Unicorn is a Python tool for generating PowerShell downgrade attacks that inject shellcode directly into memory.
The tool addresses the challenge of executing shellcode on Windows systems by leveraging a PowerShell downgrade attack technique. It works by generating obfuscated PowerShell commands that bypass security restrictions and inject payloads into memory without writing to disk. The approach is based on established PowerShell attack methodologies and supports multiple payload sources including custom shellcode, Cobalt Strike, and Metasploit.
Unicorn suits penetration testers and red teamers who need to deliver payloads through command injection vectors. The tool generates attack code in multiple formats: direct PowerShell commands for command-line execution, VBA macros for Office documents, and HTA files for browser-based delivery. Each format produces the necessary payload files and a Metasploit resource script for listener configuration. The direct PowerShell approach requires a delivery mechanism such as SQL injection, Excel macros, Word documents, or tools like psexec. The macro variant embeds code in Office files and displays a fake corruption message to the user. The HTA variant creates HTML and HTA files that prompt the user to accept execution before the injection occurs. The tool also supports the windows/download_exec payload method for downloading and executing remote binaries.
Development activity shows consistent maintenance with regular updates addressing compatibility issues across different Office versions and Windows environments. The project includes specific handling for Office 365 and Word 2016+ macro naming conventions, indicating ongoing refinement for modern systems. Documentation covers multiple attack vectors and deployment scenarios, suggesting active engagement with real-world usage patterns. The codebase remains focused on its core functionality without scope creep into unrelated attack methods.
