Donut Shellcode

Donut is a shellcode generator designed for in-memory execution of various file types including VBScript, JScript, EXEs, DLLs, and .NET assemblies without writing to disk. It supports HTTP staging of modules or direct embedding in the loader, with optional Chaskey block cipher encryption using a 128-bit random key. After execution, original file references are erased to evade memory scanners.

Key use cases include red team operations for evading detection during payload delivery. It compresses inputs with aPLib, LZNT1, Xpress, or Xpress Huffman, applies entropy to API hashes and strings, patches AMSI and WLDP, modifies command lines for EXEs, and handles exit behaviors to maintain host process persistence. Output formats include binary, Base64, C, Ruby, Python, PowerShell, C#, and hexadecimal.

The tool targets x86, amd64, or both architectures, with options for forking threads, specifying .NET classes/methods, and passing arguments. It supports preserving PE headers, decoy modules for evasion, and configurable bypass levels for AMSI/WLDP/ETW.

Donut creates position-independent code (PIC) loaders that load and execute input files entirely in memory. It optionally compresses files using aPLib or Windows compressors like LZNT1/Xpress via RtlCompressBuffer, applies entropy (random names, API hashes, strings), and encrypts modules with 128-bit Chaskey cipher. For .NET, it creates AppDomains and invokes specified classes/methods; for unmanaged code, it executes entry points as threads or processes. AMSI/WLDP are patched at runtime, command lines adjusted, and exit APIs hooked to control process/thread termination. HTTP staging fetches encrypted modules from servers, decrypts them in-memory, and erases traces post-execution.