{"id":17383352,"url":"https://github.com/karkas66/celestialspark","last_synced_at":"2025-04-08T03:16:44.675Z","repository":{"id":232793752,"uuid":"785205756","full_name":"Karkas66/CelestialSpark","owner":"Karkas66","description":"Version 2 - A modern 64-bit position independent meterpreter and Sliver compatible reverse_TCP Staging Shellcode based on Cracked5piders Stardust","archived":false,"fork":false,"pushed_at":"2025-03-27T12:47:34.000Z","size":638,"stargazers_count":99,"open_issues_count":0,"forks_count":10,"subscribers_count":3,"default_branch":"main","last_synced_at":"2025-04-08T03:16:34.100Z","etag":null,"topics":["pe","position-in","shellcode","stager"],"latest_commit_sha":null,"homepage":"","language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Karkas66.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-04-11T12:17:22.000Z","updated_at":"2025-04-01T08:29:07.000Z","dependencies_parsed_at":null,"dependency_job_id":"7c5bdc0a-a813-4f92-83ed-f018436f50b9","html_url":"https://github.com/Karkas66/CelestialSpark","commit_stats":null,"previous_names":["karkas66/celestialspark"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Karkas66%2FCelestialSpark","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Karkas66%2FCelestialSpark/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Karkas66%2FCelestialSpark/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Karkas66%2FCelestialSpark/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Karkas66","download_url":"https://codeload.github.com/Karkas66/CelestialSpark/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247767237,"owners_count":20992548,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["pe","position-in","shellcode","stager"],"created_at":"2024-10-16T07:41:21.819Z","updated_at":"2025-04-08T03:16:44.665Z","avatar_url":"https://github.com/Karkas66.png","language":"C","funding_links":[],"categories":[],"sub_categories":[],"readme":"# CelestialSpark V2\n\nA modern 64-bit position independent meterpreter and Sliver compatible reverse_TCP Staging Shellcode based on Cracked5piders Stardust Version 2 (03/2025)\n\n```c++\n#include \u003ccommon.h\u003e\n#include \u003cconstexpr.h\u003e\n#include \u003cresolve.h\u003e\n\nusing namespace stardust;\n\n// Define IP adress of your C2 Stager\n#define IP_STR  \"10.10.10.10\"\n// Define PORT 443 of your C2 Stager\n#define PORT 443\n```\n\n## Why\nI wanted to improve my understanding of position independent Shellcode, plus... My Meterpreter reverse_TCP Stager gets caught by a lot of AV/EDRs and I was hoping to somehow get around the IoCs the 15 year old Meterpreter reverse_TCP Shellcode generated by msfvenom.\nInspirations were:\n- https://github.com/SherifEldeeb/TinyMet\n- https://github.com/rapid7/metasploit-framework/blob/master/external/source/shellcode/windows/x86/src/block/block_reverse_tcp.asm\n\n## How does it work\n- not existing HTONS and HTONL functions have been hardcoded\n- custom inet_addr function was rewritten and implemented in main.cc\n- Socket creation and interaction functions have been imported from ws2_32.dll\n- Meterpreter Staging Logic hase been copied from the original project and TinyMet\n\n## Usage\n- Git clone\n- change IP and Port in main.cc\n- disable the messagebox right before the Stage2 shellcode execution (if it bothers you)\n- make\n- Use your favourite Shellcode Loader/Injector. I Successfully tested:\n    - https://github.com/Cipher7/ChaiLdr\n    - https://github.com/florylsk/ExecIT\n    - https://github.com/3xpl01tc0d3r/ProcessInjection\n    - the original Stardust Loader and Stomper written by [Cracked5pider](https://github.com/Cracked5pider)\n\nEnd of CelestialSpark\n# Original Readme from here\n\n# Stardust\n\nA modern and easy to use 32/64-bit shellcode template.\n\n- raw strings \n- C++20 project \n- uses compile time hashing with fnv1a for both function and module resolving  \n\n### Basic Usage\n\nresolving modules from PEB using `resolve::module`:\n```c++\nif ( ! (( ntdll.handle = resolve::module( expr::hash_string\u003cwchar_t\u003e( L\"ntdll.dll\" ) ) )) ) {\n    return;\n}\n\nif ( ! (( kernel32.handle = resolve::module( expr::hash_string\u003cwchar_t\u003e( L\"kernel32.dll\" ) ) )) ) {\n    return;\n}\n```\n\nresolving function apis using either `RESOLVE_API` macro or `resolve::api` function:\n```c++\nconst auto user32 = kernel32.LoadLibraryA( symbol\u003cconst char*\u003e( \"user32.dll\" ) );\n\ndecltype( MessageBoxA ) * msgbox = RESOLVE_API( reinterpret_cast\u003cuintptr_t\u003e( user32 ), MessageBoxA );\n\nmsgbox( nullptr, symbol\u003cconst char*\u003e( \"Hello world\" ), symbol\u003cconst char*\u003e( \"caption\" ), MB_OK );\n```\nThe `RESOLVE_API` is a wrapper around `resolve::api` to automatically hashes the function name and cast the function pointer to the function type.