{"id":9210,"date":"2024-05-08T16:01:01","date_gmt":"2024-05-08T08:01:01","guid":{"rendered":""},"modified":"2024-05-08T16:01:01","modified_gmt":"2024-05-08T08:01:01","slug":"\u5982\u4f55\u4f7f\u7528ModuleShifting\u6d4b\u8bd5Module Stomping\u548cModule Overloading\u6ce8\u5165\u6280\u672f","status":"publish","type":"post","link":"https:\/\/mushiming.com\/9210.html","title":{"rendered":"\u5982\u4f55\u4f7f\u7528ModuleShifting\u6d4b\u8bd5Module Stomping\u548cModule Overloading\u6ce8\u5165\u6280\u672f"},"content":{"rendered":"<\/p>\n<div>\n <img decoding=\"async\" src=\"https:\/\/img.mushiming.top\/app\/mushiming_com\/6cc5aad9d0e3474ea508244368153352.jpeg\" =\"\" =\"\" alt=\"\u5982\u4f55\u4f7f\u7528ModuleShifting\u6d4b\u8bd5Module Stomping\u548cModule Overloading\u6ce8\u5165\u6280\u672f (https:\/\/mushiming.com\/)  \u7b2c1\u5f20\" title=\"\u5982\u4f55\u4f7f\u7528ModuleShifting\u6d4b\u8bd5Module Stomping\u548cModule Overloading\u6ce8\u5165\u6280\u672f  \u7b2c1\u5f20-\u7a46\u4e16\u660e\u535a\u5ba2\" >\n<\/div>\n<h3 id=\"h2-1\">\u5173\u4e8eModuleShifting<\/h3>\n<p>ModuleShifting\u662f\u4e00\u6b3e\u9488\u5bf9Module Stomping\u548cModule Overloading\u6ce8\u5165\u6280\u672f\u7684\u5b89\u5168\u6d4b\u8bd5\u5de5\u5177\uff0c\u8be5\u5de5\u5177\u57fa\u4e8ePython ctypes\u5b9e\u73b0\u5176\u529f\u80fd\uff0c\u56e0\u6b64\u53ef\u4ee5\u901a\u8fc7Python\u89e3\u91ca\u5668\u6216Pyramid\u5728\u5185\u5b58\u4e2d\u5b8c\u6574\u6267\u884c\uff0c\u8fd9\u6837\u5c31\u53ef\u4ee5\u907f\u514d\u4f7f\u7528\u7f16\u8bd1\u52a0\u8f7d\u5668\u4e86\u3002<\/p>\n<p>\u9700\u8981\u6ce8\u610f\u7684\u662f\uff0c\u8be5\u6280\u672f\u53ef\u4ee5\u4e0ePE\u6216Shellcode Payload\u7ed3\u5408\u4f7f\u7528\uff0c\u4f46\u5f53\u524d\u7248\u672c\u7684ModuleShifting\u53ea\u80fd\u4e0eShellcode Payload\u4e00\u8d77\u4f7f\u7528\u3002<\/p>\n<h3 id=\"h2-2\">\u529f\u80fd\u4ecb\u7ecd<\/h3>\n<p>\u5f53\u8be5\u5de5\u5177\u4e0eShellcode Payload\u4e00\u8d77\u4f7f\u7528\u65f6\uff0c\u5c06\u6267\u884c\u4e0b\u5217\u64cd\u4f5c\uff1a<\/p>\n<blockquote>\n<p>1\u3001\u901a\u8fc7LoadLibrary\u52a0\u8f7d\u5408\u6cd5\u7684\u5bbf\u4e3bDLL\uff1b<\/p>\n<p>2\u3001\u5c06\u6307\u5b9a\u533a\u57df\u7684\u5185\u5b58\u6743\u9650\u4fee\u6539\u4e3aRW\uff1b<\/p>\n<p>3\u3001\u5c06Shellcode\u91cd\u5199\u81f3\u76ee\u6807\u533a\u57df\uff1b<\/p>\n<p>4\u3001\u6dfb\u52a0\u53ef\u9009\u586b\u5145\u6570\u636e\u4ee5\u66f4\u597d\u5730\u4f2a\u88c5\u6210\u8bef\u62a5\u884c\u4e3a\uff1b<\/p>\n<p>5\u3001\u5c06\u6743\u9650\u66f4\u6539\u4e3aRX\uff1b<\/p>\n<p>6\u3001\u901a\u8fc7\u51fd\u6570\u6307\u9488\u6267\u884cShellcode\uff1b<\/p>\n<p>7\u3001\u5728\u6267\u884c\u7684Shellcode\u4e0a\u5199\u5165\u539f\u59cbDLL\u5185\u5bb9\uff1b<\/p>\n<\/blockquote>\n<div>\n <img decoding=\"async\" src=\"https:\/\/img.mushiming.top\/app\/mushiming_com\/dd45d395952d40209a7c5989d9e47048.jpeg\" =\"\" =\"\" alt=\"\u5982\u4f55\u4f7f\u7528ModuleShifting\u6d4b\u8bd5Module