OffensiveGo - Golang weaponization for red teamers.

项目说明

OffensiveGo - Golang Weaponization for red teamers.

!image

This repo is made by , & and contains some examples of offensi & utilities rewrote in Golang that can be used in a red team engagement.

Table of Content

Previous work

About Golang

- Installation
- Workspace Setup
- Compilation
- Assembly in Go
- Obfuscate Go Builds
- Golang Binary

Examples

Interesting Tools in Golang

Credits

️💾 Previous works

These repo inspires us to make OffensiveGo

Offensi : this project contains a bunch of examples made in Rust.

OffensiveNim : this one contains examples written in Nim.

Offensi : A Collection of Offensive C# Tooling.

OffensiveDLR : Toolbox containing research notes & PoC code for weaponizing .NET's DLR.

OffensiveVBA : This repo covers some code execution and A methods for Macros in Office documents.

OffensiveZig : Some attempts at using Zig in penetration testing.

📝 About Golang

Simpler syntax: Go's syntax is simpler and easier to learn.

Garbage collection: Go uses garbage collection, which makes memory management easier for de.

Cross-platform support: Go has excellent cross-platform support and can be compiled to run on a wide range of platforms, including Windows, Linux, and macOS. Rust also has good cross-platform support, but its compilation process can be more complex.

Goroutine: Goroutines are lightweight threads of execution that enable concurrent programming in Go, making it easy to write efficient, safe, and scalable concurrent programs, allowing for non-blocking concurrent execution and communication .

OPSEC Consideration & Caveat of Golang

Go binaries generally have no installation dependencies, compiler statically links Go runtime and needed packages. Static linking results in larger binaries. 1.9 MB for "Hello World" compared to 54 KB in C.

🏗 Workspace Setup

create a go.mod file in your project directory, which will be used to manage dependencies :

ensure that all your project's dependencies are up to date :

Compilation

Use go build file.go for compilation.

Omit debug symbols and strip the symbol table. it can also reduce binary size by about 30% :

Hide console, to avoid Go program displaying console windows on execution :

Assembly in Go

The assembly language used with Go is based on Plan9 (P9) and is a high-ledent language that includes mnemonics like CALL and RET, as well as higher-le like loops and conditionals, which are implemented using lower-le instructions by the assembler.

That's how you declare function :

!image
- NOSPLIT : Don't insert the preamble to check if the stack must be split. The frame for the routine, plus anything it calls, must fit in the spare space remaining in the current stack segment. Used to protect routines such as the stack splitting code itself, which can impro.
- NOFRAME : skip the generation of a function prologue and epilogue, even if this is not a leaf function, which can also impro by reducing the o of setting up and tearing down the stack frame for each call.

> Note : It can be useful to use Assembly in Go for your loaders if you want to build direct / indirect syscall stub.

Obfuscate Go Builds

you can obfuscate Go builds using garble to replace strings and many other indcators with base64 encoding and remo intformations if necessary :

Golang Binary

The symtab (symbol table) section contains symbol table information to map program addresses to their corresponding function and names. The symtab section in a Golang binary is generated by the Go linker.

!image

If your implant use net/http lib with the default http headers, GO will put Go-http-client/1.1 has the user-agent.

!image

Examples

| File | Description |
|-------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------|
| Process Injection - APC | Execute a shellcode with NtQueueApcThread |
| Process Injection - CreateThread | Execute a shellcode with NtCreateThreadEx and CreateThread | | | | |
| AMSI Patching | bypass AMSI by patching in memory AmsiScanBuffer |
| ETW Patching | bypass ETW, by patching in memory with ret on NtTraceControl |
| Network | TCP, HTTP, and named pipes servers and clients for different communication channels. |
| WMI Query | List the AV/EDR solution with a wmi query |
| sRDI | Convert DLL files to position independent shellcode |
| Cryptography | Encryption algorithms for usage. Contains AES, RC4, chacha20 and xor. |
| Self Remove | Self remove a executable. Golang implementation of delete-self-poc |
| Process Dump | Dump any process with MiniDumpWriteDump. In this example, it dumps LSASS |
| Dllmain | DllMain() entrypoint in Golang from this. Can be used for dll hijacking. |
| Token Manipulation | Play with windows token. List all the token, ImpersonateLoggedOnUser and CreateProcessWithToken. |
| Sandbox detection/e| Sandbox detection and e techniques |
| Callback Injection| Callback shellcode injection using GrayStringA, EnumFonts and more... |
| Instrumentation Callback| Disable Instrumentation Callback on your process to reduce any potential direct syscall detection |

> Note : The misc folder contains some scripts like con_format.sh that can be written in other languages but but still relates to the Golang language.

> Note : More Examples will be added in the future :D

🔎 Interesting Tools in Golang

Geacon : implementation of CobaltStrike's Beacon in Go.

Acheron : Indirect syscalls for AV/EDR e in Go assembly.

Sliver : An Ad Emulation Framework fully written in Golang with ad e capabilities.

Merlin : cross-platform post-exploitation HTTP/2 Command & Control server and agent

BananaPhone : An easy to use GO of Hells gate with automatic SSN parsing.

SourcePoint : C2 profile generator for Cobalt Strike command and control servers designed to ensure e by reducing the Indicators of Compromise IoCs.

ScareCrow : Payload creation framework designed around EDR bypass such as AMSI & ETW Bypass, Encryption, Stealth Process Injections, ect.

Hooka : Implant drop-in with multiple features.

RedGuard : a C2 front flow control tool, Can avoid Blue Teams, AVs, EDRs check.

Freeze : Payload toolkit for bypassing EDRs using suspended processes, direct syscalls, and alternati methods.

Mangle : A tool that manipulates aspects of compiled executables (.exe or DLL) to avoid detection from EDRs.

Dent : A framework for creating COM-based bypasses utilizing in Microsoft's WDAPT sensors.

Ivy : Payload creation framework for the execution of arbitrary VBA (macro) source code directly in memory. Ivy’s loader does this by utilizing programmatical access in the en to load, decrypt and execute shellcode.

I would also mention the timwhitez's github that contains many re-implementations in Golang.

🎖 Credits

-

-

-

- For the AES implementation

- For the Chacha20 implementation

- For the RC4 implementation

项目信息

开发语言：Go

Star 数：526

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Golang weaponization for red teamers.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。