最近BRC4更新到了0.6版本，其中添加了Debugging features
功能，功能包括list_modules列出当前进程或其他进程加载的模块 、list_exports查看某模块的导出函数 、Memory hunting查看内存中的RWX区域(这也是一种shellcode的加载方式)
本来作者的意思是用此类方法来进行EDR/AV的检测，但总感觉多此一举了，这里给出各个功能的实现代码，有兴趣的xd可以看看。
list_modules
这个实现比较简单，C#的ProcessModule中有相关内容
if (args.Length != 0) {var pid = Convert.ToInt32(args[0]);Process targetProcess = Process.GetProcessById(pid);ProcessModule myProcessModule;ProcessModuleCollection myProcessModuleCollection = targetProcess.Modules;for (int i = 0; i < myProcessModuleCollection.Count; i++){myProcessModule = myProcessModuleCollection[i];//Console.WriteLine("The moduleName is " + myProcessModule.ModuleName);Console.WriteLine(" - " + myProcessModule.BaseAddress + " | " + myProcessModule.FileName);//Console.WriteLine("The " + myProcessModule.ModuleName + "'s base address is: " + myProcessModule.BaseAddress);//Console.WriteLine("For " + myProcessModule.ModuleName + " Entry point address is: " + myProcessModule.EntryPointAddress);}}else{Process process = Process.GetCurrentProcess();ProcessModule myProcessModule;ProcessModuleCollection myProcessModuleCollection = process.Modules;for (int i = 0; i < myProcessModuleCollection.Count; i++){myProcessModule = myProcessModuleCollection[i];//Console.WriteLine("The moduleName is " + myProcessModule.ModuleName);Console.WriteLine(" - " + myProcessModule.BaseAddress + " | " + myProcessModule.FileName);//Console.WriteLine("The " + myProcessModule.ModuleName + "'s base address is: " + myProcessModule.BaseAddress);//Console.WriteLine("For " + myProcessModule.ModuleName + " Entry point address is: " + myProcessModule.EntryPointAddress);}}
list_exports
这个可以使用SymLoadModuleEx、SymEnumerateSymbols64加回调函数可以解决
baseOfDll = SymLoadModuleEx(hCurrentProcess,IntPtr.Zero,"c:windowssystem32user32.dll",null,0,0,IntPtr.Zero,0);if (baseOfDll == 0){Console.Out.WriteLine("Failed to load module.");SymCleanup(hCurrentProcess);return;}if (SymEnumerateSymbols64(hCurrentProcess,baseOfDll, EnumSyms, IntPtr.Zero) == false){Console.Out.WriteLine("Failed to enum symbols.");}
Memory hunting
VirtualQueryEx查就行了
while (VirtualQueryEx(process, offset, &mbi, sizeof(mbi))){offset = (LPVOID)((DWORD_PTR)mbi.BaseAddress + mbi.RegionSize);if (mbi.AllocationProtect == PAGE_EXECUTE_READWRITE && mbi.State == MEM_COMMIT && mbi.Type == MEM_PRIVATE){std::cout << "tRWX: 0x" << std::hex << mbi.BaseAddress << "n";}}
IOC 病毒名称：Sodinokibi勒索病毒 样本名称：CDHFUN.exe MD5: ea4cae3d6d8150215a4d90593a4c30f2 SHA1: 8dcbcbefaedf5675b170af3fd44db93ad864894e SHA25…
免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论