v1.2

Mangle.go

@@ -1,12 +1,16 @@
 package main
 
 import (
+	"bufio"
 	"bytes"
+	"crypto/rand"
+	"encoding/binary"
 	"flag"
 	"fmt"
 	"io/ioutil"
 	"log"
-	"math/rand"
+	"math/big"
+	mrand "math/rand"
 	"strconv"
 	"strings"
 	"time"
@@ -17,8 +21,8 @@ import (
 var hex = "abcef12345678890"
 
 func GenerateNumer(min, max int) string {
-	rand.Seed(time.Now().UnixNano())
-	num := rand.Intn(max-min) + min
+	mrand.Seed(time.Now().UnixNano())
+	num := mrand.Intn(max-min) + min
 	n := num
 	s := strconv.Itoa(n)
 	return s
@@ -28,7 +32,7 @@ func GenerateNumer(min, max int) string {
 func RandStringBytes(n int) string {
 	b := make([]byte, n)
 	for i := range b {
-		b[i] = hex[rand.Intn(len(hex))]
+		b[i] = hex[mrand.Intn(len(hex))]
 
 	}
 	return string(b)
@@ -90,6 +94,7 @@ func main() {
 		InputFileData = GoEditor(InputFileData)
 	}
 
+	fmt.Println("[!] Writing to new file " + opt.outFile)
 	ioutil.WriteFile(opt.outFile, InputFileData, 0777)
 
 }
@@ -113,6 +118,7 @@ func GoEditor(buff []byte) []byte {
 		val := RandStringBytes(len(stringnum[i]))
 		mydata = strings.ReplaceAll(string(mydata), stringnum[i], val)
 	}
+	fmt.Println("[*] Stripped out golang strings")
 	return []byte(mydata)
 
 }
@@ -120,29 +126,109 @@ func GoEditor(buff []byte) []byte {
 func Padding(buff []byte, size int) []byte {
 	str1 := "0"
 	res1 := strings.Repeat(str1, (size * 1024 * 1024))
-	sum := string(buff) + res1
-	mydata := []byte(sum)
-	return mydata
+	sourceBytes, err := pe.NewFile(bytes.NewReader(buff))
+	if err != nil {
+		log.Panic("Error Reading Inputed File")
+	}
+	//Shoutout to Binject for their project binjection where I borrowed some of the code below.
+	var sectionAlignment, fileAlignment, scAddr uint32
+	var imageBase uint64
+	var shellcode []byte
+	lastSection := sourceBytes.Sections[sourceBytes.NumberOfSections-1]
+	switch file := (sourceBytes.OptionalHeader).(type) {
+	case *pe.OptionalHeader32:
+		imageBase = uint64(file.ImageBase)
+		sectionAlignment = file.SectionAlignment
+		fileAlignment = file.FileAlignment
+		scAddr = align(lastSection.Size, fileAlignment, lastSection.Offset)
+		break
+	case *pe.OptionalHeader64:
+		imageBase = file.ImageBase
+		sectionAlignment = file.SectionAlignment
+		fileAlignment = file.FileAlignment
+		scAddr = align(lastSection.Size, fileAlignment, lastSection.Offset)
+		break
+	}
+
+	buf := bytes.NewBuffer([]byte(res1))
+	w := bufio.NewWriter(buf)
+	binary.Write(w, binary.LittleEndian, imageBase)
+	w.Flush()
+	shellcode = buf.Bytes()
+
+	shellcodeLen := len(shellcode)
+	newsection := new(pe.Section)
+	newsection.Name = "." + RandomString(5)
+	o := []byte(newsection.Name)
+	newsection.OriginalName = [8]byte{o[0], o[1], o[2], o[3], o[4], o[5], 0, 0}
+	newsection.VirtualSize = uint32(shellcodeLen)
+	newsection.VirtualAddress = align(lastSection.VirtualSize, sectionAlignment, lastSection.VirtualAddress)
+	newsection.Size = align(uint32(shellcodeLen), fileAlignment, 0)
+	newsection.Offset = align(lastSection.Size, fileAlignment, lastSection.Offset)
+	newsection.Characteristics = pe.IMAGE_SCN_CNT_CODE | pe.IMAGE_SCN_MEM_EXECUTE | pe.IMAGE_SCN_MEM_READ
+	sourceBytes.InsertionAddr = scAddr
+	sourceBytes.InsertionBytes = shellcode
+
+	switch file := (sourceBytes.OptionalHeader).(type) {
+	case *pe.OptionalHeader32:
+		v := newsection.VirtualSize
+		if v == 0 {
+			v = newsection.Size
+		}
+		file.SizeOfImage = align(v, sectionAlignment, newsection.VirtualAddress)
+		file.CheckSum = 0
+		break
+	case *pe.OptionalHeader64:
+		v := newsection.VirtualSize
+		if v == 0 {
+			v = newsection.Size
+		}
+		file.SizeOfImage = align(v, sectionAlignment, newsection.VirtualAddress)
+		file.CheckSum = 0
+		break
+	}
+	sourceBytes.FileHeader.NumberOfSections++
+	sourceBytes.Sections = append(sourceBytes.Sections, newsection)
+	Bytes, _ := sourceBytes.Bytes()
+
+	fmt.Println("[*] Padding has been added to increase size")
+	return Bytes
 
 }
 
 func Stealer(InputFileData, FiletoCopy []byte) []byte {
 	signedFileReader := bytes.NewReader(FiletoCopy)
-	signedPEFile, err := pe.NewFile(signedFileReader)
+	signedsourceBytes, err := pe.NewFile(signedFileReader)
 	if err != nil {
 
 	}
 
 	targetFileReader := bytes.NewReader(InputFileData)
-	targetPEFile, err := pe.NewFile(targetFileReader)
+	targetsourceBytes, err := pe.NewFile(targetFileReader)
 	if err != nil {
 
 	}
 
-	targetPEFile.CertificateTable = signedPEFile.CertificateTable
-	Data, err := targetPEFile.Bytes()
+	targetsourceBytes.CertificateTable = signedsourceBytes.CertificateTable
+	Data, err := targetsourceBytes.Bytes()
 	if err != nil {
 	}
-
+	fmt.Println("[*] Cloned certificate values")
 	return Data
 }
+
+func align(size, align, addr uint32) uint32 {
+	if 0 == (size % align) {
+		return addr + size
+	}
+	return addr + (size/align+1)*align
+}
+
+func RandomString(len int) string {
+	bytes := make([]byte, len)
+	for i := 0; i < len; i++ {
+		r, _ := rand.Int(rand.Reader, big.NewInt(25))
+		bytes[i] = 97 + byte(r.Int64()) //a=97
+	}
+	return string(bytes)
+}