Stomping\u548cModule Overloading\u6ce8\u5165\u6280\u672f (https:\/\/mushiming.com\/)  \u7b2c2\u5f20\" title=\"\u5982\u4f55\u4f7f\u7528ModuleShifting\u6d4b\u8bd5Module Stomping\u548cModule Overloading\u6ce8\u5165\u6280\u672f  \u7b2c2\u5f20-\u7a46\u4e16\u660e\u535a\u5ba2\" >\n<\/div>\n<\/p>\n<p>\u5f53\u8be5\u5de5\u5177\u4e0e\u4e00\u4e2aPE Payload\u4e00\u8d77\u4f7f\u7528\u65f6\uff0c\u5219\u4f1a\u6267\u884c\u4e0b\u5217\u64cd\u4f5c\uff1a<\/p>\n<blockquote>\n<p>1\u3001\u901a\u8fc7LoadLibrary\u52a0\u8f7d\u5408\u6cd5\u7684\u5bbf\u4e3bDLL\uff1b<\/p>\n<p>2\u3001\u5c06\u6307\u5b9a\u533a\u57df\u7684\u5185\u5b58\u6743\u9650\u4fee\u6539\u4e3aRW\uff1b<\/p>\n<p>3\u3001\u5c06PE\u5185\u5bb9\u9010\u8282\u590d\u5236\u5230\u6307\u5b9a\u76ee\u6807\u70b9\u4e0a\uff1b<\/p>\n<p>4\u3001\u6dfb\u52a0\u53ef\u9009\u586b\u5145\u6570\u636e\u4ee5\u66f4\u597d\u5730\u4f2a\u88c5\u6210\u8bef\u62a5\u884c\u4e3a\uff1b<\/p>\n<p>5\u3001\u6267\u884c\u57fa\u5730\u5740\u91cd\u65b0\u5206\u914d\uff1b<\/p>\n<p>6\u3001\u89e3\u6790\u5bfc\u5165\uff1b<\/p>\n<p>7\u3001\u901a\u8fc7\u5c06\u6743\u9650\u8bbe\u7f6e\u4e3a\u5176\u672c\u673a\u503c\u6765\u5b8c\u6210\u5185\u5b58\u5904\u7406\uff08\u907f\u514d\u521b\u5efaRWX\u5185\u5b58\u533a\u57df\uff09\uff1b<\/p>\n<p>8\u3001TLS\u56de\u8c03\u6267\u884c\uff1b<\/p>\n<p>9\u3001\u6267\u884cPE\u5165\u53e3\u70b9\uff1b<\/p>\n<\/blockquote>\n<h3 id=\"h2-3\">\u5de5\u5177\u5b89\u88c5<\/h3>\n<p>\u7531\u4e8e\u8be5\u5de5\u5177\u57fa\u4e8ePython 3\u5f00\u53d1\uff0c\u56e0\u6b64\u6211\u4eec\u9996\u5148\u9700\u8981\u5728\u672c\u5730\u8bbe\u5907\u4e0a\u5b89\u88c5\u5e76\u914d\u7f6e\u597dPython 3\u73af\u5883\u3002\u63a5\u4e0b\u6765\uff0c\u5e7f\u5927\u7814\u7a76\u4eba\u5458\u53ef\u4ee5\u76f4\u63a5\u4f7f\u7528\u4e0b\u5217\u547d\u4ee4\u5c06\u8be5\u9879\u76ee\u6e90\u7801\u514b\u9686\u81f3\u672c\u5730\uff1a<\/p>\n<pre class=\"language-java prettyprint linenums\">git clone https:\/\/github.com\/naksyn\/ModuleShifting.git<\/pre>\n<p>ModuleShifting\u53ef\u4ee5\u548cPyramid\u4e00\u8d77\u4f7f\u7528\uff0c\u914d\u5408\u4e00\u4e2aPython\u89e3\u91ca\u5668\uff0c\u5373\u53ef\u5728\u5185\u5b58\u4e2d\u5b8c\u6574\u6267\u884c\u672c\u5730\u8fdb\u7a0b\u6ce8\u5165\u4e86\u3002<\/p>\n<p>\u6b64\u65f6\u6211\u4eec\u8fd8\u9700\u8981\u4f7f\u7528\u4e0b\u5217\u547d\u4ee4\u514b\u9686Pyramid\u4ee3\u7801\u5e93\uff1a<\/p>\n<pre class=\"language-java prettyprint linenums\">git clone https:\/\/github.com\/naksyn\/Pyramid<\/pre>\n<p>\u7136\u540e\u4f7f\u7528\u4f60\u559c\u6b22\u7684C2\u751f\u6210\u4e00\u4e2aShellcode Payload\uff0c\u5e76\u5c06\u5176\u62d6\u52a8\u5230Pyramid\u7684Delivery_files\u6587\u4ef6\u5939\u4e2d\u3002<\/p>\n<p>\u4fee\u6539Pyramid Modules\u6587\u4ef6\u5939\u4e2dmoduleshifting.py\u811a\u672c\u4e2d\u7684\u76f8\u5173\u53c2\u6570\uff0c\u7136\u540e\u4f7f\u7528\u4e0b\u5217\u547d\u4ee4\u5f00\u542fPyramid\u670d\u52a1\u5668\uff1a<\/p>\n<pre class=\"language-java