thewover/donut

★ 4,582CAudience · developerComplexity · 4/5Setup · moderate

Mindmap

mindmap
  root((donut))
    What it does
      Converts programs to shellcode
      Runs code in memory only
      No disk writes
    Inputs
      NET assemblies
      Windows EXEs and DLLs
      VBScript and JScript
    Features
      AES encryption option
      Multiple output formats
      Compression support
    Tech Stack
      C language
      Windows API
      NET runtime loader
    Audience
      Pentesters
      Red teamers
      Security researchers

mindmap root((donut)) What it does Converts programs to shellcode Runs code in memory only No disk writes Inputs NET assemblies Windows EXEs and DLLs VBScript and JScript Features AES encryption option Multiple output formats Compression support Tech Stack C language Windows API NET runtime loader Audience Pentesters Red teamers Security researchers

Click or tap to explore — scroll the page freely

Things people build with this

USE CASE 1

Run a .NET pentesting tool on a target system during an authorized engagement without writing any file to disk.

USE CASE 2

Deliver a custom payload as shellcode that bypasses file-based antivirus scanning during a controlled security test.

USE CASE 3

Integrate memory-resident execution into your own red team tooling via the provided C, C++, or Python library.

USE CASE 4

Convert VBScript or JScript tools into in-memory shellcode for use in authorized security assessments.

Tech stack

CC++PythonWindows API

Getting it running

Difficulty · moderate Time to first run · 30min

Requires a Windows target environment for generated shellcode, the build supports Linux but the payloads execute Windows processes only.

Project includes a legal-use disclaimer, always verify the license terms before use in commercial or production contexts.

In plain English

Donut is a tool used in security research and penetration testing that converts Windows programs into a self-contained blob of machine code, called shellcode, which can be injected into a running process and executed entirely in memory without touching the disk. The input can be a .NET assembly (a compiled C# or VB.NET program), a native Windows executable, a DLL, a VBScript file, or a JScript file. The typical use case is an authorized red team engagement where a tester needs to run a tool on a target system without dropping a file that antivirus software might detect. By converting the program into shellcode and loading it directly into memory, there is no file for the operating system to scan before execution. Donut handles the technical work of setting up the correct runtime environment in memory: for .NET programs it loads the .NET runtime into the host process, for scripts it uses the Windows scripting engine, for native executables it uses a custom loader. The generated shellcode can optionally be encrypted with a 128-bit symmetric cipher so the raw bytes are harder to recognize in transit or storage. The tool supports several output formats for the resulting shellcode, including raw binary, Base64, C arrays, Python strings, PowerShell strings, and others, so it can be incorporated into many different delivery mechanisms. Compression of the input file before wrapping is also supported. Donut also includes options that disable certain Windows logging and scanning mechanisms at runtime to reduce the chance of detection during a test. The README discusses these techniques and links to the underlying security research papers. Libraries for both Linux and Windows are provided so developers can call Donut's functionality from their own tools in C, C++, or Python. The project is aimed at security professionals conducting authorized assessments and includes a disclaimer about legal use.

Copy-paste prompts

Prompt 1

I have a .NET assembly called tool.exe and want to convert it to encrypted shellcode using Donut for an authorized pentest, show me the exact Donut command to produce Base64 output with AES-128 encryption.

Prompt 2

Help me write a Python script using Donut's Python bindings that reads a DLL file, converts it to shellcode, and writes the result as a C-style byte array.

Prompt 3

Show me how to call the Donut C library from a custom loader to generate shellcode at runtime instead of as a pre-built file.

Prompt 4

Using Donut, what command-line flags do I need to disable Windows script logging and AMSI scanning before executing a JScript payload in memory?

Prompt 5

Explain step by step how Donut loads the .NET CLR runtime into a target process when injecting a C# assembly as shellcode.

Open on GitHub → Explain another repo

← thewover on gitmyhub — every repo by this author, as a profile.

Verify against the repo before relying on details.