Automatic killing-free remote control program generation method, tool and equipment

Abstract

The invention relates to the field of information security, in particular to an automatic killing-free remote control program generation method, tool and equipment, and aims to improve the attack and defense drilling efficiency. The automatic killing-free remote control program generation method provided by the invention comprises the following steps: acquiring an initial Shellcode; calling an encryption function to encrypt the initial Shellcode so as to obtain an encrypted Shellcode; embedding the source code of the decryption function into the loader template so as to generate a loader source file; and compiling the loader source file by adopting a compiling tool, and embedding the encrypted Shellcode so as to obtain an executable remote control program. According to the method and the device, decoupling between the loader template and the encryption and decryption algorithm is realized, so that a user can independently optimize the encryption and decryption algorithm without concerning other codes of the loader, the encryption and decryption algorithm can be automatically upgraded or replaced under the condition of not influencing other system functions, and the efficiency of attack and defense drilling work is improved.

Description

Technical Field

[0001] The present invention relates to the field of information security, and in particular to a method, tool and device for generating an automated anti-killing remote control program. Background Art

[0002] The core purpose of the anti-virus remote control program generation technology is to bypass the detection of anti-virus software, so that the remote control software can run covertly, thereby realizing remote control and monitoring of the target system. This technology has potential application value in the fields of legal education, research and network security testing. For example, in network security attack and defense drills, the attacker needs to simulate real attack scenarios, and the anti-virus remote control program can help them bypass the security protection of the target system and simulate hacker attack behaviors more realistically.

[0003] Shellcode refers to a small machine code program that is often used as a payload in vulnerability attacks. The main function of Shellcode is to perform malicious operations by exploiting vulnerabilities in the target system, such as gaining control of the system, executing remote code, and escalating privileges.

[0004] A loader is a program that can load shellcode or other malicious programs from the outside into memory and execute them. Loaders usually use different techniques to circumvent traditional security protections, such as encrypting or compressing shellcode to avoid detection by anti-virus software. The working principle of a loader usually includes finding vulnerabilities, injecting shellcode, decrypting shellcode, and finally executing it in the target environment.

[0005] In actual attack and defense drills, attackers need to quickly respond to changing protection mechanisms and attack environments. However, existing anti-kill remote control program generation technologies often lack sufficient automation support. After optimizing the encryption and decryption algorithms, users are still required to manually modify the loader template, which reduces the overall efficiency of attack and defense drills. Summary of the invention

[0006] In order to solve the above problems in the prior art, the present invention proposes an automated anti-killing remote control program generation method, tool and device, which improves the efficiency of attack and defense drills.

[0007] A first aspect of the present invention provides a method for generating an automated anti-killing remote control program, the method comprising: Get the initial Shellcode; Calling an encryption function to encrypt the initial Shellcode to obtain an encrypted Shellcode; Embed the source code of the decryption function into the loader template to generate the loader source file; The loader source file is compiled using a compilation tool, and the encrypted Shellcode is embedded therein, thereby obtaining the executable remote control program.

[0008] Preferably, the loader template includes a preset first mark; The steps of “embedding the source code of the decryption function into the loader template to generate the loader source file” include: Embed the source code of the decryption function into the loader template according to the preset first mark to obtain a first source code; The loader source file is generated according to the first source code.

[0009] Preferably, the loader template includes a preset first mark and a preset second mark; The decryption function includes a called function; The steps of “embedding the source code of the decryption function into the loader template to generate the loader source file” include: Embed the source code of the decryption function into the loader template according to the preset first mark to obtain a first source code; According to the preset second mark, embedding the source code file package containing the called function into the first source code to obtain a second source code; The loader source file is generated according to the second source code.

[0010] Preferably, the number of the loader templates and the number of the generated loader source files are both M, and they correspond one to one; The number of the compilation tools is N; The loader template also includes preset embedding instructions; The step of “using a compilation tool to compile the loader source file and embed the encrypted Shellcode to obtain the executable remote control program” includes: For the M loader source files, N compilation tools are used to compile each of the loader source files respectively, and the encrypted Shellcode is embedded into the compiled binary file according to the embedding instruction, thereby generating M×N executable remote control programs.

