███████╗██╗  ██╗███████╗██╗     ██╗      ██████╗ ██████╗ ██████╗ ███████╗
   ██╔════╝██║  ██║██╔════╝██║     ██║     ██╔════╝██╔═══██╗██╔══██╗██╔════╝
   ███████╗███████║█████╗  ██║     ██║     ██║     ██║   ██║██║  ██║█████╗  
   ╚════██║██╔══██║██╔══╝  ██║     ██║     ██║     ██║   ██║██║  ██║██╔══╝  
   ███████║██║  ██║███████╗███████╗███████╗╚██████╗╚██████╔╝██████╔╝███████╗
   ╚══════╝╚═╝  ╚═╝╚══════╝╚══════╝╚══════╝ ╚═════╝ ╚═════╝ ╚═════╝ ╚══════╝
                                                                              
        ███████╗██╗   ██╗ █████╗ ███████╗██╗ ██████╗ ███╗   ██╗           
        ██╔════╝██║   ██║██╔══██╗██╔════╝██║██╔═══██╗████╗  ██║           
        █████╗  ██║   ██║███████║███████╗██║██║   ██║██╔██╗ ██║           
        ██╔══╝  ╚██╗ ██╔╝██╔══██║╚════██║██║██║   ██║██║╚██╗██║           
        ███████╗ ╚████╔╝ ██║  ██║███████║██║╚██████╔╝██║ ╚████║           
        ╚══════╝  ╚═══╝  ╚═╝  ╚═╝╚══════╝╚═╝ ╚═════╝ ╚═╝  ╚═══╝           
                                                                              
                        ███████╗██╗   ██╗██╗████████╗███████╗              
                        ██╔════╝██║   ██║██║╚══██╔══╝██╔════╝              
                        ███████╗██║   ██║██║   ██║   █████╗                
                        ╚════██║██║   ██║██║   ██║   ██╔══╝                
                        ███████║╚██████╔╝██║   ██║   ███████╗              
                        ╚══════╝ ╚═════╝ ╚═╝   ╚═╝   ╚══════╝              

Professional shellcode encryption and C# loader generation toolkit for Red Team operations.

---

🇬🇧 English

Description

Shellcode Evasion Suite is a comprehensive toolkit designed for Red Team operators and penetration testers to generate evasion-ready payloads. The suite provides:

• Multi-algorithm encryption (AES-256-CBC, AES-256-GCM, ChaCha20)
• Dynamic key generation to avoid static signatures
• Password-derived encryption using PBKDF2 (100,000 iterations)
• Multiple output formats (C, C#, PowerShell, Python, hex, base64)
• Production-ready C# loaders with AMSI/ETW bypass
• Code obfuscation with randomized variable names
• Multiple injection techniques (Classic, Remote injection)

This tool is designed to help security professionals test EDR/AV solutions and understand modern evasion techniques.

Features

🔐 shellcode2AES.py - Payload Encryption

• ✅ 3 encryption modes (AES-CBC, AES-GCM, ChaCha20)
• ✅ 6 output formats for maximum compatibility
• ✅ PBKDF2 key derivation from passwords
• ✅ Custom key/IV support for reproducibility
• ✅ Verbose logging for debugging

💉 shellcode2CSharp.py - Loader Generation

• ✅ Complete, compilable C# code (not just byte arrays)
• ✅ AMSI bypass (patches amsi.dll!AmsiScanBuffer)
• ✅ ETW bypass (patches ntdll!EtwEventWrite)
• ✅ Variable name obfuscation for signature evasion
• ✅ Classic injection (VirtualAlloc + CreateThread)
• ✅ Remote process injection (CreateRemoteThread)
• ✅ Full P/Invoke declarations included

Installation

# Clone repository
git clone https://github.com/mrflippermen/Shellcode-Evasion-Suite.git
cd Shellcode-Evasion-Suite

# Install dependencies
pip install -r requirements.txt

Usage

Basic Encryption + Loader Generation

# 1. Encrypt shellcode with AES-GCM
python src/shellcode2AES.py payload.bin -m aes-gcm -f csharp -o encrypted_payload.txt

# 2. Generate C# loader with AMSI bypass
python src/shellcode2CSharp.py payload.bin -t classic --amsi --obfuscate -o loader.cs

# 3. Compile the loader
csc /unsafe /platform:x64 /out:payload.exe loader.cs

Advanced: Password-Protected Payload

# Encrypt with password-derived key
python src/shellcode2AES.py payload.bin \
    -p "MySecurePassword123!" \
    -m chacha20 \
    -f python \
    -o encrypted.py

