diff --git a/.DS_Store b/.DS_Store new file mode 100644 index 0000000..ec062cd Binary files /dev/null and b/.DS_Store differ diff --git a/Mangle.go b/Mangle.go index f6c424e..70b46ee 100644 --- a/Mangle.go +++ b/Mangle.go @@ -1,12 +1,16 @@ package main import ( + "bufio" "bytes" + "crypto/rand" + "encoding/binary" "flag" "fmt" "io/ioutil" "log" - "math/rand" + "math/big" + mrand "math/rand" "strconv" "strings" "time" @@ -17,8 +21,8 @@ import ( var hex = "abcef12345678890" func GenerateNumer(min, max int) string { - rand.Seed(time.Now().UnixNano()) - num := rand.Intn(max-min) + min + mrand.Seed(time.Now().UnixNano()) + num := mrand.Intn(max-min) + min n := num s := strconv.Itoa(n) return s @@ -28,7 +32,7 @@ func GenerateNumer(min, max int) string { func RandStringBytes(n int) string { b := make([]byte, n) for i := range b { - b[i] = hex[rand.Intn(len(hex))] + b[i] = hex[mrand.Intn(len(hex))] } return string(b) @@ -90,6 +94,7 @@ func main() { InputFileData = GoEditor(InputFileData) } + fmt.Println("[!] Writing to new file " + opt.outFile) ioutil.WriteFile(opt.outFile, InputFileData, 0777) } @@ -113,6 +118,7 @@ func GoEditor(buff []byte) []byte { val := RandStringBytes(len(stringnum[i])) mydata = strings.ReplaceAll(string(mydata), stringnum[i], val) } + fmt.Println("[*] Stripped out golang strings") return []byte(mydata) } @@ -120,29 +126,109 @@ func GoEditor(buff []byte) []byte { func Padding(buff []byte, size int) []byte { str1 := "0" res1 := strings.Repeat(str1, (size * 1024 * 1024)) - sum := string(buff) + res1 - mydata := []byte(sum) - return mydata + sourceBytes, err := pe.NewFile(bytes.NewReader(buff)) + if err != nil { + log.Panic("Error Reading Inputed File") + } + //Shoutout to Binject for their project binjection where I borrowed some of the code below. + var sectionAlignment, fileAlignment, scAddr uint32 + var imageBase uint64 + var shellcode []byte + lastSection := sourceBytes.Sections[sourceBytes.NumberOfSections-1] + switch file := (sourceBytes.OptionalHeader).(type) { + case *pe.OptionalHeader32: + imageBase = uint64(file.ImageBase) + sectionAlignment = file.SectionAlignment + fileAlignment = file.FileAlignment + scAddr = align(lastSection.Size, fileAlignment, lastSection.Offset) + break + case *pe.OptionalHeader64: + imageBase = file.ImageBase + sectionAlignment = file.SectionAlignment + fileAlignment = file.FileAlignment + scAddr = align(lastSection.Size, fileAlignment, lastSection.Offset) + break + } + + buf := bytes.NewBuffer([]byte(res1)) + w := bufio.NewWriter(buf) + binary.Write(w, binary.LittleEndian, imageBase) + w.Flush() + shellcode = buf.Bytes() + + shellcodeLen := len(shellcode) + newsection := new(pe.Section) + newsection.Name = "." + RandomString(5) + o := []byte(newsection.Name) + newsection.OriginalName = [8]byte{o[0], o[1], o[2], o[3], o[4], o[5], 0, 0} + newsection.VirtualSize = uint32(shellcodeLen) + newsection.VirtualAddress = align(lastSection.VirtualSize, sectionAlignment, lastSection.VirtualAddress) + newsection.Size = align(uint32(shellcodeLen), fileAlignment, 0) + newsection.Offset = align(lastSection.Size, fileAlignment, lastSection.Offset) + newsection.Characteristics = pe.IMAGE_SCN_CNT_CODE | pe.IMAGE_SCN_MEM_EXECUTE | pe.IMAGE_SCN_MEM_READ + sourceBytes.InsertionAddr = scAddr + sourceBytes.InsertionBytes = shellcode + + switch file := (sourceBytes.OptionalHeader).(type) { + case *pe.OptionalHeader32: + v := newsection.VirtualSize + if v == 0 { + v = newsection.Size + } + file.SizeOfImage = align(v, sectionAlignment, newsection.VirtualAddress) + file.CheckSum = 0 + break + case *pe.OptionalHeader64: + v := newsection.VirtualSize + if v == 0 { + v = newsection.Size + } + file.SizeOfImage = align(v, sectionAlignment, newsection.VirtualAddress) + file.CheckSum = 0 + break + } + sourceBytes.FileHeader.NumberOfSections++ + sourceBytes.Sections = append(sourceBytes.Sections, newsection) + Bytes, _ := sourceBytes.Bytes() + + fmt.Println("[*] Padding has been added to increase size") + return Bytes } func Stealer(InputFileData, FiletoCopy []byte) []byte { signedFileReader := bytes.NewReader(FiletoCopy) - signedPEFile, err := pe.NewFile(signedFileReader) + signedsourceBytes, err := pe.NewFile(signedFileReader) if err != nil { } targetFileReader := bytes.NewReader(InputFileData) - targetPEFile, err := pe.NewFile(targetFileReader) + targetsourceBytes, err := pe.NewFile(targetFileReader) if err != nil { } - targetPEFile.CertificateTable = signedPEFile.CertificateTable - Data, err := targetPEFile.Bytes() + targetsourceBytes.CertificateTable = signedsourceBytes.CertificateTable + Data, err := targetsourceBytes.Bytes() if err != nil { } - + fmt.Println("[*] Cloned certificate values") return Data } + +func align(size, align, addr uint32) uint32 { + if 0 == (size % align) { + return addr + size + } + return addr + (size/align+1)*align +} + +func RandomString(len int) string { + bytes := make([]byte, len) + for i := 0; i < len; i++ { + r, _ := rand.Int(rand.Reader, big.NewInt(25)) + bytes[i] = 97 + byte(r.Int64()) //a=97 + } + return string(bytes) +}