{
  "name": "inject",
  "display_name": "inject",
  "kind": "module",
  "description": "Inject prepared shellcode into an existing process or a newly spawned process. Donut inputs are prepared by the TeamServer shellcode service before the task is sent to the beacon.",
  "command_template": "inject --pid {pid} [--raw {raw:q}] [--donut-exe {donut_exe:q}] [--donut-dll {donut_dll:q}] [--method {method:q}] [-- {arguments:raw}]",
  "target": "beacon",
  "requires_session": true,
  "platforms": ["windows"],
  "archs": ["x86", "x64", "arm64"],
  "args": [
    {
      "name": "--pid",
      "type": "flag",
      "required": true,
      "description": "Target process id. Use a negative value to spawn the configured process before injection."
    },
    {
      "name": "--raw",
      "type": "flag",
      "required": false,
      "description": "Use an existing raw shellcode file on the TeamServer.",
      "artifact_filter": {
        "category": "tool",
        "scope": "server",
        "target": "teamserver",
        "platform": "windows",
        "arch": "session.arch",
        "runtime": "any",
        "format": "bin",
        "name_contains": ".bin"
      }
    },
    {
      "name": "--donut-exe",
      "type": "flag",
      "required": false,
      "description": "Generate shellcode from an executable on the TeamServer.",
      "artifact_filters": [
        {
          "category": "tool",
          "scope": "server",
          "target": "teamserver",
          "platform": "windows",
          "arch": "session.arch",
          "runtime": "any",
          "format": "exe",
          "name_contains": ".exe"
        },
        {
          "category": "beacon",
          "scope": "implant",
          "target": "listener",
          "platform": "windows",
          "arch": "session.arch",
          "runtime": "native",
          "format": "exe",
          "name_contains": ".exe"
        }
      ]
    },
    {
      "name": "--donut-dll",
      "type": "flag",
      "required": false,
      "description": "Generate shellcode from a DLL on the TeamServer.",
      "artifact_filter": {
        "category": "tool",
        "scope": "server",
        "target": "teamserver",
        "platform": "windows",
        "arch": "session.arch",
        "runtime": "any",
        "format": "dll",
        "name_contains": ".dll"
      }
    },
    {
      "name": "source_path",
      "type": "path",
      "required": true,
      "description": "Raw shellcode, executable, or DLL path on the TeamServer."
    },
    {
      "name": "pid",
      "type": "number",
      "required": true,
      "description": "Target process id."
    },
    {
      "name": "--method",
      "type": "flag",
      "required": false,
      "description": "Required for --donut-dll."
    },
    {
      "name": "arguments",
      "type": "text",
      "required": false,
      "description": "Arguments passed to the Donut source after --.",
      "variadic": true
    }
  ],
  "examples": [
    "inject --raw shellcode.bin --pid 4321",
    "inject --donut-exe Seatbelt.exe --pid 4321 -- -group=system",
    "inject --donut-dll Tool.dll --pid -1 --method EntryPoint -- arg1 arg2"
  ],
  "source": "manifest"
}