Hello, I'm Matt Glass, and welcome to this course on Execution with Donut.
In this course,
I'll show you how to use Donut to generate shell code and
enable execution of programs by exploiting the way Windows
handles .NET code through its native API.
Using Donut,
we can run other red team tools or C2 clients
without triggering the host defenses.
But first, let's look at what Donut is and how it's used.
Donut is the shell code generation tool originally written by
TheWover. This tool is available on GitHub and is currently
managed by multiple contributors.
Donut is designed to generate shell code from malicious executables or DLL
files. Using the shell code, you can hide the tools within other
executables or inject the code into running processes.
You can download versions of the tool from GitHub or clone the
repository using Git. Once loaded on your host, Donut enables
in‑memory execution of a variety of file types.
Donut accomplishes this by exploiting the way Windows machines handle
.NET execution to evade defenses. On the kill chain,
Donut falls under exploit and evasion. Although the programs Donut allows
you to execute can be used to accomplish escalation,
lateral movement, and action, Donut itself just enables the
execution of these programs and evades defenses on the exploited
host. The attack knowledge base developed by MITRE categorizes
adversary tactics and techniques into multiple categories to
describe the adversary's behavior.
The tactics are categories that cover different phases of an
attack and allow defensive teams to model an adversary's actions
and improve the defense of their networks.
We will cover three techniques that Donut can be used for.
The first is Native API, which falls under the execution tactics.
The second and third are Dynamic Link Library Injection
and Portable Executable Injection,
which are sub‑techniques of the Process Injection Technique,
which falls under the Defense Evasion tactic.
Donut can accomplish this by enabling adversaries to generate
shell code from their malicious programs.
They could use this shell code to target an exploited host and attempt to
inject their executables or DLL files into existing processes.
If this injection succeeds,
the attackers can run applications like C2 clients, which will communicate back
to the server and grant additional control over the host.
Once injected,
the client is now masked behind a legitimate program and
evades the existing host's defenses.