SLAE 7: Creating your own crypter using golang

  1package main
  2
  3import (
  4    "crypto/aes"
  5    "crypto/cipher"
  6    "crypto/rand"
  7    "crypto/sha256"
  8    "encoding/hex"
  9    "flag"
 10    "fmt"
 11    "io"
 12    "os"
 13    "os/user"
 14    "path/filepath"
 15)
 16
 17type cliOptions struct {
 18    encrypt   bool
 19    decrypt   bool
 20    shellcode string
 21}
 22
 23func processArgs() cliOptions {
 24    opts := cliOptions{}
 25    flag.BoolVar(&opts.decrypt, "decrypt", false, "Decrypt your shellcode")
 26    flag.BoolVar(&opts.decrypt, "d", false, "Decrypt your shellcode")
 27    flag.BoolVar(&opts.encrypt, "encrypt", false, "Encrypt your shellcode")
 28    flag.BoolVar(&opts.encrypt, "e", false, "Encrypt your shellcode")
 29    flag.StringVar(&opts.shellcode, "shellcode", "", "Your shellcode")
 30    flag.StringVar(&opts.shellcode, "s", "", "Your shellcode")
 31    flag.Parse()
 32
 33    return opts
 34}
 35
 36func init() {
 37    flag.Usage = func() {
 38        h := "\nEncrypt your shellcode! Very nice! Made by @dubs3c.\n\n"
 39
 40        h += "Usage:\n"
 41        h += "  cyrptoBoot [shellcode] [options]\n\n"
 42
 43        h += "Options:\n"
 44        h += "  -e,  --encrypt      Encrypt shellcode\n"
 45        h += "  -d,  --decrypt      Decrypt shellcode\n"
 46        h += "  -s,  --shellcode    Shellcode\n"
 47        h += "  -v,  --version      Show version\n"
 48
 49        h += "\nExamples:\n"
 50        h += "  cryptoBoot -e -s \"<shellcode>\"\n"
 51        h += "  cryptoBoot -d -s \"<shellcode>\"\n"
 52
 53        fmt.Fprintf(os.Stderr, h)
 54    }
 55}
 56
 57func encrypt(shellcode string, envKey []byte) (encryptedShellcode []byte, err error) {
 58    plaintext := []byte(shellcode)
 59
 60    block, err := aes.NewCipher(envKey)
 61    if err != nil {
 62        panic(err.Error())
 63    }
 64
 65    // Never use more than 2^32 random nonces with a given key because of the risk of a repeat.
 66    nonce := make([]byte, 12)
 67    if _, err := io.ReadFull(rand.Reader, nonce); err != nil {
 68        panic(err.Error())
 69    }
 70
 71    aesgcm, err := cipher.NewGCM(block)
 72    if err != nil {
 73        panic(err.Error())
 74    }
 75
 76    ciphertext := aesgcm.Seal(nil, nonce, plaintext, nil)
 77    ciphertextWithNonce := append(nonce, ciphertext...)
 78    encodedCiphertext := make([]byte, hex.EncodedLen(len(ciphertextWithNonce)))
 79    hex.Encode(encodedCiphertext, ciphertextWithNonce)
 80    return encodedCiphertext, nil
 81}
 82
 83func decrypt(ciphertext string, envKey []byte) (plaintext []byte, err error) {
 84    ciphertxt, _ := hex.DecodeString(ciphertext[24:])
 85    nonce, _ := hex.DecodeString(ciphertext[:24])
 86
 87    block, err := aes.NewCipher(envKey)
 88    if err != nil {
 89        return []byte{}, err
 90    }
 91
 92    aesgcm, err := cipher.NewGCM(block)
 93    if err != nil {
 94        return []byte{}, err
 95    }
 96
 97    plaintxt, err := aesgcm.Open(nil, nonce, ciphertxt, nil)
 98    if err != nil {
 99        return []byte{}, err
100    }
101
102    return plaintxt, nil
103}
104
105func main() {
106
107    if len(os.Args) <= 1 {
108        flag.Usage()
109        os.Exit(0)
110    }
111
112    opts := processArgs()
113
114    currentUser := &user.User{}
115    currentUser, err := user.Current()
116    envPath := "/etc/vmware-tools/scripts/vmware/network"
117    envKey := sha256.Sum256([]byte(envPath + currentUser.Username))
118
119    if opts.encrypt {
120        if opts.shellcode == "" {
121            fmt.Println("[-] Please specify your shellcode")
122            os.Exit(1)
123        }
124
125        ciphertext, err := encrypt(opts.shellcode, envKey[:])
126        if err != nil {
127            fmt.Println("[-] Something went wrong encrypting your shellcode. Error: ", err)
128            os.Exit(1)
129        }
130
131        fmt.Printf("[+] Your encrypted shellcode: %s\n", ciphertext)
132        return
133    }
134
135    if opts.decrypt {
136
137        if opts.shellcode == "" {
138            fmt.Println("[-] Please specify your encrypted shellcode")
139            os.Exit(1)
140        }
141
142        encryptedShellcode := opts.shellcode
143
144        err = filepath.Walk("/etc/", func(path string, info os.FileInfo, err error) error {
145            envKey := sha256.Sum256([]byte(path + currentUser.Username))
146            plaintext, err := decrypt(encryptedShellcode, envKey[:])
147            if err != nil {
148                // Disregard errors
149                return nil
150            } else {
151                fmt.Printf("[+] Decrypted shellcode: %s\n", plaintext)
152            }
153            return nil
154        })
155
156        if err != nil {
157            fmt.Printf("error walking the path %q: %v\n", "/etc/", err)
158            return
159        }
160    }
161}