[alphawrld]

Newbie here. I just cloned and edited Pulsar a bit and it's working fine but when I build "Shellcode" it gives me a .bin file

How should i run this on my vm to test it and how to make it easy executable if i want to share it easily and run it fast

[CL1B]

Learn what shellcode is and it works in your context. You shouldn't proceed without doing so first.

There's a lot of ways to execute shellcode most of which won't work as Pulsar is using donut, which in terms embeds a (really old) loader; The famous donutLoader.

Get a general understanding first then look into writing loaders compatible with invoking donutLoader, top of the dome loading trough CreateThread() is safest.

For evasion and operational security do not ever use the of donut's dated stub, it's a 1 way ticket to jail as there are many donut decompilers.

[possessed-client]

[..]
For evasion and operational security do not ever use the of donut's dated stub, it's a 1 way ticket to jail as there are many donut decompilers.

That's a bit much I'd think, what can an analyst learn by decompiling donut? Only what they learn from Pulsar, which is mostly the addresses and whatever artifacts they can scrape from the particular Pulsar build and system it's built on, which shouldn't really de-anon you, unless you've done something monumentally stupid compiling Pulsar and/or getting your IPs/domains. And they don't really need to decompile donut anyway to get to Pulsar, just run it in a good enough sandbox to get addresses or dump Pulsar from memory at right moment.

Anyway, yeah, unless the shellcode loader you're using to execute that shellcode is decent enough to mask the fact that standard Donut shellcode is very signatured, you might want to build Pulsar as an exe and use a custom Donut build if you need it as shellcode - look around Github, I've seen Donut forks with updated AMSI patching, and also Donut forks prepared for compilation with LLVM obfuscation, which helps against detections of it.

Or you might opt for injecting the exe directly, in which case you don't necessarily need it as shellcode - here's a post on a test I did yesterday about injecting XWorm, it should also work with Pulsar against WD, though there's some basic code edits necessary for this - https://hackforums.net/showthread.php?ti...id62892017

[CL1B]

That's a bit much I'd think, what can an analyst learn by decompiling donut? Only what they learn from Pulsar, which is mostly the addresses and whatever artifacts they can scrape from the particular Pulsar build and system it's built on, which shouldn't really de-anon you, unless you've done something monumentally stupid compiling Pulsar and/or getting your IPs/domains. And they don't really need to decompile donut anyway to get to Pulsar, just run it in a good enough sandbox to get addresses or dump Pulsar from memory at right moment.

Anyway, yeah, unless the shellcode loader you're using to execute that shellcode is decent enough to mask the fact that standard Donut shellcode is very signatured, you might want to build Pulsar as an exe and use a custom Donut build if you need it as shellcode - look around Github, I've seen Donut forks with updated AMSI patching, and also Donut forks prepared for compilation with LLVM obfuscation, which helps against detections of it.

Or you might opt for injecting the exe directly, in which case you don't necessarily need it as shellcode - here's a post on a test I did yesterday about injecting XWorm, it should also work with Pulsar against WD, though there's some basic code edits necessary for this - https://hackforums.net/showthread.php?ti...id62892017

You hit the nail: "and/or getting your IPs/domains"

The majority of treat actors do not know how big their fingerprint is buying servers, domains or proxying DNS.

Depending on the attack, still a 1 way ticket to jail.