# Shhhloader | SysWhispers Shellcode Loader

**URL:** <https://onehack.st/t/shhhloader-syswhispers-shellcode-loader/219045>\
**Category:** Tools & Scripts\
**Tags:** tools, programming, hacking\
**Created:** [April 17, 2022, 8:54am UTC](https://onehack.st/t/shhhloader-syswhispers-shellcode-loader/219045 "2022-04-17T08:54:18Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![TheStrength](https://onehack.st/user_avatar/onehack.st/thestrength/32/46753_2.png) [@TheStrength](https://onehack.st/u/TheStrength)\
**Post date:** [April 17, 2022, 8:54am UTC](https://onehack.st/t/shhhloader-syswhispers-shellcode-loader/219045/1 "2022-04-17T08:54:18Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/2/7/27d7ae90bdd480c85783dcaa3363fb564262de98.png)

Shhhloader is a SysWhispers Shellcode Loader that is currently a Work in Progress. It takes raw shellcode as input and compiles a C++ stub that has been integrated with SysWhispers in order to bypass AV/EDR. The included python builder will work on any Linux system that has Mingw-w64 installed.

The tool has been confirmed to successfully load Meterpreter and a Cobalt Strike beacon on fully updated systems with Windows Defender enabled. The project itself is still in a PoC/WIP state, as it currently doesn’t work with all payloads.

**2/9/22 EDIT: Shhhloader now includes 5 different ways to execute your shellcode! See below for updated usage. Big thanks to [@Snovvcrash](https://github.com/snovvcrash) and their [DInjector](https://github.com/snovvcrash/DInjector) project for inspiration! I highly recommend taking a look at it for more information regarding the shellcode injection techniques and code that this tool is now based on.**

```auto
┳┻|
┻┳|
┳┻|
┻┳|
┳┻| _
┻┳| •.•) - Shhhhh, AV might hear us! 
┳┻|⊂ﾉ   
┻┳|
usage: Shhhloader.py [-h] [-p explorer.exe] [-m QueueUserAPC] [-nr] [-v] [-d] [-o a.exe] file

ICYGUIDER'S CUSTOM SYSWHISPERS SHELLCODE LOADER

positional arguments:
  file File containing raw shellcode

optional arguments:
  -h, --help show this help message and exit
  -p explorer.exe, --process explorer.exe
                        Process to inject into (Default: explorer.exe)
  -m QueueUserAPC, --method QueueUserAPC
                        Method for shellcode execution (Options: ProcessHollow, QueueUserAPC,
                        RemoteThreadContext, RemoteThreadSuspended, CurrentThread) (Default: QueueUserAPC)
  -nr, --no-randomize Disable syscall name randomization
  -v, --verbose Enable debugging messages upon execution
  -d, --dll-sandbox Use DLL based sandbox checks instead of the standard ones
  -o a.exe, --outfile a.exe
                        Name of compiled file

```

Video Demo: [https://www.youtube.com/watch?v=-KLGV\_aGYbw](https://www.youtube.com/watch?v=-KLGV_aGYbw)

Features:

- 5 Different Shellcode Execution Methods (ProcessHollow, QueueUserAPC, RemoteThreadContext, RemoteThreadSuspended, CurrentThread)
- PPID Spoofing
- Block 3rd Party DLLs
- Syscall Name Randomization
- XOR Encryption with Dynamic Key Generation
- Sandbox Evasion via Loaded DLL Enumeration
- Sandbox Evasion via Checking Processors, Memory, and Time

Tested and Confirmed Working on:

- Windows 10 21H1 (10.0.19043)
- Windows 10 20H2 (10.0.19042)
- Windows Server 2019 (10.0.17763)

Scan Results as of 2/9/22 (x64 Meterpreter QueueUserAPC): [https://antiscan.me/scan/new/result?id=tntuLnCkTCwz](https://antiscan.me/scan/new/result?id=tntuLnCkTCwz)

[![Scan](https://camo.githubusercontent.com/948d9f9f4991fa374fae04127573685acc9215c97c511292d72844e254c782cb/68747470733a2f2f616e74697363616e2e6d652f696d616765732f726573756c742f746e74754c6e436b5443777a2e706e67)](https://camo.githubusercontent.com/948d9f9f4991fa374fae04127573685acc9215c97c511292d72844e254c782cb/68747470733a2f2f616e74697363616e2e6d652f696d616765732f726573756c742f746e74754c6e436b5443777a2e706e67)

Greetz & Credit:

- Jthuraisamy for his amazing project SysWhispers: [https://github.com/jthuraisamy/SysWhispers](https://github.com/jthuraisamy/SysWhispers)
- OutFlank for creating InlineWhispers (Mingw-w64 Compatible SysWhispers): [https://github.com/outflanknl/InlineWhispers](https://github.com/outflanknl/InlineWhispers)
- FalconForceTeam for their syscall generation tool that supports SysWhispers2: [https://github.com/FalconForceTeam/SysWhispers2BOF](https://github.com/FalconForceTeam/SysWhispers2BOF)
- Snovvcrash for their NimHollow project, which I used as a template for process hollowing: [https://github.com/snovvcrash/NimHollow](https://github.com/snovvcrash/NimHollow)
- Snovvcrash again for their DInjector project, which I used as a template for many of the included injection techniques: [https://github.com/snovvcrash/DInjector](https://github.com/snovvcrash/DInjector)
- Cerbersec for their Ares project, whose code I used for PPID Spoofing, Blocking 3rd Party DLLs and Sandbox Evasion: [https://github.com/Cerbersec/Ares](https://github.com/Cerbersec/Ares)

## GitHub:

> **[GitHub - icyguider/Shhhloader: Syscall Shellcode Loader (Work in Progress)](https://github.com/icyguider/Shhhloader)**
>
> Syscall Shellcode Loader (Work in Progress)