SharpShooter - Payload Generation Framework

项目说明

Description
===========

SharpShooter is a payload creation 框架 for the retrieval and execution of arbitrary CSharp 源码 代码.
SharpShooter is capable of creating payloads in a of formats, including HTA, JS, VBS and WSF. It le James Forshaw's DotNetToJa 工具 to invoke methods from the SharpShooter DotNet serialised object. Payloads can be retrie Web or DNS delivery or both; SharpShooter is compatible with the MDSec Acti PowerDNS project. Alternatively, stageless payloads with embedded shellcode execution can also be generated for the same scripting formats.

SharpShooter payloads are RC4 encrypted with a random key to provide some modest anti-virus e, and the project includes the capability to integrate sandbox detection and en keying to assist in e detection.

SharpShooter includes a predefined CSharp template for executing shellcode with staged and stageless payloads, but any CSharp 代码 can be compiled and invoked in memory using reflection, courtesy of CSharp's CodeDom provider.

Finally, SharpShooter provides the ability to bundle the payload inside an HTML file using the Demiguise HTML smuggling technique.

SharpShooter targets v2, v3 and v4 of the .NET 框架 which will be found on most end-user Windows workstations.

1.0 of SharpShooter introduced several new concepts, including COM staging, execution of Squiblydoo and Squiblytwo, as well as XSL execution. To acomplish this new functionality, several new flags were added; --com, --awl and --awlurl.

2.0 of SharpShooter added the AMSI bypass module, along with support generating VBA and Excel 4 macro enabled documents.

Further information can be found on the MDSec blog post.

Usage - Command Line Mode:
======

SharpShooter is highly configurable, supporting a number of different payload types, sandbox e, delivery methods and output types.

Running SharpShooter with the --help argument will produce the following output:

Examples of some use cases are provided below:

Stageless Ja ###

Create a stageless Ja payload targeting 4 of the .NET 框架. This example will create a payload named foo.js in the output directory. The shellcode is read from the ./raw.txt file.
The payload attempts to enforce some sandbox e by keying execution to the CONTOSO domain, and checking for known sandbox/.

Stageless HTA ###

Create a stageless HTA payload targeting 2/3 of the .NET 框架. This example will create a payload named foo.hta in the output directory. The shellcode is read from the ./raw.txt file.
The payload attempts to enforce some sandbox e by checking for known MAC addresses. A HTML smuggling payload will also be generated named foo.html in the output directory. This payload will use the example McAfee virus scan template.

Staged VBS ###

This example creates a staged that performs both Web and DNS delivery. The payload will attempt to retrieve a GZipped CSharp file that executes the shellcode supplied as a CSharp byte array in the csharpsc.txt file. The CSharp file used is the built-in SharpShooter shellcode execution template. The payload is created in the output directory named foo.payload and should be hosted on The same file should also be hosted on the bar.foo domain using PowerDNS to serve it. The VBS file will attempt to key execution to the CONTOSO domain and will be embedded in a HTML file using the HTML smuggling technique with the McAfee virus scanned template. The resultant payload is stored in the output directory named foo.html.

Custom CSharp inside VBS ###

This example demonstrates how to create a staged JS payload that performs web delivery, retrieving a payload from The generated payload will attempt sandbox e, and attempt to compile the retrie which requires mscorlib.dll and System.Windows.Forms.dll as DLL references. The Main method in the MDSec.SharpShooter namespace will be executed on successful compilation.

Creation of a Squiblytwo VBS ###

This example creates a COM stager that uses the Outlook.CreateObject() COM method as a primitive to execute wmic.exe to execute a hosted stylesheet. The --awl parameter is not used by defaults to wmic.

Creation of a XSL HTA ###

This example creates a HTA smuggled file that uses the the XMLDOM COM interface to retrieve and execute a hosted stylesheet.

Creation of a ###

This example creates a file that uses the the XMLDOM COM interface to retrieve and execute a hosted stylesheet.

Creation of an Excel 4.0 SLK Macro Enabled Document ###

This example creates an Excel 4.0 SLK file that executes the supplied shellcode and wraps it in HTML.
The shellcode cannot contain null bytes, hint:

Author and Credits
==================
Author: Dominic Chell, MDSec Acti and

Credits:

项目信息

开发语言：VBA

Star 数：1986

技术要点

该项目属于黑客技术方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Payload Generation Framework展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。