Dynamic HTTP(S) Payload-Stager

A dynamic HTTP/S stager that lets one shellcode loader be reused for different encrypted payloads - no rebuilds.

Learn more about this in my blog post

Quick overview

A Python tool packages decryption params (key, IV, etc.) into a Base64 file you host. The stager fetches that file at runtime, parses <name><delimiter><hex> lines, converts hex -> bytes, and loads them into memory.

This lets the same loader decrypt different payloads on demand - no rebuilding or redeploying required.

Video Demo

demo_http_stager.mp4

How to use

To use the Dynamic HTTP/S Stager, configure three parameters:

• The number of variables
• The URL to the hosted file
• The delimiter used in the Python script

Code

• ConvertToFormat.py
• Dynamic_HTTP_Payload_Stager.cpp

Update

ConvertToFormat.py now supports: read-from-file, custom delimiter, and output path.

Notes

• Host the file over HTTPS; consider token/HMAC or short-lived URLs for integrity.
• Stager should validate counts/lengths and Base64 decode success.
• PoC - treat keys/hosting with OPSEC in mind.