[0011] Preferably, the method further comprises: Obtaining an encryption / decryption file specified by a user, wherein the encryption / decryption file includes a source code of the encryption function and a source code of the decryption function; Obtaining the source code of the encryption function from the encryption and decryption file, thereby generating an encryption tool source file; Compiling the encryption tool source file to obtain an executable encryption tool; The step of “calling an encryption function to encrypt the initial Shellcode to obtain the encrypted Shellcode” includes: The executable encryption tool is used to encrypt the initial Shellcode to obtain the encrypted Shellcode.

[0012] A second aspect of the present invention provides an automated anti-killing remote control program generation tool, the tool comprising: Shellcode acquisition module, used to obtain the initial Shellcode; A Shellcode encryption module, used for calling an encryption function to encrypt the initial Shellcode to obtain an encrypted Shellcode; The embedding module is used to embed the source code of the decryption function into the loader template to generate the loader source file; The compiling module is used to compile the loader source file using a compiling tool and embed the encrypted Shellcode to obtain the executable remote control program.

[0013] Preferably, the loader template includes a preset first mark; The embedded module comprises: A first embedding unit, configured to embed the source code of the decryption function into the loader template according to the preset first mark to obtain a first source code; The first file generating unit is used to generate the loader source file according to the first source code.

[0014] Preferably, the loader template includes a preset first mark and a preset second mark; The decryption function includes a called function; The embedded module comprises: A first embedding unit, configured to embed the source code of the decryption function into the loader template according to the preset first mark to obtain a first source code; A second embedding unit is used to embed the source code file package containing the called function into the first source code according to the preset second mark to obtain a second source code; The second file generating unit generates the loader source file according to the second source code.

[0015] According to a third aspect of the present invention, an electronic device is provided, comprising a memory and a processor, wherein the memory stores a computer program that can be loaded by the processor and execute the method described above.

[0016] According to a fourth aspect of the present invention, a computer-readable storage device is provided, storing a computer program that can be loaded by a processor and execute the method as described above.

[0017] The present invention has the following beneficial effects: (1) The method for generating an automated anti-killing remote control program proposed in the present invention embeds the source code of the decryption function into the loader template, and then embeds the encrypted Shellcode during the compilation process, thereby generating an executable remote control program. The present invention achieves the decoupling between the loader template and the encryption and decryption algorithm, allowing the user to optimize the encryption and decryption algorithm alone without having to worry about other codes of the loader, so as to automatically upgrade or replace the encryption and decryption algorithm without affecting other system functions, thereby improving the efficiency of attack and defense drills.

[0018] (2) A preset first tag is pre-added in the loader template, so that the program (the program executing the method of the present invention) can automatically embed the source code of the decoding function according to the tag, thereby generating a loader source file.

[0019] (3) Considering that some decoding functions may call other functions, the present invention also adds a preset second tag in the loader template so that the program can embed the source file package where the called function is located into the loader template according to this tag.

[0020] (4) The loader template also sets preset embedding instructions. M loader source files are generated using M loader templates, which are then compiled using N compilers. The encrypted Shellcode is embedded into the compiled binary file according to the preset embedding instructions, thereby generating M×N executable remote control programs in batches, further improving the efficiency of attack and defense drills.

[0021] (5) The encryption function and decryption function are obtained according to the encryption and decryption files specified by the user, so that the user can combine different encryption and decryption algorithms with the same loader template, thereby providing greater flexibility for the generation of remote control programs and further improving the efficiency of attack and defense drills. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 This is a schematic diagram of the main steps of the first embodiment of the method for generating an automated anti-killing remote control program in the present invention; Figure 2This is a schematic diagram of the main steps of Embodiment 2 of the method for generating an automated anti-killing remote control program in the present invention. DETAILED DESCRIPTION

[0023] The preferred embodiments of the present invention are described below with reference to the accompanying drawings. It should be understood by those skilled in the art that these embodiments are only used to explain the technical principles of the present invention and are not intended to limit the protection scope of the present invention.

