An attack method based on cloud function free killing and anti-tracing

Abstract

The application relates to the technical field of computer network security, and discloses an attack method based on cloud function free killing and anti-tracing, which is characterized by comprising the following steps: S1, establishing a landing point; S2, hijacking a maintenance permission; S3, hiding real IP address information in command and control server communication; S4, checking whether a disk is less than 60G, whether memory is less than 4G and whether the number of CPU cores is less than 4; S5, checking a running process name; S6, checking whether the following virtual machine configuration files exist; S7, checking whether a mouse moves within 10 seconds of program running and whether a keyboard is input. In penetration testing or attack and defense drills, whether core malicious code is acquired or a command and control server is connected, the real IP address of the server is hidden through cloud functions as an agent, evidence available for tracing is reduced, and great challenges are brought to subsequent defense party tracing.

Description

Technical Field

[0001] This invention relates to the field of computer network security technology, specifically to an attack method based on cloud functions for evasion of antivirus software and prevention of attribution. Background Technology

[0002] Existing technologies use special algorithms to compress resources in executable files and dynamically linked files, and disguise external data such as file descriptions, version numbers, creation dates, modified software, and system execution requirements through packing. However, packing leaves obvious traces, making antivirus software highly sensitive to it, resulting in a high rate of false positives. Even legitimate software is often identified as a virus by antivirus software after being packed. The packer runs before the program runs, and by the time the program is loaded into memory, it has reverted to its original unpacked state. Therefore, it is ineffective in protecting malicious code from dynamic detection.

[0003] To address this issue, we propose a cloud function-based attack method that evades antivirus detection and prevents tracing of origins. Summary of the Invention

[0004] The purpose of this invention is to provide an attack method based on cloud functions for evading antivirus and preventing source tracing, which solves the problems mentioned in the background art.

[0005] To achieve the above objectives, the present invention provides the following technical solution: an attack method based on cloud function evasion and anti-source tracing, comprising the following steps: S1: Establish a foothold; S2: Hijacking to maintain privileges; S3: Command and control server communication that hides the real IP address information; S4: Check if the disk space is less than 60G, the memory is less than 4G, and the number of CPU cores is less than 4; S5: Check the name of the running process; S6: Check if the following virtual machine configuration files exist: C:\windows\System32\Drivers\Vmmouse.sys C:\windows\System32\Drivers\vmtray.dll C:\windows\System32\Drivers\VMToolsHook.dll C:\windows\System32\Drivers\vmmousever.dll C:\windows\System32\Drivers\vmhgfs.dll C:\windows\System32\Drivers\vmGuestLib.dll C:\windows\System32\Drivers\VBoxMouse.sys C:\windows\System32\Drivers\VBoxGuest.sys C:\windows\System32\Drivers\VBoxSF.sys C:\windows\System32\Drivers\VBoxVideo.sys C:\windows\System32\vboxdisp.dll C:\windows\System32\vboxhook.dll C:\windows\System32\vboxoglerrorspu.dll C:\windows\System32\vboxoglpassthroughspu.dll C:\windows\System32\vboxservice.exe C:\windows\System32\vboxtray.exe C:\windows\System32\VBoxControl.exe; S7: Check whether the mouse moves within 10 seconds of program running, whether there is any input from the keyboard, and whether the boot time exceeds 1 hour; S8: In the anti-debugging stage, check whether the BeingDebugged flag is 1; S9: Generate a anti-virus code module, perform base64 encoding on shellcode, randomly generate an equal-length key k for XOR operation, perform base64 encoding again, then store it on a server and wait for a request initiated by a cloud function; S10: Load the anti-virus code module with the built-in key k, first request a piece of non-executable but writable memory for standby, initiate a request to the cloud function server to obtain the core malicious code, enter a loop to slow down the decryption process after base64 decoding, randomly generate a number n after each XOR operation on a character, where 50 < n < 100, if n mod 3 = 1, generate n random numbers for sorting and suspend the program for 1 second, until the complete decryption is completed, perform base64 decoding and write the result into the previously allocated memory, then change the memory attribute to executable, and then execute the content in the memory; S11: The process of generating a dynamic link library (DLL) during the permission maintenance phase; S12: Set a trigger in the cloud function to realize traffic forwarding. That is, the cloud function will listen for all requests and forward the request traffic to the command and control server, and forward the return packet of the command and control server to the target that initiated the request.

[0006] Preferably, the endpoint in step S1 is established based on a cloud function proxy and by remotely loading undetectable shellcode.

[0007] Preferably, the hijacking and maintaining privileges in step S2 is done through a dynamic link library (DLL).

[0008] Preferably, step S3 is achieved by leveraging the proxy functionality of cloud functions.

