EchoStrike - Deploy reverse shells and perform stealthy process

项目说明

EchoStrike ⚔️

EchoStrike is a tool designed to generate undetectable reverse shells and perform process injection on Windows systems. Through an interacti written in Python, users can customize their binaries with ad persistence and encryption techniques. The malware code is written in Go, ensuring flexibility and power to meet the attacker’s needs.

EchoStrike allows downloading binaries from any URL and executing them under suspended processes like explorer.exe or cmd.exe, ensuring discreet and covert execution. Additionally, it offers ad options to adjust the binary size and ensure persistence on the target system.

---

✨ Features

<ul>
<li><strong>Interacti (Python-based):</strong> EchoStrike offers a user-friendly setup wizard, written in Python, guiding users through the customization of reverse shell payloads without the need to manually edit configuration files.</li>
<li><strong>Custom Persistence Techniques:</strong> Supports multiple persistence methods including:
<ul>
<li><code>Registry (CurrentUser Run)</code></li>
<li><code>Registry (Command Processor)</code></li>
<li><code>Task Scheduler (Admin Required)</code></li>
<li><code>Startup Folder</code></li>
</ul>
</li>
<li><strong>AES Encryption for Payloads:</strong> Automatically generates 128-bit AES keys (16-byte hexadecimal format) to encrypt payloads before injection, ensuring shellcode is not detected in memory in its raw form.</li>
<li><strong>Binary Padding for E:</strong> Adjusts the size of the generated binaries by adding padding, making it harder to detect them based on file size analysis.</li>
<li><strong>Error Logging and Process Management:</strong> Includes utilities for logging errors and managing background processes, with options to execute commands without displaying windows and mo to system folders like <code>AppData\Roaming</code> to avoid detection.</li>
<li><strong>Process Injection:</strong> Allows for the injection of binaries within suspended processes like <code>explorer.exe</code>, <code>cmd.exe</code>, and <code>powershell.exe</code>, enabling in-memory execution to avoid detection.</li>
<li><strong>Dynamic Download and Execution:</strong> EchoStrike allows you to download binaries from any URL and execute them under suspended processes, ensuring discreet delivery and execution of payloads.</li>
</ul>

---

⚙️ Configuration

EchoStrike’s configuration is simple and intuitive, with just a few steps required to generate your reverse shell payload. You simply need to follow the steps provided in the terminal by the wizard:

<ol>
<li><strong>Enter the IP and Port:</strong> Configure the server's IP address and port for the reverse shell connection.</li>
<li><strong>Provide a 16-bit AES key (32 characters):</strong> Enter or generate a secure AES key to encrypt the payload.</li>
<li><strong>Select Persistence Option:</strong> Choose from multiple persistence methods such as registry or task scheduler.</li>
<li><strong>Select Injection Method:</strong> EchoStrike allows for techniques, including process hollowing for shellcode injection.</li>
<li><strong>Compile the Payload:</strong> EchoStrike will generate a binary ready for deployment with the specified options.</li>
</ol>

---

---

⚙️ Demo Implementation

To ensure you receive the reverse shell, follow these steps:

<ol>
<li><strong>Start a TCP connection with Ngrok:</strong> Use the following command to start a TCP connection on port 443:
<pre><code>ngrok tcp 443</code></pre>
</li>
<li><strong>Extract the IP address:</strong> Once you get the Ngrok URL, extract the IP using this command:
<pre><code>ping 0.tcp.ngrok.io:16315</code></pre>
</li>
<li><strong>Enter the IP and Port:</strong> Use the IP address and port you obtained in the previous step (e.g., 16315) when EchoStrike prompts you for the reverse shell details.</li>
<li><strong>Create an OpenSSL Certificate and Key:</strong> Generate a certificate and key using the following command:
<pre><code>openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes</code></pre>
</li>
<li><strong>Listen on Port 443:</strong> Use socat to listen on port 443, where Ngrok will communicate with your local machine:
<pre><code>sudo socat OPENSSL-LISTEN:443,reuseaddr,cert=cert.pem,key=key.pem,=0,fork stdio</code></pre>
</li>
</ol>

Following these steps, you should successfully receive the reverse shell after the executes the binary generated by EchoStrike. If the ’s machine is turned off, keep your machine in listening mode. When the machine is turned back on, and if you selected a persistence technique, you will regain the shell without any user interaction.

---

💻 Requirements

This tool can be compiled on both Windows and Linux systems, pro flexibility for different en.

---

⚠️ Disclaimer

<p>This tool is intended solely for educational purposes and for use in controlled en. Unauthorized use of EchoStrike outside of these settings is strictly prohibited. The author, <strong>@Sti</strong>, takes no responsibility for any misuse or damage caused by this code.</p>

---

🎥 Demo

<p>Check out a li of EchoStrike in action </p>

项目信息

开发语言：Go

Star 数：194

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Deploy reverse shells and perform stealthy process injection with EchoStrike – a Go-based tool for ethical hacking and Red Team operations.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。