Havoc的demon开发环境配置（使用vscode二开beacon）

二开havoc需要看一下之前的几篇文章，感谢chatAI让我少吃了很多苦头，二开beacon（demon）环境终于搭建好了，之前想过使用ollvm编译demon，以便于源码级的混淆，但是试了以下，llvm能让人吃更多苦头，我没有测试过demon能不能使用llvm编译，因为llvm本身就很难编译成功，以至于我不想在llvm上花费任何精力，如果您有linux版本的ollvm编译后的二进制文件，希望您能分享给我，我会第一时间进行测试。下面是之前几篇文章的链接：

• vscode二开havoc的teamserver环境搭建（C2远控二开）-CSDN博客

• windows与linux交叉编译远程调试简单实现（使用vscode调试linux编译的exe）-CSDN博客

经过我对teamserver的调试，我发现demon的编译是用纯命令行的，因为命令行内容太多占用太多篇幅，我只提供能使用的版本

/usr/bin/nasm -f win64 src/asm/Spoof.x64.asm -o /tmp/ca501b78d3/381232c2a5.o
/usr/bin/nasm -f win64 src/asm/Syscall.x64.asm -o /tmp/ca501b78d3/18fb5b2891.o
​
"/root/Havoc_dbg/teamserver_proj/data/x86_64-w64-mingw32-cross/bin/x86_64-w64-mingw32-gcc" src/core/CoffeeLdr.c src/core/Command.c src/core/Dotnet.c src/core/Download.c src/core/HwBpEngine.c src/core/HwBpExceptions.c src/core/Jobs.c src/core/Kerberos.c src/core/Memory.c src/core/MiniStd.c src/core/Obf.c src/core/ObjectApi.c src/core/Package.c src/core/Parser.c src/core/Pivot.c src/core/Runtime.c src/core/Socket.c src/core/Spoof.c src/core/SysNative.c src/core/Syscalls.c src/core/Thread.c src/core/Token.c src/core/Transport.c src/core/TransportHttp.c src/core/TransportSmb.c src/core/Win32.c src/crypt/AesCrypt.c src/inject/Inject.c src/inject/InjectUtil.c /tmp/ca501b78d3/381232c2a5.o /tmp/ca501b78d3/18fb5b2891.o src/Demon.c -Iinclude -nostdlib -mwindows -Os -g -fno-asynchronous-unwind-tables -masm=intel -fno-ident -fpack-struct=8 -falign-functions=1 -ffunction-sections -fdata-sections -falign-jumps=1 -w -falign-labels=1 -fPIC -Wl,--no-seh,--enable-stdcall-fixup,--gc-sections -DCONFIG_BYTES={0x02\,0x00\,0x00\,0x00\,0x0f\,0x00\,0x00\,0x00\,0x02\,0x00\,0x00\,0x00\,0x02\,0x00\,0x00\,0x00\,0x40\,0x00\,0x00\,0x00\,0x43\,0x00\,0x3a\,0x00\,0x5c\,0x00\,0x57\,0x00\,0x69\,0x00\,0x6e\,0x00\,0x64\,0x00\,0x6f\,0x00\,0x77\,0x00\,0x73\,0x00\,0x5c\,0x00\,0x53\,0x00\,0x79\,0x00\,0x73\,0x00\,0x74\,0x00\,0x65\,0x00\,0x6d\,0x00\,0x33\,0x00\,0x32\,0x00\,0x5c\,0x00\,0x6e\,0x00\,0x6f\,0x00\,0x74\,0x00\,0x65\,0x00\,0x70\,0x00\,0x61\,0x00\,0x64\,0x00\,0x2e\,0x00\,0x65\,0x00\,0x78\,0x00\,0x65\,0x00\,0x00\,0x00\,0x40\,0x00\,0x00\,0x00\,0x43\,0x00\,0x3a\,0x00\,0x5c\,0x00\,0x57\,0x00\,0x69\,0x00\,0x6e\,0x00\,0x64\,0x00\,0x6f\,0x00\,0x77\,0x00\,0x73\,0x00\,0x5c\,0x00\,0x53\,0x00\,0x79\,0x00\,0x73\,0x00\,0x57\,0x00\,0x4f\,0x00\,0x57\,0x00\,0x36\,0x00\,0x34\,0x00\,0x5c\,0x00\,0x6e\,0x00\,0x6f\,0x00\,0x74\,0x00\,0x65\,0x00\,0x70\,0x00\,0x61\,0x00\,0x64\,0x00\,0x2e\,0x00\,0x65\,0x00\,0x78\,0x00\,0x65\,0x00\,0x00\