This is my presentation about bypassing AntiVirus solutions at B33F H4CK1NG in April 2024, which is the book club under B33F 50μP CTF team.

Disclaimer

Just my personal notes. I’m still learning. Much of the content is hearsay or something I “dreamed about”, so it’s just for reference only.

This article is for educational purposes only. I’m not responsible for any damage caused by the misuse of this information.

Before we start

We only discuss User-level (Ring-3) attack and defense, no Kernel(Ring-0).

This writeup is based on many previous works.

Why?

Bypassing AV is crucial nowadays because of windows defender and other AV solutions when we are pefroming red teaming or pentesting.

If you cannot bypass AV, maybe you can have only a plain reverse shell, which is not enough for a red team operation.

What is C2?

  • Command and Control
  • Backdoor
  • Famous C2 frameworks:

What does Anti Virus do?

Static Analysis

image

  • Open source projects’ signature are highly recognized, especially the hash of official release. image

image

Dynamic Detection

  • Run in sandbox
  • Hook dangerous winapi functions in ntdll.dll
    • VirtualAlloc/VirtualProtect rwx memory
    • WriteProcessMemory
    • CreateRemoteThread
  • Monitor suspicious internet traffic

Some bypass methods

Static Analysis Bypass

Dynamic Detection Bypass

Some other weird(?) bypass methods

  • Use BYOVD attack to kill antivirus.
  • Guess the excluded path of antivirus.

Random Victim

Our victim today:

upload_62a3f451333e8bddbf83212cddd44595 (1)

AMSI

  • AMSI is an interface on which applications or services (third-party included) are able to scan a script’s content for malicious usage. If a signature in the script is registered by the AMSI antimalware service provider (Windows Defender by default), it will be blocked. (我有記得打馬賽克)
  • amsi.dll
  • Bypassing AMSI is easy 
DWORD offset = 0x83;
FARPROC ptrAmsiScanBuffer = GetProcAddress(LoadLibrary("amsi.dll"), "AmsiScanBuffer");
VirtualProtect(ptrAmsiScanBuffer + offset, 1, PAGE_EXECUTE_READWRITE, &dwOld);
memcpy(ptrAmsiScanBuffer + offset, "\x74", 1);
VirtualProtect(ptrAmsiScanBuffer + offset, 1, dwOld, &dwOld);

Conclusion