ShenCode

A versatile tool for working with shellcodes.

Features

Version 0.8.3

General usage

Check out ShenCode Docs and the starter tutorial for more information.

Category	Module	Description	Docs	Refs
core	download	Download remote files	download
core	extract	Extract a range of bytes from a file	extract
core	output	Inspect and display files in different formats	output
core	subproc	Execute an external subprocess	subproc
core	task	Execute tasks to automate ShenCode	task
encoder	aes	Encrypt with AES	aes
encoder	alphanum	Alphanumeric encoder to avoid null bytes	alphanum
encoder	bytebert	Advanced polymorphic encoder	bytebert
encoder	byteswap	New XOR Encryption, Swapping Bytes	byteswap	Blog Post
encoder	multicoder	Multi-Algorithm encoder	multicoder
encoder	xor	Encode payload with custom XOR key	xor
encoder	xorpoly	Polymorphic x64 in-memory decoder	xorpoly	Blog Post
inject	dll	Inject dll into a process	dll
inject	injection	Inject shellcode into a process	injection
inject	ntinjection	Inject with native windows API	ntinjection
inject	psoverwrite	Process overwriting injection	psoverwrite	hasherezade
obfuscate	feed	Hide shellcode bytes in a feed.xml file	feed
obfuscate	qrcode	Generate QR-Code from a file	qrcode
obfuscate	rolhash	ROR13 to custom ROL hashing	rolhash
obfuscate	uuid	Generate UUIDs from shellcode	uuid	Blog Post
payload	msfvenom	Create payloads with msfvenom	msfvenom
payload	winexec	Create a shellcode with custom WinExec command	winexec
stager	meterpreter	Download a meterpreter reverse tcp stage	meterpreter
stager	sliver	Download a sliver stage	sliver

How to use

Install

git clone https://github.com/psycore8/shencode
cd shencode
python -m venv .venv
<! ACTIVATE-VENV-SEE-BELOW !>
pip install .
shencode -h

To activate the virtual environment use the following command:

• Windows - .venv\bin\activate
• Linux - source .venv/bin/activate

Release Notes

• general - Task file for starters tutorial
• core/download - Download module for different protocols
• core/formatout - deleted module
• encoder/aes - marked as deprecated
• encoder/alphanum - fixed wrong register in decoder stub
• encoder/bytebert - outputs nasm file, object file and final output file now
• encoder/byteswap - marked as deprecated
• encoder/multicoder - Encoder module for different encoding techniques
• obfuscate/feed - randomized title, date and URL parts
• payload/winexec - enhanced shellcode randomness

References

• Byte-Swapping
• In-Memory Decoder
• Function Name Hashing
• Win32API with python3 injection
• Violent python: XOR Encryption
• How to easily encrypt file in python