search

optiv / ScareCrow

ScareCrow - Payload creation framework designed around EDR bypass.
2.73k stars 507 forks source link

Binary Mode Crashing on later versions of Go #7

Closed Tylous closed 3 years ago

Tylous commented 3 years ago

`C:\Users\Admin\Desktop>test.exe [DEBUG] [+] Detected Version: 10.0 [DEBUG] [+] Reloading: C:\Windows\System32\kernel32.dll [DEBUG] [+] Reloading: C:\Windows\System32\kernelbase.dll [DEBUG] [+] Reloading: C:\Windows\System32\ntdll.dll [DEBUG] [+] EDR removed [DEBUG] [] Create a Pointer on stack [DEBUG] [] Loading shellcode into a string [DEBUG] [] Copy Pointer's attributes [DEBUG] [] Overwriten Pointer to point to shellcode String Exception 0xc0000005 0x0 0xffffffffffffffff 0x7ffcdc61d34d PC=0x7ffcdc61d34d

runtime: unknown pc 0x7ffcdc61d34d stack: frame={sp:0xc00006d2a8, fp:0x0} stack=[0xc00006c000,0xc00006e000) 000000c00006d1a8: 0000000000000200 0000000000000008 000000c00006d1b8: 0000000000000000 0000000000000110 000000c00006d1c8: 0000000000000100 0000000000000002 000000c00006d1d8: 0000000000a30000 000000c00006d2a1 000000c00006d1e8: 0000000000000011 00007ffcef6fb434 000000c00006d1f8: 0000000000140000 0000000000000000 000000c00006d208: 00007ffcdc687420 0000000000000002 000000c00006d218: 0000000000000001 0000000000a3e4d0 000000c00006d228: 0000000000000002 00007ffcef6cabec 000000c00006d238: 000000c000000000 0000000000000000 000000c00006d248: 0000000000000000 0000000000a3e490 000000c00006d258: 000000c00006d300 00007ffcef6caa97 000000c00006d268: 0000000000a3e490 00007ffcef713c70 000000c00006d278: 0000000000a3e490 0000001700000002 000000c00006d288: 000000000000018c 00007ffcdc687420 000000c00006d298: 000000a000000000 0000000000000000 000000c00006d2a8: <0000af6126a8b566 0000000000000000 000000c00006d2b8: 0000000000000000 00007ffcec65eced 000000c00006d2c8: 00000000000003f0 0000000000000000 000000c00006d2d8: 00007ffcdc687420 00007ffcef826448 000000c00006d2e8: 0000000000000000 00007ffcec65ec4b 000000c00006d2f8: 0000000000a3e490 0000af6126a8b576 000000c00006d308: 00007ffcdc687420 00007ffcdc5d7c01 000000c00006d318: 0000000000000190 000000000000001d 000000c00006d328: 000000c00006d360 0000000000000004 000000c00006d338: 000000c00006d368 0000000000000000 000000c00006d348: 000000c00006d3d8 00007ffcdc5adbd0 000000c00006d358: 0000000000000000 0000000000000000 000000c00006d368: 0000000000000000 00000000ef6ca3bf 000000c00006d378: 0000000000000000 0000000000000000 000000c00006d388: 000000c00006d3e1 00007ffcdc6118c1 000000c00006d398: 0000000000000000 0000000000000190 runtime: unknown pc 0x7ffcdc61d34d stack: frame={sp:0xc00006d2a8, fp:0x0} stack=[0xc00006c000,0xc00006e000) 000000c00006d1a8: 0000000000000200 0000000000000008 000000c00006d1b8: 0000000000000000 0000000000000110 000000c00006d1c8: 0000000000000100 0000000000000002 000000c00006d1d8: 0000000000a30000 000000c00006d2a1 000000c00006d1e8: 0000000000000011 00007ffcef6fb434 000000c00006d1f8: 0000000000140000 0000000000000000 000000c00006d208: 00007ffcdc687420 0000000000000002 000000c00006d218: 0000000000000001 0000000000a3e4d0 000000c00006d228: 0000000000000002 00007ffcef6cabec 000000c00006d238: 000000c000000000 0000000000000000 000000c00006d248: 0000000000000000 0000000000a3e490 000000c00006d258: 000000c00006d300 00007ffcef6caa97 000000c00006d268: 0000000000a3e490 00007ffcef713c70 000000c00006d278: 0000000000a3e490 0000001700000002 000000c00006d288: 000000000000018c 00007ffcdc687420 000000c00006d298: 000000a000000000 0000000000000000 000000c00006d2a8: <0000af6126a8b566 0000000000000000 000000c00006d2b8: 0000000000000000 00007ffcec65eced 000000c00006d2c8: 00000000000003f0 0000000000000000 000000c00006d2d8: 00007ffcdc687420 00007ffcef826448 000000c00006d2e8: 0000000000000000 00007ffcec65ec4b 000000c00006d2f8: 0000000000a3e490 0000af6126a8b576 000000c00006d308: 00007ffcdc687420 00007ffcdc5d7c01 000000c00006d318: 0000000000000190 000000000000001d 000000c00006d328: 000000c00006d360 0000000000000004 000000c00006d338: 000000c00006d368 0000000000000000 000000c00006d348: 000000c00006d3d8 00007ffcdc5adbd0 000000c00006d358: 0000000000000000 0000000000000000 000000c00006d368: 0000000000000000 00000000ef6ca3bf 000000c00006d378: 0000000000000000 0000000000000000 000000c00006d388: 000000c00006d3e1 00007ffcdc6118c1 000000c00006d398: 0000000000000000 0000000000000190 rax 0x7ffcdca04800 rbx 0x0 rcx 0x190 rdi 0xc00006d398 rsi 0x0 rbp 0xc00006d388 rsp 0xc00006d2a8 r8 0xc00006d360 r9 0x4 r10 0x0 r11 0x246 r12 0x7ffcdc9bb558 r13 0x1 r14 0x1 r15 0x0 rip 0x7ffcdc61d34d rflags 0x10212 cs 0x33 fs 0x53 gs 0x2b`

Tylous commented 3 years ago

Testing fix currently syscall.Syscall(uintptr(unsafe.Pointer(&shellcode[0])),0, 0, 0, 0,). If it works on all versions of go, I will push this to the main repo. Temp fix to change the default loader to control

Tylous commented 3 years ago

Addressed in Patch 1.4