,0x00\,0x00\,0x00\,0x00\,0x00\,0x00\,0x00\,0x00\,0x00\,0x00\,0x00\,0x00\,0x00\,0x00\,0x00\,0x00\,0x00\,0x00\,0x00\,0x00\,0x00\,0x00\,0x00\,0x00\,0x00\,0x00\,0x00\,0x00\,0x00\,0x00\,0x00\,0x00\,0x00\,0x00\,0x00\,0x00\,0x00\,0x0a\,0x00\,0x00\,0x00\,0x50\,0x00\,0x4f\,0x00\,0x53\,0x00\,0x54\,0x00\,0x00\,0x00\,0x00\,0x00\,0x00\,0x00\,0x01\,0x00\,0x00\,0x00\,0x1e\,0x00\,0x00\,0x00\,0x31\,0x00\,0x39\,0x00\,0x32\,0x00\,0x2e\,0x00\,0x31\,0x00\,0x36\,0x00\,0x38\,0x00\,0x2e\,0x00\,0x37\,0x00\,0x32\,0x00\,0x2e\,0x00\,0x31\,0x00\,0x36\,0x00\,0x32\,0x00\,0x00\,0x00\,0xbb\,0x01\,0x00\,0x00\,0x01\,0x00\,0x00\,0x00\,0xdc\,0x00\,0x00\,0x00\,0x4d\,0x00\,0x6f\,0x00\,0x7a\,0x00\,0x69\,0x00\,0x6c\,0x00\,0x6c\,0x00\,0x61\,0x00\,0x2f\,0x00\,0x35\,0x00\,0x2e\,0x00\,0x30\,0x00\,0x20\,0x00\,0x28\,0x00\,0x57\,0x00\,0x69\,0x00\,0x6e\,0x00\,0x64\,0x00\,0x6f\,0x00\,0x77\,0x00\,0x73\,0x00\,0x20\,0x00\,0x4e\,0x00\,0x54\,0x00\,0x20\,0x00\,0x36\,0x00\,0x2e\,0x00\,0x31\,0x00\,0x3b\,0x00\,0x20\,0x00\,0x57\,0x00\,0x4f\,0x00\,0x57\,0x00\,0x36\,0x00\,0x34\,0x00\,0x29\,0x00\,0x20\,0x00\,0x41\,0x00\,0x70\,0x00\,0x70\,0x00\,0x6c\,0x00\,0x65\,0x00\,0x57\,0x00\,0x65\,0x00\,0x62\,0x00\,0x4b\,0x00\,0x69\,0x00\,0x74\,0x00\,0x2f\,0x00\,0x35\,0x00\,0x33\,0x00\,0x37\,0x00\,0x2e\,0x00\,0x33\,0x00\,0x36\,0x00\,0x20\,0x00\,0x28\,0x00\,0x4b\,0x00\,0x48\,0x00\,0x54\,0x00\,0x4d\,0x00\,0x4c\,0x00\,0x2c\,0x00\,0x20\,0x00\,0x6c\,0x00\,0x69\,0x00\,0x6b\,0x00\,0x65\,0x00\,0x20\,0x00\,0x47\,0x00\,0x65\,0x00\,0x63\,0x00\,0x6b\,0x00\,0x6f\,0x00\,0x29\,0x00\,0x20\,0x00\,0x43\,0x00\,0x68\,0x00\,0x72\,0x00\,0x6f\,0x00\,0x6d\,0x00\,0x65\,0x00\,0x2f\,0x00\,0x39\,0x00\,0x36\,0x00\,0x2e\,0x00\,0x30\,0x00\,0x2e\,0x00\,0x34\,0x00\,0x36\,0x00\,0x36\,0x00\,0x34\,0x00\,0x2e\,0x00\,0x31\,0x00\,0x31\,0x00\,0x30\,0x00\,0x20\,0x00\,0x53\,0x00\,0x61\,0x00\,0x66\,0x00\,0x61\,0x00\,0x72\,0x00\,0x69\,0x00\,0x2f\,0x00\,0x35\,0x00\,0x33\,0x00\,0x37\,0x00\,0x2e\,0x00\,0x33\,0x00\,0x36\,0x00\,0x00\,0x00\,0x01\,0x00\,0x00\,0x00\,0x02\,0x00\,0x00\,0x00\,0x00\,0x00\,0x01\,0x00\,0x00\,0x00\,0x02\,0x00\,0x00\,0x00\,0x00\,0x00\,0x00\,0x00\,0x00\,0x00}  -DTRANSPORT_HTTP -D MAIN_THREADED -e WinMain src/main/MainExe.c -o /tmp/ca501b78d3/demon.x64.exe

以上编译命令行的工作：

• 前两个命令是将汇编代码转化为可执行程序，存放在/tmp/ca501b78d3/目录

• 然后就是编译demon

注：

• /tmp/ca501b78d3/目录名是随机生成的，之后的两个汇编可执行程序和demon.x64.exe都会存到这里

• 我做了很简单的修改，让原本的demon.x64.exe具有调试信息，将生成2400kb左右的exe文件（原本100kb）

demon调试的实现

和之前写的交叉编译原理一样，需要windows端和linux端各有一份源码（只需要Demon文件夹即可），你可以尝试使用以上命令编译以下Demon以确保emon.x64.exe会正确编译。