prettyprint linenums\">python3 pyramid.py -u testuser -pass testpass -p 443 -enc chacha20 -passenc superpass -generate -server 192.168.1.2 -setcradle moduleshifting.py<\/pre>\n<h3 id=\"h2-4\">\u5de5\u5177\u8fd0\u884c\u622a\u56fe<\/h3>\n<\/p>\n<div>\n <img decoding=\"async\" src=\"https:\/\/img.mushiming.top\/app\/mushiming_com\/7fdd7e59e4444bf2988973d9f4b3d3de.jpeg\" =\"\" =\"\" alt=\"\u5982\u4f55\u4f7f\u7528ModuleShifting\u6d4b\u8bd5Module Stomping\u548cModule Overloading\u6ce8\u5165\u6280\u672f (https:\/\/mushiming.com\/)  \u7b2c3\u5f20\" title=\"\u5982\u4f55\u4f7f\u7528ModuleShifting\u6d4b\u8bd5Module Stomping\u548cModule Overloading\u6ce8\u5165\u6280\u672f  \u7b2c3\u5f20-\u7a46\u4e16\u660e\u535a\u5ba2\" >\n<\/div>\n<\/p>\n<div>\n <img decoding=\"async\" src=\"https:\/\/img.mushiming.top\/app\/mushiming_com\/f2c7d87ed9534f36869cb10f58b4c07d.jpeg\" =\"\" =\"\" alt=\"\u5982\u4f55\u4f7f\u7528ModuleShifting\u6d4b\u8bd5Module Stomping\u548cModule Overloading\u6ce8\u5165\u6280\u672f (https:\/\/mushiming.com\/)  \u7b2c4\u5f20\" title=\"\u5982\u4f55\u4f7f\u7528ModuleShifting\u6d4b\u8bd5Module Stomping\u548cModule Overloading\u6ce8\u5165\u6280\u672f  \u7b2c4\u5f20-\u7a46\u4e16\u660e\u535a\u5ba2\" >\n<\/div>\n<\/p>\n<div>\n <img decoding=\"async\" src=\"https:\/\/img.mushiming.top\/app\/mushiming_com\/af4812fca8504878b642c0d4f635fc43.jpeg\" =\"\" =\"\" alt=\"\u5982\u4f55\u4f7f\u7528ModuleShifting\u6d4b\u8bd5Module Stomping\u548cModule Overloading\u6ce8\u5165\u6280\u672f (https:\/\/mushiming.com\/)  \u7b2c5\u5f20\" title=\"\u5982\u4f55\u4f7f\u7528ModuleShifting\u6d4b\u8bd5Module Stomping\u548cModule Overloading\u6ce8\u5165\u6280\u672f  \u7b2c5\u5f20-\u7a46\u4e16\u660e\u535a\u5ba2\" >\n<\/div>\n<\/p>\n<div>\n <img decoding=\"async\" src=\"https:\/\/img.mushiming.top\/app\/mushiming_com\/9160a8ee6414465f9b9021be67f97006.jpeg\" =\"\" =\"\" alt=\"\u5982\u4f55\u4f7f\u7528ModuleShifting\u6d4b\u8bd5Module Stomping\u548cModule Overloading\u6ce8\u5165\u6280\u672f (https:\/\/mushiming.com\/)  \u7b2c6\u5f20\" title=\"\u5982\u4f55\u4f7f\u7528ModuleShifting\u6d4b\u8bd5Module Stomping\u548cModule Overloading\u6ce8\u5165\u6280\u672f  \u7b2c6\u5f20-\u7a46\u4e16\u660e\u535a\u5ba2\" >\n<\/div>\n<\/p>\n<div>\n <img decoding=\"async\" src=\"https:\/\/img.mushiming.top\/app\/mushiming_com\/d8133ac3fad546488c67f10169cc3b0d.jpeg\" =\"\" =\"\" alt=\"\u5982\u4f55\u4f7f\u7528ModuleShifting\u6d4b\u8bd5Module Stomping\u548cModule Overloading\u6ce8\u5165\u6280\u672f (https:\/\/mushiming.com\/)  \u7b2c7\u5f20\" title=\"\u5982\u4f55\u4f7f\u7528ModuleShifting\u6d4b\u8bd5Module Stomping\u548cModule Overloading\u6ce8\u5165\u6280\u672f  \u7b2c7\u5f20-\u7a46\u4e16\u660e\u535a\u5ba2\" >\n<\/div>\n<\/p>\n<div>\n <img decoding=\"async\" src=\"https:\/\/img.mushiming.top\/app\/mushiming_com\/de084e2a4eaa4206a00c947cae6ef6d7.jpeg\" =\"\" =\"\" alt=\"\u5982\u4f55\u4f7f\u7528ModuleShifting\u6d4b\u8bd5Module