Method for evading PE file uploading of antivirus software based on penetration testing

Abstract

The invention discloses a method for evading PE file uploading of antivirus software based on penetration testing. The method includes the following steps that a) a memory of a current PE file and a memory of a file after the capacity is increased are determined; b) a block table head at the least significant end is determined; c) a new block table head is added again, and the length of a corresponding block of the block table head and the specific attribute of the block are set; d) bytes are added to the file tail of the block; e) the file is preserved; f) the size of the file is verified; g) a PE file is operated, and whether load time is changed or not is detected. Compared with the prior art, according to the method for evading PE file uploading of the antivirus software based on penetration testing, when a large file is killed through a current antivirus-software cloud killing mechanism, only a characteristic value can be commonly extracted, and an analysis-process basis of the file cannot be uploaded; according to the method for evading PE file uploading of the antivirus software by increasing the memory of the PE file, an unsafe data loophole is recovered while the working efficiency of penetration testing is improved.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a method for uploading PE files based on avoiding antivirus software in penetration testing. Background technique [0002] At present, the security protection software adopts the cloud detection and killing mechanism. The cloud detection and killing mechanism means that when the security protection software detects suspicious files, it first uses the local popular signature database and the local normal file database (white list database) to check. If the file is neither an existing virus signature nor a normal local file, the signature of the file will be submitted to the cloud database for inspection. If it is detected that the file is a virus, the result of cloud identification will be returned. If the cloud library inspection finds that this is a brand new file and a suspicious file that has never appeared before, the suspicious file will be reported. [0003] Pene...

AI Technical Summary

Problems solved by technology

[0006] The purpose of the present invention is to provide a method for uploading PE files based on anti-virus software in penetration testing, so as to solve the problem that the penetration testing work efficiency is low in the prior art, and the penetration testing tool PE is easy to be uploaded, analyzed or checked and killed. There are technical flaws with huge loopholes in security

Images