A repository of Windows Shellcode runners and supporting utilities. The applications load and execute Shellcode using various API calls or techniques.
A repository of Windows Shellcode runners and supporting utilities. The applications load and execute Shellcode using various API calls or techniques.
go-shellcode is a repository of Windows Shellcode runners and supporting utilities. The applications load and execute Shellcode using various API calls or techniques.
The available Shellcode runners include:
This application leverages the Windows CreateFiber function from the Kernel32.dll to execute shellcode within this application's process. This is usefull when you want to avoid remote process injection and want to avoid calling CreateThread. This application DOES NOT leverage functions from the golang.org/x/sys/windows package. The most significant difference is that this application loads all the necessary DLLs and Procedures itself and uses the procedure's Call() function.
NOTE: I have not figured out way to have the process exit and you will have to manually terminate it.
The application can be compiled with the following command on a Windows host from the project's root directory:
set GOOS=windows GOARCH=amd64;go build -o CreateFiber.exe .\cmd\CreateFiber\main.go
This application leverages the Windows CreateProcess function from Kernel32.dll. The process is created in a suspended state, the AddressOfEntryPoint in the IMAGE_OPTIONAL_HEADER structure is updated to execute shellcode in the childprocess, and then the process is resumed. This is a type of process hollowing but the existing PE is NOT unmapped and the ThreadContext is NOT updated. The provided shellcode architecture (i.e. x86 or x64) must match the architecture of the child process.
The application can be compiled with the following command on a Windows host from the project's root directory:
set GOOS=windows GOARCH=amd64;go build -o CreateProcess.exe .\cmd\CreateProcess\main.go
This application leverages the Windows CreateProcess function from Kernel32.dll. The process is created in a suspended state, the AddressOfEntryPoint in the IMAGE_OPTIONAL_HEADER structure is updated to execute shellcode in the childprocess, and then the process is resumed. This is a type of process hollowing but the existing PE is NOT unmapped and the ThreadContext is NOT updated. The provided shellcode architecture (i.e. x86 or x64) must match the architecture of the child process.
This application differs from CreateProcess because it will collect any data written to STDOUT or STDERR in the child process and return it to the parent process. Data is collected by using the CreatePipe function to create an anonymous pipe that the parent and child process communicate over. This is usefull when using tools like Donut to execute a .NET assembly in a child process as shellcode and to retrieve the output of the executed program. The following command can be used to generate position-independent shellcode to run Seatbelt with Donut v0.9.3:
.\donut.exe -o donut_v0.9.3_Seatbelt.bin -x 2 -c Seatbelt.Program -m Main -p "ARPTable" Seatbelt.exe
The application can be compiled with the following command on a Windows host from the project's root directory:
set GOOS=windows GOARCH=amd64;go build -o CreateProcessWithPipe.exe .\cmd\CreateProcessWithPipe\main.go
This application leverages the Windows CreateRemoteThread function from Kernel32.dll to execute shellocde in a remote process. The application requires that the target process to inject into is already running. The targe Process Identifier (PID) can provided at runtime for testing using the -pid command line flag. Hardcode the PID in the following line of code for operational use by replacing the 0 with your target PID:
pid := flag.Int("pid", 0, "Process ID to inject shellcode into")
This application leverages functions from the golang.org/x/sys/windows package, where feasible, like the windows.OpenProcess(). The application can be compiled wit the following command on a Windows host from the project's root directory:
set GOOS=windows GOARCH=amd64;go build -o CreateRemoteThread.exe .\cmd\CreateRemoteThread\main.go
This application leverages the Windows CreateRemoteThread function from Kernel32.dll to execute shellocde in a remote process. The application requires that the target process to inject into is already running. The targe Process Identifier (PID) can provided at runtime for testing using the -pid command line flag. Hardcode the PID in the following line of code for operational use by replacing the 0 with your target PID:
pid := flag.Int("pid", 0, "Process ID to inject shellcode into")
This application DOES NOT leverage functions from the golang.org/x/sys/windows package. The most significant difference is that this application loads all the necessary DLLs and Procedures itself and uses the procedure's Call() function. The application can be compiled with the following command on Windows host from the project's root directory:
set GOOS=windows GOARCH=amd64;go build -o CreateRemoteThreadNative.exe .\cmd\CreateRemoteThreadNative\main.go
This application leverages the Windows CreateThread function from Kernel32.dll to execute shellcode within this application's process. This is usefull when you want to avoid remote process injection. This application leverages functions from the golang.org/x/sys/windows package, where feasible, like the [windows.VirtualAlloc()`](https://github.com/golang/sys/blob/a7d97aace0b0/windows/zsyscall_windows.go#L1712). The application can be compiled with the following command on Windows host from the project's root directory:
set GOOS=windows GOARCH=amd64;go build -o CreateThread.exe .\cmd\CreateThread\main.go
This application leverages the Windows CreateThread function from the Kernel32.dll to execute shellcode within this application's process. This is usefull when you want to avoid remote process injection. This application DOES NOT leverage functions from the golang.org/x/sys/windows package. The most significant difference is that this application loads all the necessary DLLs and Procedures itself and uses the procedure's Call() function. The application can be compiled with the following command on Windows host from the project's root directory:
set GOOS=windows GOARCH=amd64;go build -o CreateThreadNative.exe .\cmd\CreateThreadNative\main.go
The application leverages the Windows CreateProcess function to create a process in a suspended state. Once the child process is suspended, the Windows QueueUserAPC function is used to add a UserAPC to the child process that points to the allocate shellcode. Next, ResumeThread is called, which subsequently calls the undocumented NtTestAlert function that will execute the created UserAPC and in turn the shellcode. This is usefull because the shellcode will execute before AV/EDR can hook functions to support detection. Reference New 'Early Bird' Code Injection Technique Discovered. The application can be compiled with the following command on Windows host from the project's root directory:
export GOOS=windows GOARCH=amd64;go build -o goEarlyBird.exe cmd\EarlyBird\main.go
This application leverages the Windows EtwpCreateEtwThread function from ntdll.dll to execute shellcode within this application's process. Original work by TheWover. This is usefull when you want to avoid remote process injection. This application DOES NOT leverage functions from the golang.org/x/sys/windows package. The most significant difference is that this application loads all the necessary DLLs and Procedures itself and uses the procedure's Call() function. The application can be compiled with the following command on a Windows host from the project's root directory:
set GOOS=windows GOARCH=amd64;go build -o EtwpCreateEtwThread.exe .\cmd\EtwpCreateEtwThread\main.go
This application uses the undocumented NtQueueApcThreadEx to create a "Special User APC" in the current thread of the current process to execute shellcode. Because the shellcode is loaded and executed in the current process, it is "local". This same technique can be used for a remote process. NOTE: This will only work on Windows 7 or later. Reference APC Series: User APC API.
export GOOS=windows GOARCH=amd64;go build -o goNtQueueApcThreadEx-Local.exe cmd\NtQueueApcThreadEx-Local\main.go
This application leverages the Windows RtlCreateUserThread function from ntdll.dll to execute shellocde in a remote process. The application requires that the target process to inject into is already running. The targe Process Identifier (PID) can provided at runtime for testing using the -pid command line flag. Hardcode the PID in the following line of code for operational use by replacing the 0 with your target PID:
pid := flag.Int("pid", 0, "Process ID to inject shellcode into")
This application DOES NOT leverage functions from the golang.org/x/sys/windows package. The most significant difference is that this application loads all the necessary DLLs and Procedures itself and uses the procedure's Call() function. The application can be compiled with the following command on a Windows host from the project's root directory:
`set GOOS=wind
No open issues yet, or sync has not completed.