Git Product home page Git Product logo

bypassuseradd's Introduction

BypassUserAdd

Subscription

通过反射DLL注入、Win API、C#、以及底层实现NetUserAdd方式实现BypassAV进行增加用户的功能,实现Cobalt Strike插件化

Usage

结合cna使用,直接load cna然后选对应的UserAdd方式即可

Note

暂时先只支持x64

部分代码参考idiotc4t师傅,非常感谢师傅的分享 主要实现了四种方式：

    1. 通过编写反射DLL实现API(NetUserAdd)添加用户
    1. 通过编写反射DLL实现重新实现NetUserAdd底层封装（主要是利用MS-SAMR）进行用户添加
    1. 通过微软提供C#利用活动目录创建用户方式,实现内存调用(execute-assembly) 参考:https://docs.microsoft.com/zh-cn/troubleshoot/dotnet/csharp/add-user-local-system
    1. 通过上传重写NetUserAdd底层实现添加用户的可执行程序实现添加用户

使用过程中第2和4种方式设置的用户默认是未启用状态,AV一般不会监控账户启用而会监控账户禁用,因此还需要net user 对应的账户名称 /active:yes

bypassuseradd's People

Contributors

crisprss avatar

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.