# laZzzy | Shellcode Loader, Developed Using Different Open-Source Libraries, That Demonstrates Different Execution Techniques

**URL:** <https://onehack.st/t/lazzzy-shellcode-loader-developed-using-different-open-source-libraries-that-demonstrates-different-execution-techniques/229980>\
**Category:** Tools & Scripts\
**Tags:** tools, hacking, privacy\
**Created:** [December 18, 2022, 10:11pm UTC](https://onehack.st/t/lazzzy-shellcode-loader-developed-using-different-open-source-libraries-that-demonstrates-different-execution-techniques/229980 "2022-12-18T22:11:01Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![WhiteHat](https://onehack.st/user_avatar/onehack.st/whitehat/32/162514_2.png) [@WhiteHat](https://onehack.st/u/WhiteHat)\
**Post date:** [December 18, 2022, 10:11pm UTC](https://onehack.st/t/lazzzy-shellcode-loader-developed-using-different-open-source-libraries-that-demonstrates-different-execution-techniques/229980/1 "2022-12-18T22:11:02Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/4/2/42eb7ae3f81e48577213a2c34b6cc18e71a12177.png)

[![Python](https://camo.githubusercontent.com/a1b2dac5667822ee0d98ae6d799da61987fd1658dfeb4d2ca6e3c99b1535ebd8/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f707974686f6e2d3336373041303f7374796c653d666f722d7468652d6261646765266c6f676f3d707974686f6e266c6f676f436f6c6f723d666664643534)](https://camo.githubusercontent.com/a1b2dac5667822ee0d98ae6d799da61987fd1658dfeb4d2ca6e3c99b1535ebd8/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f707974686f6e2d3336373041303f7374796c653d666f722d7468652d6261646765266c6f676f3d707974686f6e266c6f676f436f6c6f723d666664643534) [![C++](https://camo.githubusercontent.com/891c1fd9d2ab2adf1053e8514f469b94049769ccd9d2765c8e06e9c1b6da1b8c/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f632b2b2d2532333030353939432e7376673f7374796c653d666f722d7468652d6261646765266c6f676f3d63253242253242266c6f676f436f6c6f723d7768697465)](https://camo.githubusercontent.com/891c1fd9d2ab2adf1053e8514f469b94049769ccd9d2765c8e06e9c1b6da1b8c/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f632b2b2d2532333030353939432e7376673f7374796c653d666f722d7468652d6261646765266c6f676f3d63253242253242266c6f676f436f6c6f723d7768697465) [![Visual Studio](https://camo.githubusercontent.com/80669e11bf3bc52895d6a03fb9745050bba5e0fdfecb2a6c6baea6d5dbbee275/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f56697375616c25323053747564696f2d3543324439312e7376673f7374796c653d666f722d7468652d6261646765266c6f676f3d76697375616c2d73747564696f266c6f676f436f6c6f723d7768697465)](https://camo.githubusercontent.com/80669e11bf3bc52895d6a03fb9745050bba5e0fdfecb2a6c6baea6d5dbbee275/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f56697375616c25323053747564696f2d3543324439312e7376673f7374796c653d666f722d7468652d6261646765266c6f676f3d76697375616c2d73747564696f266c6f676f436f6c6f723d7768697465) [![Windows](https://camo.githubusercontent.com/41281b9a32f13ac5b9d41ed9bae12c0de662f948f9bf59fd19df354fe49af146/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f57696e646f77732d3030373844363f7374796c653d666f722d7468652d6261646765266c6f676f3d77696e646f7773266c6f676f436f6c6f723d7768697465)](https://camo.githubusercontent.com/41281b9a32f13ac5b9d41ed9bae12c0de662f948f9bf59fd19df354fe49af146/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f57696e646f77732d3030373844363f7374796c653d666f722d7468652d6261646765266c6f676f3d77696e646f7773266c6f676f436f6c6f723d7768697465)

laZzzy is a shellcode loader that demonstrates different execution techniques commonly employed by malware. laZzzy was developed using different open-source header-only libraries.