[0024] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0025] It should be noted that, in the description of the present invention, the terms "first" and "second" are only for the convenience of description, and do not indicate or imply the relative importance of the devices, elements or parameters, and therefore cannot be understood as limiting the present invention. In addition, the term "and / or" in the present invention is only a description of the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article, unless otherwise specified, generally indicates that the associated objects before and after are in an "or" relationship.

[0026] Figure 1 Schematic diagram of the main steps of the first embodiment of the method for generating an automatic anti-killing remote control program in the present invention. Figure 1 As shown, the generation method of this embodiment includes steps A10-A40: Step A10: Get the initial Shellcode.

[0027] Users can use external commands to specify the Shellcode that needs to be compiled into the program, for example: packer.exe -f shellcode.bin, in this example, packer.exe is a program used to execute the method of this embodiment, and shellcode.bin is a specified Shellcode file. Since the Shellcode at this time has not been encrypted, it is called "initial Shellcode" in this embodiment.

[0028] Step A20: Call the encryption function to encrypt the initial Shellcode to obtain the encrypted Shellcode.

[0029] Step A30: embed the source code of the decryption function into the loader template to generate a loader source file.

[0030] The loader template includes a preset first tag and a preset embedding instruction. For example, a loader template written in the go language includes the following source code: import( "embed" "golang.org / x / sys / windows" "syscall" "unsafe" ) / / go:embed shellcode var shellcode []byte / / __DECODE__ Here, the import keyword is used to import other packages so that the functions, types, variables, constants, etc. defined in these packages can be used in the current file.

[0031] “ / / go:embed shellcode” is the preset embedding instruction, where “ / / go:embed” is a compiler instruction, which is used in conjunction with the embed package imported by import to embed the contents of the external file shellcode into the go program during compilation.

[0032] “var shellcode []byte” defines a variable of type []byte, and the embedded file content will be stored in this variable in the form of byte slices.

[0033] " / / __DECODE__" is the default first tag.

[0034] Step A30 may specifically include steps A31-A32: Step A31: embed the source code of the decryption function into the loader template according to the preset first tag to obtain the first source code.

[0035] Specifically, the preset first marker may be replaced by the source code of the decryption function, or the source code of the decryption function may be inserted after the preset first marker.

[0036] Step A32: Generate a loader source file according to the first source code.

[0037] Step A40: Use a compilation tool to compile the loader source file and embed the encrypted Shellcode to obtain an executable remote control program.

[0038] There are M loader templates and M generated loader source files, which correspond one to one; there are N compilation tools; and both M and N are preset values.

[0039] Specifically, step A40 may include: for M loader source files, using N compilation tools to compile each loader source file respectively, and embedding the encrypted Shellcode into the compiled binary file according to a preset embedding instruction, thereby generating M×N executable remote control programs.

[0040] When N compilation tools are used to compile each loader source file respectively, a multi-threaded parallel compilation method can be used to speed up the compilation speed.

[0041] In an optional embodiment, the loader template includes a preset second tag in addition to the preset first tag and the preset embedded instruction; the decryption function includes the called function. For example, another loader template written in the go language includes the following source code: import( "embed" "golang.org / x / sys / windows" "syscall" "unsafe" / / __IMPORT__ ) / / go:embed shellcode var shellcode []byte / / __DECODE__ Among them, “ / / __IMPORT__” is the preset second tag, “ / / go:embed shellcode” is the preset embedding instruction, and “ / / __DECODE__” is the preset first tag.

[0042] Therefore, in this optional embodiment, step A30 may specifically include steps A35-A37: Step A35: embed the source code of the decryption function into the loader template according to the preset first tag to obtain the first source code.

[0043] Step A36: embed the source code file package containing the called function into the first source code according to the preset second mark to obtain the second source code.