Advanced: Remote Process Injection

# Generate remote injection loader targeting PID 1234
python src/shellcode2CSharp.py payload.bin \
    -t remote \
    --pid 1234 \
    --amsi \
    --etw \
    --obfuscate \
    -o injector.cs

Command Reference

shellcode2AES.py:

-m, --mode          Encryption mode: aes-cbc, aes-gcm, chacha20
-f, --format        Output format: hex, base64, c, csharp, powershell, python
-p, --password      Derive key from password (PBKDF2)
-k, --key           Custom encryption key (hex)
-i, --iv            Custom IV/nonce (hex)
-o, --output        Output file (default: stdout)
-v, --verbose       Verbose logging

shellcode2CSharp.py:

-t, --technique     Injection technique: classic, remote, array
--pid               Target PID for remote injection
--amsi              Include AMSI bypass
--etw               Include ETW bypass
--obfuscate         Randomize variable names
-o, --output        Output C# file
-v, --verbose       Verbose logging

OPSEC Considerations

• Dynamic keys: Every run generates unique encryption keys (unless custom key specified)
• AMSI bypass: Patches AV memory scanner to prevent in-memory detection
• ETW bypass: Disables Event Tracing to avoid telemetry
• Obfuscation: Randomized names defeat static signature matching
• No artifacts: Loaders execute in-memory, no disk writes

Project Structure

Shellcode-Evasion-Suite/
├── src/
│   ├── shellcode2AES.py      # Encryption module
│   ├── shellcode2CSharp.py   # Loader generator
│   └── __init__.py
├── examples/
│   ├── README.md             # Example walkthroughs
│   └── sample_output/
├── docs/
│   ├── USAGE.md              # Detailed usage guide
│   └── TECHNIQUES.md         # Technical documentation
├── requirements.txt
├── .gitignore
├── LICENSE
└── README.md

---

🇪🇸 Español

Descripción

Shellcode Evasion Suite es un conjunto de herramientas diseñado para operadores de Red Team y pentesters para generar payloads listos para evadir defensas. El suite provee:

• Encriptación multi-algoritmo (AES-256-CBC, AES-256-GCM, ChaCha20)
• Generación dinámica de claves para evitar firmas estáticas
• Encriptación derivada de contraseña usando PBKFD2 (100,000 iteraciones)
• Múltiples formatos de salida (C, C#, PowerShell, Python, hex, base64)
• Loaders de C# listos para producción con bypass de AMSI/ETW
• Ofuscación de código con nombres de variables aleatorios
• Múltiples técnicas de inyección (Clásica, Remota)

Esta herramienta ayuda a profesionales de seguridad a probar soluciones EDR/AV y entender técnicas modernas de evasión.

Instalación

git clone https://github.com/mrflippermen/Shellcode-Evasion-Suite.git
cd Shellcode-Evasion-Suite
pip install -r requirements.txt

Uso Básico

# Encriptar shellcode
python src/shellcode2AES.py payload.bin -m aes-gcm -f csharp -o encrypted.txt

# Generar loader en C#
python src/shellcode2CSharp.py payload.bin -t classic --amsi -o loader.cs

# Compilar
csc /unsafe /platform:x64 /out:payload.exe loader.cs

Consideraciones OPSEC

• Las claves dinámicas previenen detección por firmas estáticas
• El bypass de AMSI evita escaneo en memoria
• El bypass de ETW deshabilita la telemetría de Windows
• La ofuscación derrota el análisis estático

---

📋 Requirements

• Python 3.8+
• pycryptodome
• C# compiler (csc.exe / Mono) for loader compilation

🔒 Legal Disclaimer

FOR AUTHORIZED SECURITY TESTING ONLY

This tool is provided for educational purposes and authorized penetration testing. Users are solely responsible for compliance with applicable laws. Unauthorized access to computer systems is illegal.

• ✅ Use only on systems you own or have explicit written permission to test
• ✅ Understand your local laws regarding security tools
• ❌ The author assumes NO liability for misuse

📜 License

MIT License - see LICENSE file for details.

👤 Author

Esteban Jiménez

• 🏆 Top 1 Hack The Box Ecuador
• 🎯 Red Team Operator
• 💼 Active Directory Specialist
• 🔗 GitHub

🙏 Acknowledgments

• Offensive security community for knowledge sharing
• EDR vendors for providing challenges to overcome
• MITRE ATT&CK framework for technique documentation

---

⚠️ Use responsibly. Happy hacking!