### Features

- Direct syscalls and native (`Nt*`) functions (not all functions but most)
- Import Address Table (IAT) evasion
- Encrypted payload (XOR and AES)
  - Randomly generated key
  - Automatic padding (if necessary) of payload with NOPS (`\x90`)
  - Byte-by-byte in-memory decryption of payload

- XOR-encrypted strings
- PPID spoofing
- Blocking of non-Microsoft-signed DLLs
- (Optional) Cloning of PE icon and attributes
- (Optional) Code signing with spoofed cert

### How to Use

#### Requirements:

- Windows machine w/ Visual Studio and the following components, which can be installed from _`Visual Studio Installer` \> `Individual Components`_:
  - `C++ Clang Compiler for Windows` and `C++ Clang-cl for build tools`[![Clang](https://github.com/capt-meelo/laZzzy/raw/main/img/clang.png)](https://github.com/capt-meelo/laZzzy/blob/main/img/clang.png)
  - `ClickOnce Publishing`[![ClickOne](https://github.com/capt-meelo/laZzzy/raw/main/img/clickonce.png)](https://github.com/capt-meelo/laZzzy/blob/main/img/clickonce.png)

- Python3 and the required modules:
  - `python3 -m pip install -r requirements.txt`

#### Options:

(venv) PS C:\MalDev\laZzzy\> python3 .\builder.py -h ⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣀⣀⣀⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀ ⠀⠀⣿⣿⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣠⣤⣤⣤⣤⠀⢀⣼⠟⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀ ⠀⠀⣿⣿⠀⠀⠀⠀⢀⣀⣀⡀⠀⠀⠀⢀⣀⣀⣀⣀⣀⡀⠀⢀⣼⡿⠁⠀⠛⠛⠒⠒⢀⣀⡀⠀⠀⠀⣀⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀ ⠀⠀⣿⣿⠀⠀⣰⣾⠟⠋⠙⢻⣿⠀⠀⠛⠛⢛⣿⣿⠏⠀⣠⣿⣯⣤⣤⠄⠀⠀⠀⠀⠈⢿⣷⡀⠀⣰⣿⠃⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀ ⠀⠀⣿⣿⠀⠀⣿⣯⠀⠀⠀⢸⣿⠀⠀⠀⣠⣿⡟⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⢿⣧⣰⣿⠃⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀ ⠀⠀⣿⣿⠀⠀⠙⠿⣷⣦⣴⢿⣿⠄⢀⣾⣿⣿⣶⣶⣶⠆⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠘⣿⡿⠃⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀ ⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣼⡿⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀ ⠀⠀by: CaptMeelo⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⠉⠁⠀⠀⠀ usage: builder.py [-h] -s -p -m [-tp] [-sp] [-pp] [-b] [-d] options: -h, --help show this help message and exit -s path to raw shellcode -p password -m shellcode execution method (e.g. 1) -tp process to inject (e.g. svchost.exe) -sp process to spawn (e.g. C:\Windows\System32\RuntimeBroker.exe) -pp parent process to spoof (e.g. explorer.exe) -b binary to spoof metadata (e.g. C:\Windows\System32\RuntimeBroker.exe) -d domain to spoof (e.g. [www.microsoft.com](http://www.microsoft.com)) shellcode execution method: 1 Early-bird APC Queue (requires sacrificial proces) 2 Thread Hijacking (requires sacrificial proces) 3 KernelCallbackTable (requires sacrificial process that has GUI) 4 Section View Mapping 5 Thread Suspension 6 LineDDA Callback 7 EnumSystemGeoID Callback 8 FLS Callback 9 SetTimer 10 Clipboard

#### Example:

Execute `builder.py` and supply the necessary data.

