, Odzhan
usage: donut [options] <EXE/DLL/VBS/JS>
Only the finest artisanal donuts are made of shells.
-MODULE OPTIONS-
-n,--modname: <name> Module name for HTTP staging. If entropy is enabled, this is generated randomly.
-s,--server: <server> Server that will host the Donut module. Credentials may be provided in the following format: https://username:password@192.168.0.1/
-e,--entropy: <level> Entropy. 1=None, 2=Use random names, 3=Random names + symmetric encryption (default)
-PIC/SHELLCODE OPTIONS-
-a,--arch: <arch>,--cpu: <arch> Target architecture : 1=x86, 2=amd64, 3=x86+amd64(default).
-o,--output: <path> Output file to save loader. Default is "loader.bin"
-f,--format: <format> Output format. 1=Binary (default), 2=Base64, 3=C, 4=Ruby, 5=Python, 6=Powershell, 7=C#, 8=Hex
-y,--fork: <offset> Create a new thread for the loader and continue execution at <offset> relative to the host process's executable.
-x,--exit: <action> Exit behaviour. 1=Exit thread (default), 2=Exit process, 3=Do not exit or cleanup and block indefinitely
-FILE OPTIONS-
-c,--class: <namespace.class> Optional class name. (required for .NET DLL)
-d,--domain: <name> AppDomain name to create for .NET assembly. If entropy is enabled, this is generated randomly.
-i,--input: <path>,--file: <path> Input file to execute in-memory.
-m,--method: <method>,--function: <api> Optional method or function for DLL. (a method is required for .NET DLL)
-p,--args: <arguments> Optional parameters/command line inside quotations for DLL method/function or EXE.
-w,--unicode Command line is passed to unmanaged DLL function in UNICODE format. (default is ANSI)
-r,--runtime: <version> CLR runtime version. MetaHeader used by default or v4.0.30319 if none available.
-t,--thread Execute the entrypoint of an unmanaged EXE as a thread.
-EXTRA-
-z,--compress: <engine> Pack/Compress file. 1=None
-b,--bypass: <level> Bypass AMSI/WLDP/ETW : 1=None, 2=Abort on fail, 3=Continue on fail.(default)
-k,--headers: <level> Preserve PE headers. 1=Overwrite (default), 2=Keep all
-j,--decoy: <level> Optional path of decoy module for Module Overloading.
examples:
donut -ic2.dll
donut --arch:x86 --class:TestClass --method:RunProcess --args:notepad.exe --input:loader.dll
donut -iloader.dll -c TestClass -m RunProcess -p"calc notepad" -s http://remote_server.com/modules/
Donut is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies. A module created by Donut can either be staged from a HTTP server or embedded directly in the loader itself. The module is optionally encrypted using the Chaskey block cipher and a 128-bit randomly generated key. After the file is loaded and executed in memory, the original reference is erased to deter memory scanners. The generator and loader support the following features: - Compression of input files with aPLib and LZNT1, Xpress, Xpress Huffman via RtlCompressBuffer. - Using entropy for API hashes and generation of strings. - 128-bit symmetric encryption of files. - Patching Antimalware Scan Interface (AMSI) and Windows Lockdown Policy (WLDP). - Patching command line for EXE files. - Patching exit-related API to avoid termination of host process. - Multiple output formats: C, Ruby, Python, PowerShell, Base64, C#, Hexadecimal. This is the common documentation package.
sudo apt install python-donut-doc (47 KB)
Donut is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies. A module created by Donut can either be staged from a HTTP server or embedded directly in the loader itself. The module is optionally encrypted using the Chaskey block cipher and a 128-bit randomly generated key. After the file is loaded and executed in memory, the original reference is erased to deter memory scanners. The generator and loader support the following features: - Compression of input files with aPLib and LZNT1, Xpress, Xpress Huffman via RtlCompressBuffer. - Using entropy for API hashes and generation of strings. - 128-bit symmetric encryption of files. - Patching Antimalware Scan Interface (AMSI) and Windows Lockdown Policy (WLDP). - Patching command line for EXE files. - Patching exit-related API to avoid termination of host process. - Multiple output formats: C, Ruby, Python, PowerShell, Base64, C#, Hexadecimal. This package installs the Python 3 module.
sudo apt install python3-donut (150 KB)
Dependências: libc6, python3
