Skip to content

Command Plugin (SC)

This page covers authoring choices for a command plugin delivered as shellcode (SC). For ExecUnit formats, responsibilities, and platform differences, start with Command ExecUnits.

Authoring options

When creating command plugin shellcode, you have two options:

  1. Write Native Shellcode: Develop the shellcode directly using assembly language and C.
  2. Convert Executable to Shellcode: Write the code in C/C++ or C# and convert the resulting executable to shellcode using tools like Donut.

The original command example uses C# and implements an echo operation.

Shellcode main activities

The command receives configuration from the server-side plugin, performs its operation, and returns result or error data together with its completion status. See Command ExecUnits for these responsibilities in context.

Type-Length-Value (TLV) encoding and the command message definitions are maintained under Architecture > Protocols.

Example plugin SC code

The protocol reference describes the messages used by the original echo example:

The echo operation returns the supplied data. Keep the operation's behavior separate from the message definitions in the protocol reference.

Shellcode conversion

The resulting executable is converted into shellcode using the Donut tool. This conversion is performed without applying compression or encryption, allowing the Tuoni server to randomize the pipe name as needed.

donut.exe -z 1 -e 1 -o CommandEcho.shellcode -i CommandEcho.exe