以上命令过于臃肿，我将以上命令放在了与Demon同级的目录下，并将其命名为compile，下面是compile简单的功能：

• mkdir /Demon/.build：在Demon项目文件夹下新建.build用于存放只有剪切过来的demon.x64.exe

• 以上的编译命令

• 将编译后的demon.x64.exe移动到/Demon/.build/下

• 删除编译过程中生成tmp（缓存）文件夹

项目结构展示，以及json文件的编写：

 

sftp.json

{
    "name": "KaliServer",
    "host": "192.168.72.162",
    "protocol": "sftp",
    "port": 5022,
    "username": "root",
    "remotePath": "/root/Havoc_dbg/teamserver_proj/payloads/Demon",
    "uploadOnSave": true,
    "useTempFile": false,
    "openSsh": false
}
以上是调试环境所必须的配置，主要作用是同步windows端和linux端代码

launch.json

{
    // 使用 IntelliSense 了解相关属性。 
    // 悬停以查看现有属性的描述。
    // 欲了解更多信息，请访问: https://go.microsoft.com/fwlink/?linkid=830387
    "version": "0.2.0",
    "configurations": [{
        "name": "(gdb) 启动",
        "type": "cppdbg",
        "request": "launch",
        "program": "F:/6.phrase_six/Havoc_dbg/teamserver_proj/payloads/Demon/.build/demon.x64.exe",
        "args": [],
        "stopAtEntry": false,
        "cwd": "${fileDirname}",
        "environment": [],
        "externalConsole": false,
        "MIMode": "gdb",
        //"preLaunchTask": "copy_file",
        "miDebuggerPath": "F:/6.phrase_six/GBD/GDB-Windows-Binaries-master/gdb.exe",                   // gdb路径
        "sourceFileMap": 
        {
                "/root/Havoc_dbg/teamserver_proj/payloads/Demon/": "${workspaceFolder}/"
        },
        "setupCommands": [
            {
                "description": "为 gdb 启用整齐打印",
                "text": "-enable-pretty-printing",
                "ignoreFailures": true
            },
            {
                "description": "将反汇编风格设置为 Intel",
                "text": "-gdb-set disassembly-flavor intel",
                "ignoreFailures": true
            }
        ]
    
    }
    
]
}

以上内容是调试的配置，主要内容如下：

• "program"变量：二进制文件demon.x64.exe的路径（exe文件的复制会在task.json中进行配置，task.json在下面）

• //"preLaunchTask": "copy_file"：这里就是配置的task.json的任务，我将它注释掉是因为，如果每次调试就编译的话太费时间了

• "miDebuggerPath": "F:/6.phrase_six/GBD/GDB-Windows-Binaries-master/gdb.exe"：gdb的路径（希望你下载了）

• sourceFileMap：linux源码映像到windows源码的路径，用于gdb调试的时候能找到源码

task.json

{
    "version": "2.0.0",
    "tasks": [
        {
            "label": "cross_compile",
            "type": "process",
            "command": "powershell",
            "args": [
                "-Command",
                "ssh -p 9722 root@192.168.72.162 \"cd /root/Havoc_dbg/teamserver_proj/payloads/Demon && bash -c /root/Havoc_dbg/teamserver_proj/payloads/Demon/compile\""
            ],
            "group": {
                "kind": "build",
                "isDefault": true
            },
            "problemMatcher": ["$gcc"]
        }
        ,
        {
            "label": "copy_file",
            "type": "shell",
            "command": "ssh -p 9722 root@192.168.72.162 \" scp -r /root/Havoc_dbg/teamserver_proj/payloads/Demon/.build/ andy@DESKTOP-T89LSP5:F:/6.phrase_six/Havoc_dbg/teamserver_proj/payloads/Demon/ \" ",
            // "command": "ssh -p 9722 root@192.168.72.162 \"/root/Havoc_dbg/teamserver_proj/data/x86_64-w64-mingw32-cross/bin/x86_64-w64-mingw32-gcc ~/Havoc_dbg/c_demo/main.c -g -o /tmp/a.exe\"  && scp -o StrictHostKeyChecking=no /tmp/a.exe andy@DESKTOP-T89LSP5:F:\\6.phrase_six\\havoc\\c_demo_exe\\.build \" ",
            "dependsOn": "cross_compile",  // 等待 `task1` 完成后再执行
            "group": {
                "kind": "build",
                "isDefault": true
            },
            "problemMatcher": ["$gcc"]
        },
    ],
} 

以上task内容如下：

• cross_compile：运行存在linux端的compile脚本，linux开始编译demon.x64.exe并剪切到项目目录

• copy_file：需要从将demon.x64.exe从linux端拷贝到windows端

  • "dependsOn": "cross_compile"：表明copy_file运行之前会运行cross_compile

配置好这三个文件后就可以愉快的调试了