myph

~ shellcode loader for your evasion needs
git clone https://github.com/matro7sh/myph.git
crypting.go (5166B)
      1 package tools
      2 
      3 import (
      4 	"crypto/aes"
      5 	"crypto/cipher"
      6 	"crypto/rand"
      7 	"errors"
      8 	"fmt"
      9 	"io"
     10 
     11 	"golang.org/x/crypto/blowfish"
     12 	"golang.org/x/crypto/chacha20poly1305"
     13 )
     14 
     15 func GetChacha20Template() string {
     16 	return fmt.Sprintf(`
     17 package main
     18 
     19 import (
     20     "golang.org/x/crypto/chacha20poly1305"
     21 
     22     "errors"
     23 )
     24 
     25 func Decrypt(toDecrypt []byte, key []byte) ([]byte, error) {
     26     enc, err := chacha20poly1305.NewX(key)
     27     if err != nil {
     28         return []byte{}, err
     29     }
     30 
     31     nonceSize := enc.NonceSize()
     32 	if len(toDecrypt) < nonceSize {
     33 		return nil, errors.New("Ciphertext too short")
     34 	}
     35 
     36 	nonce, ciphertext := toDecrypt[:nonceSize], toDecrypt[nonceSize:]
     37     return enc.Open(nil, nonce, ciphertext, nil)
     38 }
     39     `)
     40 }
     41 
     42 func GetBlowfishTemplate() string {
     43 	return fmt.Sprintf(`
     44 package main
     45 
     46 import (
     47     "golang.org/x/crypto/blowfish"
     48 
     49     "crypto/cipher"
     50 )
     51 
     52 func Decrypt(toDecrypt []byte, key []byte) ([]byte, error) {
     53     dcipher, err := blowfish.NewCipher(key)
     54     if err != nil {
     55         return []byte{}, err
     56     }
     57 
     58     div := toDecrypt[:blowfish.BlockSize]
     59     decrypted := toDecrypt[blowfish.BlockSize:]
     60     dcbc := cipher.NewCBCDecrypter(dcipher, div)
     61     dcbc.CryptBlocks(decrypted, decrypted)
     62 
     63     return decrypted, nil
     64 }
     65     `)
     66 }
     67 
     68 func GetAESTemplate() string {
     69 	return fmt.Sprintf(`
     70 package main
     71 
     72 import (
     73     "crypto/aes"
     74     "crypto/cipher"
     75     "errors"
     76 )
     77 
     78 func Decrypt(encrypted []byte, key []byte) ([]byte, error) {
     79     c, err := aes.NewCipher(key)
     80     if err != nil {
     81         return nil, err
     82     }
     83 
     84     gcm, err := cipher.NewGCM(c)
     85     if err != nil {
     86         return nil, err
     87     }
     88 
     89     nonceSize := gcm.NonceSize()
     90     if len(encrypted) < nonceSize {
     91         return nil, errors.New("ciphertext too short")
     92     }
     93 
     94     nonce, ciphertext := encrypted[:nonceSize], encrypted[nonceSize:]
     95     return gcm.Open(nil, nonce, ciphertext, nil)
     96 }
     97     `)
     98 }
     99 
    100 func GetXORTemplate() string {
    101 	return fmt.Sprintf(`
    102 package main
    103 
    104 func Decrypt(toDecrypt []byte, key []byte) ([]byte, error) {
    105     encrypted := make([]byte, len(toDecrypt))
    106     keyLen := len(key)
    107 
    108     for i, b := range toDecrypt {
    109         encrypted[i] = b ^ key[i %% keyLen]
    110     }
    111     return encrypted, nil
    112 }
    113     `)
    114 }
    115 
    116 func DecryptChacha20(toDecrypt []byte, key []byte) ([]byte, error) {
    117 	enc, err := chacha20poly1305.NewX(key)
    118 	if err != nil {
    119 		return []byte{}, err
    120 	}
    121 
    122 	nonceSize := enc.NonceSize()
    123 	if len(toDecrypt) < nonceSize {
    124 		return nil, errors.New("Ciphertext too short")
    125 	}
    126 
    127 	nonce, ciphertext := toDecrypt[:nonceSize], toDecrypt[nonceSize:]
