GoRedOps - 🦫 | GoRedOps is a repository dedicated to gatheri

项目说明

GoRedOps

!GoRedOps Logo

GoRedOps is a collection of Golang projects designed specifically for red teamers and offensi operations. This repository provides tools and techniques essential for penetration testing, exploitation, and security research.

Table of Contents

About

Project Structure

Getting Started

Contributing

Project Structure

GoRedOps contains the following codes:

AntiDebugNOPACKAGE

- Anti-debugging techniques without packaging.

AntiDebugPackage

- Packaged anti-debugging techniques.

BatchfileDeobfuscator

- Tools for deobfuscating batch files.

CreateDLL

- Tools for creating dynamic-link libraries (DLLs).

crypto

- cryptographic algorithms (AES, ChaCha20, RC4, XOR).

EDR-XDR-A

- Tools for e and disabling EDR, XDR, and antivirus software.

ETWBypass

- Techniques for bypassing Event Tracing for Windows (ETW).

GoDLLInjector

- DLL injection techniques.

GoObfuscator

- Tools for obfuscating Go code.

injection_nati

- Native APC injection techniques.

injection_thread

- Thread injection techniques:
- createThread
- ntCreateThreadEx

instrumentation_callback

- Techniques in instrumentation callbacks.

LifetimeAMSIBypass

- Bypassing AMSI (Antimalware Scan Interface).

misc

- Miscellaneous scripts and tools.

network

- Networking tools:
- http (HTTP client and server)
- pipes (Named pipes client and server)
- tcp (TCP client and server)

ParentPIDSpoofing

- Techniques for spoofing parent process IDs.

PEParser

- Tools for parsing PE (Portable Executable) files.

process_dump

- Tools for dumping process memory.

ProtecProc

- Process protection techniques.

ProtectProcess

- Additional process protection techniques.

sandbox

- Techniques for detecting and e sandboxes.

self_remove

- Tools for self-removing malware.

srdi

- Tools for shellcode reflection and dynamic in.

token

- Token manipulation tools:
- impersonate
- list

wmi

- Tools for interacting with Windows Management Instrumentation (WMI).

APC Injection

- Exploits the Asynchronous Procedure Call (APC) technique to execute malicious code within target processes.

Early Bird APC Injection

- A of APC Injection focusing on executing code before the main process starts.

Local Mapping Injection

- Demonstrates malicious code injection mapping into local processes.

Local Payload Execution

- Addresses the direct execution of malicious payloads in a system's local en.

Payload Execution Fibers

- Demonstrates running shellcode using Fibers, a type of lightweight thread.

Payload Placement

- Shows how to store shellcode in the .text section of a process and execute it.

Process Injection (Shellcode)

- Exploits shellcode injection directly into running processes to control or execute malicious tasks.

Registry Shellcode

- Demonstrates writing and reading shellcode to/from the Windows Registry.

Remote Function Stomping Injection

- Exploits the substitution of functions in remote systems to carry out malicious acti.

Remote Mapping Injection

- Demonstrates malicious code injection mapping into remote processes.

Remote Thread Hijacking

- Focuses on hijacking threads in remote system processes to execute malicious code.

Threadless Injection

- Demonstrates threadless injection using Go & C, where shellcode is injected without creating a new thread.

RunPE (Run Portable Executable)

- Runs PE in Memory, PE = .exe.

Lifetime ETW - Amsi Bypass

- Patches Amsi and ETW forever in newly created powershell consoles.

Keylogger

- Logs keystrokes into a temp file.

Getting Started

To get started with any of the tools in this repository, na to the respecti directory and follow the instructions in the README.md file provided.

Prerequisites

Go programming language installed ( 1.20+)

Knowledge of Golang and offensi operations, so have a brain in nutshell.

Installation

Clone the repository, and Change Dir to your specified one:

Contributing

We welcome contributions to impro. If you have an idea for a new tool or an enhancement to an existing one, please fork the repository and submit a pull request.

How to contribute?

Steps to Contribute

Fork the repository.

Create a new branch for your feature or bug fix.

Implement your changes and commit them with descripti.

Push your changes to your fork.

Submit a pull request to the main repository.

License :

NoLicense (UnLicense)

Credits:

(30%)

License

This project is licensed under the MIT License. See the LICENSE file for details.

项目信息

开发语言：Go

Star 数：670

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕🦫 | GoRedOps is a repository dedicated to gathering and sharing advanced techniques and offensive malware for Red Team, with a specific focus on the Go programming language, all is made for educational purpoeses only.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。