Introduction

The previous modules demonstrated several methods for encrypting and obfuscating payloads. Implementing these methods repeatedly can become inconvenient, especially when each technique also requires its corresponding decryption or deobfuscation routine.

HellShell is a command-line utility developed by the MalDev Academy team to automate this process. The tool reads a raw payload from disk, applies the selected transformation, and produces the transformed payload together with the code required to recover the original bytes.

HellShell supports IPv4, IPv6, MAC address, and UUID obfuscation, along with AES and RC4 encryption.

Tool Features

HellShell provides the following functionality:

• IPv4, IPv6, MAC address, and UUID payload obfuscation
• AES-256-CBC encryption using a randomly generated 32-byte key and 16-byte initialization vector
• RC4 encryption using a randomly generated 16-byte key
• Automatic PKCS#7 padding for payloads processed by the obfuscation routines
• Automatic generation of the corresponding decryption or deobfuscation function
• Optional output-file support

The behavior of the optional output file depends on whether an obfuscation or encryption technique is selected.

For the obfuscation options, the generated string array and its corresponding deobfuscation function are written to the same text file.

For the encryption options, the output file contains only the raw ciphertext bytes. The generated key, initialization vector when applicable, and the matching decryption function remain printed to the console.

Usage

HellShell accepts the input payload path, the transformation option, and an optional output-file path.

  +==========================================================+
  |                                                          |
  |   HellShell  -  Payload Obfuscation & Encryption Tool    |
  |   MalDevAcademy   -   @NUL0x4C   |   @mrd0x              |
  |                                                          |
  +==========================================================+

  USAGE:
      HellShell.exe  <payload-file>  <option>  [output-file]

  ARGUMENTS:
      <payload-file>   Raw shellcode file to obfuscate or encrypt
      <option>         Transform to apply (see below)
      [output-file]    Optional. Behavior depends on the transform:
                         - Obfuscation (ipv4/ipv6/mac/uuid): array and deobfuscation routine are both written here.

                         - Encryption (aes/rc4): only the ciphertext is written here.
                           Key/IV and decryption routine are always printed to the console.

  OPTIONS:
      ipv4    Array of IPv4 addresses    e.g. 252.72.131.228
      ipv6    Array of IPv6 addresses    e.g. FC48:83E4:F0E8:C000:0000:4151:4150:5251
      mac     Array of MAC addresses     e.g. FC-48-83-E4-F0-E8
      uuid    Array of UUID strings      e.g. FC4883E4-F0E8-C000-0000-415141505251
      aes     AES-256-CBC encrypted output with random key and IV
      rc4     RC4 encrypted output with random key

  EXAMPLES:
      HellShell.exe  calc.bin  uuid
      HellShell.exe  beacon.bin  aes
      HellShell.exe  calc.bin  ipv6  payload.txt
      HellShell.exe  beacon.bin  rc4  ciphertext.bin

The option name is case-insensitive. Supplying an unsupported option or an incorrect number of arguments causes HellShell to display the help menu.

Console Output