[0009] Preferably, the process names in step S5 are the Vmtoolsd.exe, Vmwaretrat.exe, Vmwareuser.exe, and Vmacthlp.exe processes existing in the VMware virtual machine software, and the vboxservice.exe and vboxtray.exe processes existing in VirtualBox.

[0010] Preferably, the anti-debugging phase in step S8 uses the CheckRemoteDebuggerPresent method to detect debugging.

[0011] This invention provides an attack method based on cloud functions for evading antivirus detection and preventing source tracing. This attack method based on cloud functions has the following beneficial effects: 1. This invention can identify cloud sandboxes, virtual machines and disassemblers, greatly interfering with security analysis. At the same time, by changing different keys, it can bypass the signature recognition of static detection by antivirus software.

[0012] 2. This invention makes the entire decryption process relatively lengthy by using a large number of sorting and pausing steps, which can interfere with dynamic detection in memory.

[0013] 3. This invention utilizes DLL hijacking of startup items, which can maintain permissions without modifying critical and sensitive parts of the system, and load into the address space of whitelisted processes without leaving the process name.

[0014] 4. In penetration testing or attack and defense exercises, this invention uses cloud functions as proxies to hide the server's real IP address, whether it is to obtain core malicious code or connect to command and control servers, thereby reducing the amount of evidence left for tracing the source and posing a great challenge to the subsequent tracing by the defender. Attached Figure Description

[0015] Figure 1 This is a schematic diagram of the operation of the target system of the present invention.

[0016] Figure 2 This is a schematic diagram of the main program flow of the present invention.

[0017] Figure 3 This is a schematic diagram of the anti-sandbox module of the present invention.

[0018] Figure 4 This is a schematic diagram of the antivirus code generation module of the present invention.

[0019] Figure 5 This is a schematic diagram of the antivirus code loading module of the present invention.

[0020] Figure 6 This is a schematic diagram illustrating DLL hijacking during the permission maintenance phase of this invention.

[0021] Figure 7 This is a schematic diagram of the cloud function proxy of the present invention. Detailed Implementation

[0022] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments.

[0023] Examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain the invention, and should not be construed as limiting the invention.

[0024] like Figure 1-7 As shown, this invention provides a technical solution: an attack method based on cloud functions for evading antivirus and preventing source tracing, comprising the following steps: S1: Based on cloud function proxy, establish a foothold by remotely loading undetectable shellcode; S2: Maintaining privileges through DLL hijacking; S3: By leveraging the proxy functionality of cloud functions, commands and server communication can be implemented while hiding the real IP address information; S4: Check if the disk space is less than 60G, the memory is less than 4G, and the number of CPU cores is less than 4; S5: Check the running process names. For example, common virtual machine software like VMware might have processes such as Vmtoolsd.exe, Vmwaretrat.exe, Vmwareuser.exe, and Vmacthlp.exe. VirtualBox might have processes such as vboxservice.exe and vboxtray.exe. S6: Check if the following virtual machine configuration files exist: C:\windows\System32\Drivers\Vmmouse.sys C:\windows\System32\Drivers\vmtray.dll C:\windows\System32\Drivers\VMToolsHook.dll C:\windows\System32\Drivers\vmmousever.dll C:\windows\System32\Drivers\vmhgfs.dll C:\windows\System32\Drivers\vmGuestLib.dll C:\windows\System32\Drivers\VBoxMouse.sys C:\windows\System32\Drivers\VBoxGuest.sys C:\windows\System32\Drivers\VBoxSF.sys C:\windows\System32\Drivers\VBoxVideo.sys C:\windows\System32\vboxdisp.dll C:\windows\System32\vboxhook.dll C:\windows\System32\vboxoglerrorspu.dll C:\windows\System32\vboxoglpassthroughspu.dll C:\windows\System32\vboxservice.exe C:\windows\System32\vboxtray.exe C:\windows\System32\VBoxControl.exe; since the cloud sandbox automatically analyzes files, it checks whether the mouse moves within 10 seconds after the program runs, whether there is any keyboard input, whether the boot time exceeds 1 hour, and finally enters the anti-debugging stage; S7: checking whether the mouse moves within 10 seconds after the program runs, whether there is any keyboard input, and whether the boot time exceeds 1 hour; S8: in the anti-debugging stage, checking whether the BeingDebugged flag is 1 twice, and detecting debugging by using the CheckRemoteDebuggerPresent method; if any of the above judgments is true, it is determined that the program is running in an abnormal state, an exception is thrown and meaningless operations are executed; S9: generating a anti-virus detection code module, performing base64 encoding on shellcode, then randomly generating an equal-length key k for XOR operation, performing base64 encoding again, and then storing the result in a server to wait for a request initiated by a cloud function; S10: loading the anti-virus detection code module with a built-in key k, first requesting a piece of non-executable but writable memory for standby, initiating a request to a cloud function server to obtain core malicious code, performing base64 decoding and then entering a loop to slow down the decryption process; a random number n satisfying 50<n<100 is generated after each character is processed by XOR, if n mod3=1, n random numbers are generated and sorted, and the program is stopped for 1 second; after complete decryption, base64 decoding is performed and the result is written into the previously allocated memory, then the memory attribute is changed to executable, and the content in the memory is executed; S11: in the permission maintenance stage, the process for generating a dynamic link library (DLL) is as follows: for example, first export the function loading table of the hijacked test.dll file, rename the original test.dll to test1.dll, construct a new test.dll file and write the original function loading table into the new test.dll, that is, when the original program intends to call the original test.dll, it forwards the call to the function in test1.dll through the constructed test.dll, as Figure 6 shown. However, the dllmain function is executed before the call, wherein the dllmain function is also anti-virus detection malicious code, and the process is the same as described above; S12: setting a trigger in the cloud function to implement traffic forwarding, that is, the cloud function listens to all requests, forwards the request traffic to a command and control server, and forwards the response packet from the command and control server to the target that initiates the request.

