This repository contains a collection of Rust modules designed to execute shellcode using various methods of the native Windows API. Each module demonstrates a unique approach to loading and running shellcode, offering flexibility and adaptability for different use cases.
- Multiple Execution Methods: Includes various techniques for executing shellcode using Windows API calls.
- Rust Implementation: Leveraging Rust's safety features and performance.
- Makes use of native Windows API by calling kernel32.dll functions.
- Detailed Documentation: Each method is thoroughly documented for ease of understanding and use.
- Rust (latest stable version): See Rust Installation.
- Git: To clone the repository.
- Windows environment for compatibility with Windows API.
Clone the repository:
git clone https://github.com/affix/rs-shellcode-runners.git
cd rust-windows-shellcode-runnerEach method in the repository can be used as follows:
CreateThread: The CreateThread function is a part of the Windows API, primarily used for creating a thread to execute within the virtual address space of the calling process. When applied to running shellcode in memory, it offers a method to dynamically execute arbitrary code, often used in legitimate software as well as in various security research and exploitation scenarios.
Navigate to create-thread directory.
cd create-thread
cargo build
.\target\debug\create-thread.exeCreateRemoteThread: CreateRemoteThread is a function in the Windows API used to create a thread in the virtual address space of another process. Unlike CreateThread, which creates a thread in the same process, CreateRemoteThread allows for cross-process thread creation. This makes it particularly significant in various programming scenarios, including system monitoring, debugging, and certain types of malware activity.
cd create-remote-thread
cargo build
.\target\debug\create-remote-thread.exeThis project is licensed under the MIT License.