\n\nstring hashing for both UTF-8 and UTF-16 using the compile time `expr::hash_string` function:\n```c++\nauto user32_hash      = expr::hash_string\u003cwchar_t\u003e( L\"user32.dll\" );\nauto loadlibrary_hash = expr::hash_string\u003cchar\u003e( \"LoadLibraryA\" );\n```\n\nraw strings support for both 32/64-bit by using the `symbol` function: \n```c++\nauto caption_string = symbol\u003cconst char*\u003e( \"hello from stardust\" );\n\nuser32.MessageBoxA( nullptr, caption_string, symbol\u003cconst char*\u003e( \"message title\" ), MB_OK );\n```\n\neasy to add new apis and modules to the instance. Under `include/common.h` the following entry has to be made:\n```c++\nclass instance {\n    ...\n    \n    struct\n    {\n        uintptr_t handle; // base address to user32.dll\n\n        struct {\n            D_API( MessageBoxA );\n            // more entries can be added here\n        };\n    } user32 = {\n        RESOLVE_TYPE( MessageBoxA ),\n        // more entries can be added here \n    };\n    \n    ...\n```\nwhile the ``src/main.cc`` should resolve the base address of user32 and resolve the api pointer:\n```c++\n\ndeclfn instance::instance(\n    void\n) {\n    ...\n    //\n    // resolve user32.dll from PEB if loaded \n    if ( ! (( user32.handle = resolve::module( expr::hash_string\u003cwchar_t\u003e( L\"user32.dll\" ) ) )) ) {\n        return;\n    }\n\n    //\n    // automatically resolve every entry imported\n    // by user32 from the structure \n    RESOLVE_IMPORT( user32 );\n    ...\n}\n\n```\n\nsemi friendly debugging capabilities via DbgPrint. The project althought needs to be compiled in debug mode by specifying ``make debug``. Usage: \n```c++\nconst auto user32 = kernel32.LoadLibraryA( symbol\u003cconst char*\u003e( \"user32.dll\" ) );\n\nif ( user32 ) {\n    DBG_PRINTF( \"oh wow look we loaded user32.dll -\u003e %p\\n\", user32 );\n} else {\n    DBG_PRINTF( \"okay something went wrong. failed to load user32 :/\\n\" );\n}\n\nDBG_PRINTF( \"running from %ls (Pid: %d)\\n\",\n    NtCurrentPeb()-\u003eProcessParameters-\u003eImagePathName.Buffer,\n    NtCurrentTeb()-\u003eClientId.UniqueProcess );\n\nDBG_PRINTF( \"shellcode @ %p [%d bytes]\\n\", base.address, base.length );\n```\n\n### Building \n\nBuild in release mode: \n```shell\n$ make                                                                                                                                                                                                                                                                                  20:17:26\n-\u003e compiling src/main.cc to main.x64.obj\n-\u003e compiling src/resolve.cc to resolve.x64.obj\ncompiling x64 project\n/usr/bin/x86_64-w64-mingw32-ld: bin/stardust.x64.exe:.text: section below image base\n-\u003e compiling src/main.cc to main.x86.obj\n-\u003e compiling src/resolve.cc to resolve.x86.obj\ncompiling x86 project\n/usr/bin/i686-w64-mingw32-ld: bin/stardust.x86.exe:.text: section below image base\n$ ll bin                                                                                                                                                                                                                                                                                20:57:10\ndrwxr-xr-x spider spider 4.0 KB Thu Mar 13 20:57:10 2025 obj\n.rw-r--r-- spider spider 752 B  Thu Mar 13 20:57:10 2025 stardust.x64.bin\n.rw-r--r-- spider spider 672 B  Thu Mar 13 20:57:10 2025 stardust.x86.bin\n```\n\nBuild in debug mode: \n```shell\n$ make debug                                                                                                                                                                                                                                                                            20:57:14\n-\u003e compiling src/main.cc to main.x64.obj\n-\u003e compiling src/resolve.cc to resolve.x64.obj\ncompiling x64 project\n/usr/bin/x86_64-w64-mingw32-ld: bin/stardust.x64.exe:.text: section below image base\n-\u003e compiling src/main.cc to main.x86.obj\n-\u003e compiling src/resolve.cc to resolve.x86.obj\ncompiling x86 project\n/usr/bin/i686-w64-mingw32-ld: bin/stardust.x86.exe:.text: section below image base\n$ ll bin                                                                                                                                                                                                                                                                                20:58:13\ndrwxr-xr-x spider spider 4.0 KB Thu Mar 13 20:58:13 2025 obj\n.rw-r--r-- spider spider 1.2 KB Thu Mar 13 20:58:13 2025 stardust.x64.bin\n.rw-r--r-- spider spider 1.1 KB Thu Mar 13 20:58:13 2025 stardust.x86.bin\n```\n\n## Demo\nx64:\n![x64](./static/stomper.x64.png)\n\nx86:\n![x86](./static/stomper.x86.png)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkarkas66%2Fcelestialspark","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fkarkas66%2Fcelestialspark","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkarkas66%2Fcelestialspark/lists"}