[S3xySmurf]

Don't Kill My Cat (DKMC)

Don't kill my cat is a tool that generates obfuscated shellcode that is stored inside of polyglot images. The image is 100% valid and also 100% valid shellcode. The idea is to avoid sandbox analysis since it's a simple "legit" image. For now the tool rely on PowerShell the execute the final shellcode payload.

Why it's called don't kill my cat? Since I suck at finding names for tools, I decided to rely on the fact that the default BMP image is a cat to name the tool.

Presentation on how it works internally can be found here: https://github.com/Mr-Un1k0d3r/DKMC/blob...202017.pdf

Basic Flow:

• Generate shellcode (meterpreter / Beacon)
  
• Embed the obfuscated shellcode inside the image
  
• PowerShell download the image and execute the image as shellcode
  
• Get your shell
  

https://github.com/Mr-Un1k0d3r/DKMC

[Synthx]

Okay, this is extremely interesting. I have done somewhat similar things using Automator for mac, and using Unicode characters. I can almost 100% guarantee that I will use this tool sometime. Thanks for the HQ share, and all of your recent one's as well!

[S3xySmurf]

This makes infecting someone very interesting a few lines of code could turn any application into a special little dropper and could easily bypass most AV's using this method

[Bish0pQ]

Nice! I have actually been thinking of a embedding it into an image. Looks like you beat me to it. I will try this out, but looks very decent. Thank you for this!