> ## Documentation Index
> Fetch the complete documentation index at: https://docs.specterops.io/llms.txt
> Use this file to discover all available pages before exploring further.

# donut

> The donut command convert a VBS/JS or PE/.NET EXE/DLL to shellcode.

## Summary

The `donut` command convert a VBS/JS or PE/.NET EXE/DLL to shellcode.
Only the finest artisanal donuts are made of shells.
Uses the [go-donut](https://github.com/Binject/go-donut) project.

* Needs Admin: False
* Version: 1
* Author: @Ne0nd0g

See the [Detailed Summary](#detailed-summary) section for additional information

### Arguments

* [module](#module)
* [url](#url)
* [entropy](#entropy)
* [arch](#arch)
* [bypass](#bypass)
* [entrypoint](#entrypoint)
* [exit](#exit)
* [class](#class)
* [domain](#domain)
* [method](#method)
* [input](#input)
* [params](#params)
* [unicode](#unicode)
* [runtime](#runtime)
* [thread](#thread)
* [compress](#compress)
* [spawnto](#spawnto)
* [spawntoargs](#spawntoargs)
* [verbose](#verbose)

#### module

* Description: Module name. Randomly generated by default with entropy enabled
* Required Value: False
* Default Value: None

#### url

* Description: HTTP server that will host the donut module
* Required Value: False
* Default Value: None

#### entropy

* Description: 1=disable, 2=use random names, 3=random names + symmetric encryption (default)
* Required Value: True
* Default Value: `3`

#### arch

* Description: Target Architecture: x32, x64, or x84
* Required Value: False
* Default Value: `x84`

#### bypass

* Description: Bypass AMSI/WLDP : 1=skip, 2=abort on fail, 3=continue on fail
* Required Value: False
* Default Value: `3`

#### entrypoint

* Description: Create a new thread for loader. Optionally execute original entrypoint of host process
* Required Value: False
* Default Value: False

#### exit

* Description: Exiting. 1=exit thread, 2=exit process
* Required Value: False
* Default Value: `1`

#### class

* Description: Optional class name.  (required for .NET DLL)
* Required Value: False
* Default Value: None

#### domain

* Description: AppDomain name to create for .NET.  Randomly generated by default with entropy enabled
* Required Value: False
* Default Value: None

#### method

* Description: Optional method or API name for DLL. (a method is required for .NET DLL)
* Required Value: False
* Default Value: None

#### input

* Description: .NET assembly, EXE, DLL, VBS, JS or XSL file to execute in-memory
* Required Value: True
* Default Value: None

#### params

* Description: Optional parameters/command line inside quotations for DLL method/function or EXE.
* Required Value: False
* Default Value: None

#### unicode

* Description: Command line is passed to unmanaged DLL function in UNICODE format. (default is ANSI)
* Required Value: False
* Default Value: False

#### runtime

* Description: CLR runtime version. This will override the auto-detected version
* Required Value: False
* Default Value: None

#### thread

* Description: Create new thread for entrypoint of unmanaged EXE
* Required Value: False
* Default Value: False

#### compress

* Description: Pack/Compress file. 1=disable, 2=LZNT1, 3=Xpress, 4=Xpress Huffman
* Required Value: False
* Default Value: None

#### spawnto

* Description: The child process to inject and execute the donut generated shellcode
* Required Value: True
* Default Value: C:\Windows\System32\WerFault.exe

#### spawntoargs

* Description: Arguments to create the spawnto process with, if any
* Required Value: False
* Default Value: None

#### verbose

* Description: Show verbose output from Donut
* Note: The verbose output is from the Donut program running on the server while generating the shellcode
* Required Value: False
* Default Value: False

## Usage

To use this command, type `donut` and press enter for the dialog window to appear. There are too many arguments to
facilitate using the task window only to type out the command.

## MITRE ATT\&CK Mapping

[T1055.012](https://attack.mitre.org/techniques/T1055/012/) Process Injection: Process Hollowing

## Detailed Summary

The `donut` command leverages [Donut](https://github.com/TheWover/donut) by @TheWover transforms an arbitrary .NET
assembly, PE, or a few other executable formats into position-independent shellcode.
The [go-donut](https://github.com/Binject/go-donut) library specifically is used with Merlin to generate the shellcode.
Once the shellcode is generated, it is executed in the `spawnto` process using the process hollowing technique described
in the [createprocess](./../createprocess) command documentation.