Donut shellcode

donut -f 1 payload.exe -o shellcode.bin

Generates position-independent shellcode from a .NET or native executable to inject it into memory without touching disk.

Run it when you have a payload (Cobalt Strike beacon, mimikatz, your own DLL) and need to execute it without leaving files on the target. Donut extracts the PE and converts it into PIC shellcode that any loader can load, or that you can embed in an Office document with macros.

If the loader you use is crude, Donut's default stub is detected by heuristics: most AVs already flag vanilla shellcodes. Don't use it to load tools that need dynamic arguments without recompiling the payload with -p.