EXOCET – AV-evading, Undetectable, Payload Delivery Tool
EXOCET is superior to Metasploit’s “Evasive Payloads” modules as EXOCET uses AES-256 in GCM Mode (Galois/Counter Mode). Metasploit’s Evasion Payloads uses a easy to detect RC4 encryption. While RC4 can decrypt faster, AES-256 is much more difficult to ascertain the intent of the malware.
However, it is possible to use Metasploit to build a Evasive Payload, and then chain that with EXOCET. So EXOCET will decrypt via AES-256, and then the Metasploit Evasive Payload then decrypts itself from RC4.
Much like my previous project, DarkLordObama, this toolkit is designed to be a delivery/launch vehicle, much like
So this month, and the next month is going to be a busy month for me, and there will be delays in implementing these methods. But I am excited to get started on implementing new AV evasion techniques such as…
- Inline hooking
- Obfuscation by emulating BlackRota and the gobfuscate module
- Process hollowing
- Reflective DLL injection
- Remote process injection
- ThreadLocalStorage Callbacks
- Registration of Top-Level Exception Handlers
- Custom UPX packing
I am a very busy man, I have the following priorities and I would like to request some help, some pull requests to aid in the project. Since I have the following things to do
- A court appearance in late October
- National Cyber League
- Accounting and Finance Classes, Computer Science was NEVER my college major and in the following weeks I will have exams back-to-back
- Federal Supervised Release Conditions and the FBI trying to implicate me in new unproven crimes. I have dash camera videos I uploaded to the cloud to prove it that I am sending to my lawyers. I have documented multiple attacks against me, vandalism of my car, my house, filed police reports and counter reports and will be building my case to file a Federal lawsuit. One of the perpetrators, who ripped out my front bumper of my car, has been arrested.
- A private project involving interaction with the CoinGeckoAPI
- Running the cryptoscopeinitiative.org, a to-be-filed 501c3 Non-Profit Organization
- Teaching three online classes on Exploit Development
Upcoming update! Direct encrypted shellcode execution! (Implemented in test versions, not released yet)
I need a bit of help, because I successfully implemented CGO to execute encrypted shellcode but it is throwing memory access violations exit status 0xc0000005. It shouldn’t be anything related to DEP (Data Execution Prevention) because the file CGOTest/working-template-shellcode-executor.go did run.
Problem Discovered
As it turns out, VirtualAlloc must be called from kernel32.dll and ntdll.dll to properly make the memory page where the shellcode lands, readable, writable, and executable, in other word, set the PAGE_EXECUTE_READWRITE to ON. Read the Note on Memory Access Violation Problem below.
Once I figure this out, CGO was a pain in the ass to implement, we can now create crypters that execute INLINE-ASSEMBLY. Which was considered a impossibility until now.
Note this requires Golang and the MinGW toolchain to be installed on Windows with you running and generating the shellcode on Windows. The reason why, is because CGO cannot be cross-compiled like our other EXOCET modules. To install the toolchain you need to go to