[0044] Because the decryption function will inevitably call some functions, if these called functions do not exist in the package currently imported by import, it is necessary to insert a source code file package containing the called functions according to the preset second tag.

[0045] Step A37: Generate a loader source file according to the second source code.

[0046] Figure 2 This is a schematic diagram of the main steps of the second embodiment of the method for generating an automatic anti-killing remote control program in the present invention. Figure 2 As shown, the generation method of this embodiment includes steps B10-B70: Step B10: Obtain the encryption and decryption file specified by the user, wherein the encryption and decryption file includes the source code of the encryption function and the source code of the decryption function.

[0047] The encryption function and decryption function here match each other, that is, the encryption function can be used to encrypt data, and the decryption function can be used to decrypt and restore the encrypted data.

[0048] Step B20: Obtain the source code of the encryption function from the encryption and decryption file, thereby generating an encryption tool source file.

[0049] Step B30: compile the encryption tool source file to obtain an executable encryption tool.

[0050] Step B40: Get the initial Shellcode.

[0051] Step B50: Use an executable encryption tool to encrypt the initial Shellcode to obtain the encrypted Shellcode.

[0052] Step B60: embed the source code of the decryption function into the loader template to generate a loader source file.

[0053] Step B70: Use a compilation tool to compile the loader source file and embed the encrypted Shellcode to obtain an executable remote control program.

[0054] Although the various steps in the above embodiment are described in the above-mentioned order, those skilled in the art can understand that in order to achieve the effect of this embodiment, different steps do not have to be executed in such an order. They can be executed simultaneously (in parallel) or in a reverse order. These simple changes are within the scope of protection of the present invention.

[0055] Based on the above method embodiment, the present invention also provides an embodiment of an automated anti-killing remote control program generation tool. The generation tool of this embodiment includes: a Shellcode acquisition module, a Shellcode encryption module, an embedding module and a compiling module.

[0056] Among them, the Shellcode acquisition module is used to obtain the initial Shellcode; the Shellcode encryption module is used to call the encryption function to encrypt the initial Shellcode to obtain the encrypted Shellcode; the embedding module is used to embed the source code of the decryption function into the loader template to generate the loader source file; the compilation module is used to compile the loader source file using the compilation tool and embed the encrypted Shellcode to obtain an executable remote control program.

[0057] In this embodiment, the loader template includes a preset first mark; the embedding module includes: a first embedding unit and a first file generating unit.

[0058] The first embedding unit is used to embed the source code of the decryption function into the loader template according to the preset first mark to obtain the first source code; the first file generating unit is used to generate the loader source file according to the first source code.

[0059] In an optional embodiment, the loader template includes not only a preset first tag but also a preset second tag; the decryption function includes a called function.

[0060] In this optional embodiment, the embedding module includes: a first embedding unit, a second embedding unit and a second file generating unit.

[0061] Among them, the first embedding unit is used to embed the source code of the decryption function into the loader template according to a preset first mark to obtain the first source code; the second embedding unit is used to embed the source code file package containing the called function into the first source code according to a preset second mark to obtain the second source code; the second file generation unit generates a loader source file according to the second source code.

[0062] Furthermore, the present invention also provides an embodiment of an electronic device. The electronic device of this embodiment includes a memory and a processor. The memory stores a computer program that can be loaded by the processor and execute the method as described above.

[0063] Furthermore, the present invention also provides an embodiment of a computer-readable storage device, in which a computer program capable of being loaded by a processor and executing the method described above is stored.

[0064] The computer-readable storage device may include: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes.

[0065] Those skilled in the art should be able to appreciate that the method steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of electronic hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in electronic hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0066] So far, the technical solutions of the present invention have been described in conjunction with the preferred embodiments shown in the accompanying drawings. However, it is easy for those skilled in the art to understand that the protection scope of the present invention is obviously not limited to these specific embodiments. Without departing from the principle of the present invention, those skilled in the art can make equivalent changes or substitutions to the relevant technical features, and the technical solutions after these changes or substitutions will fall within the protection scope of the present invention.