[0025] This method enables attacks on the Windows operating system. The approach is based on my many years of experience as a defender, combining the perspectives of both attackers and defenders. It has a certain degree of originality, and the results are significant and highly practical.

[0026] Understandably, this solution will be used in legal scenarios.

[0027] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to the embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

[0028] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. An attack method based on cloud function evasion and anti-source tracing, applied in penetration testing or attack-defense drills, characterized by: Includes the following steps: S1: Based on cloud function proxy, establish a foothold by remotely loading undetectable shellcode; S2: Maintaining privileges through DLL hijacking; S3: Command and control server communication that hides the real IP address information; S4: Check if the disk space is less than 60G, the memory is less than 4G, and the number of CPU cores is less than 4; S5: Check the name of the running process; S6: Check if the following virtual machine configuration files exist: C:\windows\System32\Drivers\Vmmouse.sys C:\windows\System32\Drivers\vmtray.dll C:\windows\System32\Drivers\VMToolsHook.dll C:\windows\System32\Drivers\vmmousever.dll C:\windows\System32\Drivers\vmhgfs.dll C:\windows\System32\Drivers\vmGuestLib.dll C:\windows\System32\Drivers\VBoxMouse.sys C:\windows\System32\Drivers\VBoxGuest.sys C:\windows\System32\Drivers\VBoxSF.sys C:\windows\System32\Drivers\VBoxVideo.sys C:\windows\System32\vboxdisp.dll C:\windows\System32\vboxhook.dll C:\windows\System32\vboxoglerrorspu.dll C:\windows\System32\vboxoglpassthroughspu.dll C:\windows\System32\vboxservice.exe C:\windows\System32\vboxtray.exe C:\windows\System32\VBoxControl.exe; S7: Check if the mouse moves within 10 seconds of the program running, if there is any keyboard input, and if the power-on time exceeds 1 hour. S8: Anti-debugging phase, check if the BeingDebugged flag is 1, use the CheckRemoteDebuggerPresent method to detect debugging, if it is determined that the program is running in an abnormal state, throw an exception and perform meaningless operations; S9: Generate a anti-virus code module, which performs base64 encoding on the shellcode, randomly generates an equal-length key k for XOR operation, performs base64 encoding again, and then stores it on the server to wait for the request initiated by the cloud function; S10: Load the anti-virus code module with a built-in key k. First, request a piece of non-executable but writable memory for standby, initiate a request to the cloud function server to obtain the core malicious code, enter a loop to slow down the decryption process after base64 decoding. For each character that undergoes XOR, a number n is randomly generated, where 50 < n < 100. If n mod 3 = 1, n random numbers are generated and sorted, and the program is suspended for 1 second. Until the decryption is completed, after base64 decoding, the result is written into the previously allocated memory, then the memory attribute is changed to executable, and then the content in the memory is executed; S11: The process of generating a dynamic link library DLL in the privilege maintenance stage; S12: Set a trigger in the cloud function to implement traffic forwarding, that is, the cloud function will listen to all requests, forward the request traffic to the command and control server, and forward the response packet from the command and control server to the target that initiated the request.

2. The attack method based on cloud function evasion and anti-attribution method according to claim 1, characterized in that: Step S3 is implemented by means of the proxy function of the cloud function.

3. The attack method based on cloud function evasion and anti-attribution method according to claim 1, characterized in that: The process names in step S5 include Vmtoolsd.exe, Vmwaretrat.exe, Vmwareuser.exe, and Vmacthlp.exe existing in the virtual machine software Vmware, and vboxservice.exe and vboxtray.exe existing in VituralBox.

4. The attack method based on cloud function evasion and anti-attribution method according to claim 1, characterized in that: In the anti-debugging stage of step S8, the CheckRemoteDebuggerPresent method is used to detect debugging.

Images