(venv) PS C:\MalDev\laZzzy\> python3 .\builder.py -s .\calc.bin -p CaptMeelo -m 1 -pp explorer.exe -sp C:\Windows\System32\notepad.exe -d [www.microsoft.com](http://www.microsoft.com) -b C:\Windows\System32\mmc.exe ⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣀⣀⣀⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀ ⠀⠀⣿⣿⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣠⣤⣤⣤⣤⠀⢀⣼⠟⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀ ⠀⠀⣿⣿⠀⠀⠀⠀⢀⣀⣀⡀⠀⠀⠀⢀⣀⣀⣀⣀⣀⡀⠀⢀⣼⡿⠁⠀⠛⠛⠒⠒⢀⣀⡀⠀⠀⠀⣀⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀ ⠀⠀⣿⣿⠀⠀⣰⣾⠟⠋⠙⢻⣿⠀⠀⠛⠛⢛⣿⣿⠏⠀⣠⣿⣯⣤⣤⠄⠀⠀⠀⠀⠈⢿⣷⡀⠀⣰⣿⠃⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀ ⠀⠀⣿⣿⠀⠀⣿⣯⠀⠀⠀⢸⣿⠀⠀⠀⣠⣿⡟⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⢿⣧⣰⣿⠃⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀ ⠀⠀⣿⣿⠀⠀⠙⠿⣷⣦⣴⢿⣿⠄⢀⣾⣿⣿⣶⣶⣶⠆⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠘⣿⡿⠃⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀ ⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣼⡿⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀ ⠀⠀by: CaptMeelo⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⠉⠁⠀⠀⠀ [+] XOR-encrypting payload with [_] Key: d3b666606468293dfa21ce2ff25e86f6 [+] AES-encrypting payload with [_] IV: f96312f17a1a9919c74b633c5f861fe5 [_] Key: 6c9656ed1bc50e1d5d4033479e742b4b8b2a9b2fc81fc081fc649e3fb4424fec [+] Modifying template using [_] Technique: Early-bird APC Queue [_] Process to inject: None [_] Process to spawn: C:\Windows\System32\RuntimeBroker.exe [_] Parent process to spoof: svchost.exe [+] Spoofing metadata [_] Binary: C:\Windows\System32\RuntimeBroker.exe [_] CompanyName: Microsoft Corporation [_] FileDescription: Runtime Broker [_] FileVersion: 10.0.22621.608 (WinBuild.160101.0800) [_] InternalName: RuntimeBroker.exe [_] LegalCopyright: © Microsoft Corporation. All rights reserved. [_] OriginalFilename: RuntimeBroker.exe [_] ProductName: Microsoft® Windows® Operating System [_] ProductVersion: 10.0.22621.608 [+] Compiling project [_] Compiled executable: C:\MalDev\laZzzy\loader\x64\Release\laZzzy.exe [+] Signing binary with spoofed cert [_] Domain: [www.microsoft.com](http://www.microsoft.com) [_] Version: 2 [_] Serial: 33:00:59:f8:b6:da:86:89:70:6f:fa:1b:d9:00:00:00:59:f8:b6 [_] Subject: /C=US/ST=WA/L=Redmond/O=Microsoft Corporation/CN=[www.microsoft.com](http://www.microsoft.com) [_] Issuer: /C=US/O=Microsoft Corporation/CN=Microsoft Azure TLS Issuing CA 06 [_] Not Before: October 04 2022 [_] Not After: September 29 2023 [_] PFX file: C:\MalDev\laZzzy\output\www.microsoft.com.pfx [+] All done! [_] Output file: C:\MalDev\laZzzy\output\RuntimeBroker.exe

### Libraries Used

- [kokke/tiny-AES-c](https://github.com/kokke/tiny-AES-c)
- [skadro-official/skCrypter](https://github.com/skadro-official/skCrypter)
- [JustasMasiulis/lazy\_importer](https://github.com/JustasMasiulis/lazy_importer)
- [JustasMasiulis/inline\_syscall](https://github.com/JustasMasiulis/inline_syscall)

### Shellcode Execution Techniques

1. Early-bird APC Queue _(requires sacrificial process)_
2. Thread Hijacking _(requires sacrificial process)_
3. KernelCallbackTable _(requires sacrificial process that has a GUI)_
4. Section View Mapping
5. Thread Suspension
6. LineDDA Callback
7. EnumSystemGeoID Callback
8. Fiber Local Storage (FLS) Callback
9. SetTimer
10. Clipboard

### Notes:

- Only works on **Windows x64**
- Debugging only works on **Release** mode
- Sometimes, **KernelCallbackTable** doesn’t work on the first run but will eventually work afterward

### Credits/References

- Authors of the libraries used
- [http://undocumented.ntinternals.net/](http://undocumented.ntinternals.net/)
- [https://doxygen.reactos.org/index.html](https://doxygen.reactos.org/index.html)
- [https://github.com/processhacker/phnt](https://github.com/processhacker/phnt)
- [https://www.vergiliusproject.com/](https://www.vergiliusproject.com/)
- [https://www.ired.team/](https://www.ired.team/)
- [https://github.com/snovvcrash/DInjector](https://github.com/snovvcrash/DInjector)
- [https://github.com/aahmad097/AlternativeShellcodeExec](https://github.com/aahmad097/AlternativeShellcodeExec)
- [https://github.com/paranoidninja/CarbonCopy](https://github.com/paranoidninja/CarbonCopy)

## GitHub:

> **[GitHub - capt-meelo/laZzzy: laZzzy is a shellcode loader, developed using...](https://github.com/capt-meelo/laZzzy)**
>
> laZzzy is a shellcode loader, developed using different open-source libraries, that demonstrates different execution techniques.