Stomping\u548cModule Overloading\u6ce8\u5165\u6280\u672f (https:\/\/mushiming.com\/)  \u7b2c8\u5f20\" title=\"\u5982\u4f55\u4f7f\u7528ModuleShifting\u6d4b\u8bd5Module Stomping\u548cModule Overloading\u6ce8\u5165\u6280\u672f  \u7b2c8\u5f20-\u7a46\u4e16\u660e\u535a\u5ba2\" >\n<\/div>\n<\/p>\n<div>\n <img decoding=\"async\" src=\"https:\/\/img.mushiming.top\/app\/mushiming_com\/b0637137f4ad484d9bb8114d2dd65a6e.jpeg\" =\"\" =\"\" alt=\"\u5982\u4f55\u4f7f\u7528ModuleShifting\u6d4b\u8bd5Module Stomping\u548cModule Overloading\u6ce8\u5165\u6280\u672f (https:\/\/mushiming.com\/)  \u7b2c9\u5f20\" title=\"\u5982\u4f55\u4f7f\u7528ModuleShifting\u6d4b\u8bd5Module Stomping\u548cModule Overloading\u6ce8\u5165\u6280\u672f  \u7b2c9\u5f20-\u7a46\u4e16\u660e\u535a\u5ba2\" >\n<\/div>\n<h3 id=\"h2-5\">\u5de5\u5177\u6f14\u793a\u89c6\u9891<\/h3>\n<p><strong>\u89c6\u9891\u5730\u5740<\/strong>\uff1a\u3010\u70b9\u6211\u89c2\u770b\u3011<\/p>\n<h3 id=\"h2-6\">\u8bb8\u53ef\u8bc1\u534f\u8bae<\/h3>\n<p>\u672c\u9879\u76ee\u7684\u5f00\u53d1\u4e0e\u53d1\u5e03\u9075\u5faaApache-2.0\u5f00\u6e90\u8bb8\u53ef\u8bc1\u534f\u8bae\u3002<\/p>\n<h3 id=\"h2-7\">\u9879\u76ee\u5730\u5740<\/h3>\n<p><strong>ModuleShifting<\/strong>\uff1a\u3010GitHub\u4f20\u9001\u95e8\u3011<\/p>\n<h3 id=\"h2-8\">\u53c2\u8003\u8d44\u6599<\/h3>\n<blockquote>\n<p>https:\/\/github.com\/naksyn\/talks\/blob\/main\/x33fcon%202023%20-%20Improving%20the%20Stealthiness%20of%20Memory%20Injection%20Techniques.pdf<\/p>\n<p>Improving the stealthiness of memory injections techniques | Naksyn\u2019s blog<\/p>\n<p>Masking Malicious Memory Artifacts \u2013 Part II: Blending in with False Positives<\/p>\n<\/blockquote>\n","protected":false},"excerpt":{"rendered":"\u5982\u4f55\u4f7f\u7528ModuleShifting\u6d4b\u8bd5Module Stomping\u548cModule Overloading\u6ce8\u5165\u6280\u672f\u5f53\u8be5\u5de5\u5177\u4e0eShellcodePayload\u4e00\u8d77\u4f7f\u7528\u65f6\uff0c\u5c06\u6267\u884c\u4e0b\u5217...","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"_links":{"self":[{"href":"https:\/\/mushiming.com\/wp-json\/wp\/v2\/posts\/9210"}],"collection":[{"href":"https:\/\/mushiming.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mushiming.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mushiming.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mushiming.com\/wp-json\/wp\/v2\/comments?post=9210"}],"version-history":[{"count":0,"href":"https:\/\/mushiming.com\/wp-json\/wp\/v2\/posts\/9210\/revisions"}],"wp:attachment":[{"href":"https:\/\/mushiming.com\/wp-json\/wp\/v2\/media?parent=9210"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mushiming.com\/wp-json\/wp\/v2\/categories?post=9210"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mushiming.com\/wp-json\/wp\/v2\/tags?post=9210"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}