Donut is a shellcode generator enabling in-memory execution of diverse payloads, including VBScript, JScript, EXE, DLL files, and .NET assemblies. The generator creates position-independent code, allowing flexible execution. It can be staged from network sources or embedded within the loader. Donut supports compression, encryption, and various bypass techniques to evade detection.
Donut supports multiple output formats, including C, Ruby, Python and PowerShell, offering flexibility in integration. It incorporates techniques to bypass AMSI, WLDP and ETW. The capability to overwrite PE headers enables more robust evasion. Dynamic and static libraries are available for Linux and Windows, facilitating integration across platforms.
- Format Support: Generates shellcode for VBS, JScript, EXE, DLL, and .NET assemblies.
- Evasion Techniques: Includes AMSI, WLDP, and ETW bypass capabilities.
- Compression & Encryption: Offers compression with aPLib and LZNT1, alongside 128-bit symmetric encryption.
- Output Formats: Supports C, Ruby, Python, PowerShell, Base64, C#, and Hexadecimal output formats.
- Platform Support: Provides dynamic and static libraries for both Windows and Linux.
- Header Overwriting: Overwrites PE headers to aid in evasion and mimicry.
- Developer Friendly: Modular design with clear documentation and examples.
Donut is an active project with regular updates and recent commits, indicating ongoing maintenance. The project features comprehensive documentation and a community through issues and discussions. The well-defined architecture and tested codebase suggest reliability.
Donut is valuable for security researchers and penetration testers seeking to execute payloads in memory and evade detection. It’s beneficial for dynamically loading and executing code without writing it to disk, ideal for situations where persistence or file system access is restricted. It offers a powerful tool for advanced attack and defensive analysis.