    128 	return enc.Open(nil, nonce, ciphertext, nil)
    129 }
    130 
    131 func EncryptChacha20(toCrypt []byte, key []byte) ([]byte, error) {
    132 
    133 	enc, err := chacha20poly1305.NewX(key)
    134 	if err != nil {
    135 		return []byte{}, err
    136 	}
    137 
    138 	nonce := make([]byte, enc.NonceSize())
    139 	_, err = io.ReadFull(rand.Reader, nonce)
    140 	if err != nil {
    141 		return []byte{}, err
    142 	}
    143 
    144 	return enc.Seal(nonce, nonce, toCrypt, nil), nil
    145 }
    146 
    147 func EncryptBlowfish(toCrypt []byte, key []byte) ([]byte, error) {
    148 
    149 	/*
    150 	   let's add the required padding :)~
    151 	   source: https://stackoverflow.com/a/46747195
    152 	*/
    153 
    154 	modulus := len(toCrypt) % blowfish.BlockSize
    155 	if modulus != 0 {
    156 		padlen := blowfish.BlockSize - modulus
    157 		for i := 0; i < padlen; i++ {
    158 			toCrypt = append(toCrypt, 0)
    159 		}
    160 	}
    161 
    162 	ecipher, err := blowfish.NewCipher(key)
    163 	if err != nil {
    164 		return []byte{}, err
    165 	}
    166 
    167 	ciphertext := make([]byte, blowfish.BlockSize+len(toCrypt))
    168 	eiv := ciphertext[:blowfish.BlockSize]
    169 	ecbc := cipher.NewCBCEncrypter(ecipher, eiv)
    170 	ecbc.CryptBlocks(ciphertext[blowfish.BlockSize:], toCrypt)
    171 
    172 	return ciphertext, nil
    173 }
    174 
    175 func DecryptBlowfish(toDecrypt []byte, key []byte) ([]byte, error) {
    176 	dcipher, err := blowfish.NewCipher(key)
    177 	if err != nil {
    178 		return []byte{}, err
    179 	}
    180 
    181 	div := toDecrypt[:blowfish.BlockSize]
    182 	decrypted := toDecrypt[blowfish.BlockSize:]
    183 	dcbc := cipher.NewCBCDecrypter(dcipher, div)
    184 	dcbc.CryptBlocks(decrypted, decrypted)
    185 
    186 	return decrypted, nil
    187 }
    188 
    189 func EncryptXOR(toEncrypt []byte, key []byte) ([]byte, error) {
    190 	encrypted := make([]byte, len(toEncrypt))
    191 	keyLen := len(key)
    192 
    193 	for i, b := range toEncrypt {
    194 		encrypted[i] = b ^ key[i%keyLen]
    195 	}
    196 	return encrypted, nil
    197 }
    198 
    199 func DecryptXOR(toDecrypt []byte, key []byte) ([]byte, error) {
    200 	encrypted := make([]byte, len(toDecrypt))
    201 	keyLen := len(key)
    202 
    203 	for i, b := range toDecrypt {
    204 		encrypted[i] = b ^ key[i%keyLen]
    205 	}
    206 	return encrypted, nil
    207 }
    208 
    209 func EncryptAES(toEncrypt []byte, key []byte) ([]byte, error) {
    210 	c, err := aes.NewCipher(key)
    211 	if err != nil {
    212 		return nil, err
    213 	}
    214 
    215 	gcm, err := cipher.NewGCM(c)
    216 	if err != nil {
    217 		return nil, err
    218 	}
    219 
    220 	nonce := make([]byte, gcm.NonceSize())
    221 	if _, err = io.ReadFull(rand.Reader, nonce); err != nil {
    222 		return nil, err
    223 	}
    224 
    225 	return gcm.Seal(nonce, nonce, toEncrypt, nil), nil
    226 }
    227 
    228 func DecryptAES(encrypted []byte, key []byte) ([]byte, error) {
    229 	c, err := aes.NewCipher(key)
    230 	if err != nil {
    231 		return nil, err
    232 	}
    233 
    234 	gcm, err := cipher.NewGCM(c)
    235 	if err != nil {
    236 		return nil, err
    237 	}
    238 
    239 	nonceSize := gcm.NonceSize()
    240 	if len(encrypted) < nonceSize {
    241 		return nil, errors.New("ciphertext too short")
    242 	}
    243 
    244 	nonce, ciphertext := encrypted[:nonceSize], encrypted[nonceSize:]
    245 	return gcm.Open(nil, nonce, ciphertext, nil)
    246 }