Claims

1. A method for generating an automated anti-killing remote control program, characterized in that: The method comprises: Get the initial Shellcode; Calling an encryption function to encrypt the initial Shellcode to obtain an encrypted Shellcode; Embed the source code of the decryption function into the loader template to generate the loader source file; The loader source file is compiled using a compilation tool, and the encrypted Shellcode is embedded therein, thereby obtaining the executable remote control program.

2. The method for generating an automated anti-killing remote control program according to claim 1, characterized in that: The loader template includes a preset first mark; The steps of "embedding the source code of the decryption function into the loader template to generate the loader source file" include: Embed the source code of the decryption function into the loader template according to the preset first mark to obtain a first source code; The loader source file is generated according to the first source code.

3. The method for generating an automated anti-killing remote control program according to claim 2, characterized in that: The loader template includes a preset first mark and a preset second mark; The decryption function includes a called function; The steps of "embedding the source code of the decryption function into the loader template to generate the loader source file" include: Embed the source code of the decryption function into the loader template according to the preset first mark to obtain a first source code; According to the preset second mark, embedding the source code file package containing the called function into the first source code to obtain a second source code; The loader source file is generated according to the second source code.

4. The method for generating an automated anti-killing remote control program according to claim 3, characterized in that: There are M loader templates and M generated loader source files, and they correspond one to one; The number of the compilation tools is N; The loader template also includes preset embedding instructions; The step of "using a compilation tool to compile the loader source file and embedding the encrypted Shellcode to obtain the executable remote control program" includes: For the M loader source files, use N compilation tools to compile each of the loader source files respectively, and embed the encrypted Shellcode into the compiled binary file according to the embedding instruction, so as to generate M×N executable remote control programs; Wherein, M and N are both preset values.

5. The method for generating an automated anti-killing remote control program according to claim 1, characterized in that: The method further comprises: Obtaining an encryption / decryption file specified by a user, wherein the encryption / decryption file includes a source code of the encryption function and a source code of the decryption function; Obtaining the source code of the encryption function from the encryption and decryption file, thereby generating an encryption tool source file; Compiling the encryption tool source file to obtain an executable encryption tool; The step of "calling an encryption function to encrypt the initial Shellcode to obtain the encrypted Shellcode" includes: The executable encryption tool is used to encrypt the initial Shellcode to obtain the encrypted Shellcode.

6. An automated anti-killing remote control program generation tool, characterized in that: The tools include: Shellcode acquisition module, used to obtain the initial Shellcode; A Shellcode encryption module, used for calling an encryption function to encrypt the initial Shellcode to obtain an encrypted Shellcode; The embedding module is used to embed the source code of the decryption function into the loader template to generate the loader source file; The compiling module is used to compile the loader source file using a compiling tool and embed the encrypted Shellcode to obtain the executable remote control program.

7. The automated anti-killing remote control program generation tool according to claim 6, characterized in that: The loader template includes a preset first mark; The embedded module comprises: A first embedding unit, configured to embed the source code of the decryption function into the loader template according to the preset first mark to obtain a first source code; The first file generating unit is used to generate the loader source file according to the first source code.

8. The automated anti-killing remote control program generation tool according to claim 6, characterized in that: The loader template includes a preset first mark and a preset second mark; The decryption function includes a called function; The embedded module comprises: A first embedding unit, configured to embed the source code of the decryption function into the loader template according to the preset first mark to obtain a first source code; A second embedding unit is used to embed the source code file package containing the called function into the first source code according to the preset second mark to obtain a second source code; The second file generating unit generates the loader source file according to the second source code.

9. An electronic device, characterized in that: The method comprises a memory and a processor, wherein the memory stores a computer program that can be loaded by the processor and execute the method according to any one of claims 1 to 5.

10. A computer-readable storage device, characterized in that: A computer program is stored which can be loaded by a processor and execute the method according to any one of claims 1 to 5.

Images