maldev-for-dummies - A workshop about Malware Development

项目说明

Malware De for Dummies

*In the age of EDR, red team operators cannot get away with using pre-compiled payloads anymore. As such, malware de is becoming a vital skill for any operator. Getting started with maldev may seem daunting, but is actually very easy. This workshop will show you all you need to get started!*

This repository contains the slides and accompanying exercises for the 'MalDev for Dummies' workshop that has been/will be facilitated at Hack in Paris 2022 and X33fcon 2023. Although the slides were designed to be presented 'in-person', the materials and exercises will remain a here to be completed at your own pace - the learning process should never be rushed! Issues and pull requests to this repo with questions and/or suggestions are welcomed.

> ⚠ Disclaimer: Malware de is a skill that can -and should- be used for good, to further the field of (offensi and keep our defenses sharp. If you ever use this skillset to perform acti that you have no authorization for, you are a bigger dummy than this workshop is intended for and you should skidaddle on out of here.

Workshop Description

With antivirus (AV) and Enterprise Detection and Response (EDR) tooling becoming more mature by the minute, the red team is being forced to stay ahead of the curve. Gone are the times of execute-assembly and dropping unmodified payloads on disk - if you want your engagements to last longer than a week you will have to step up your payload creation and malware de game. Starting out in this field can be daunting however, and finding the right resources is not always easy.

This workshop is aimed at beginners in the space and will guide you through your first steps as a malware de. It is aimed primarily at offensi, but defensi are also very welcome to attend and broaden their skillset.

During the workshop we will go over some theory, after which we will set you up with a lab en. There will be exercises that you can complete depending on your current skillset and level of comfort with the subject. However, the aim of the workshop is to learn, and explicitly *not* to complete all the exercises. You are free to choose your preferred programming language for malware de, but support during the workshop is provided primarily for the C# and Nim programming languages.

During the workshop, we will discuss the key topics required to get started with building your own malware. This includes (but is not limited to):

Getting Started

To get started with malware de, you will need a de so that you are not bothered by any defensi that may run on your host machine. I prefer Windows for de, but Linux or MacOS will do just as fine. Install your editor/IDE of choice (I use VS Code for almost e except C#, for which I use Studio, and then install the toolchains required for your MalDe of choice:

Don't forget to disable Windows Defender or add the appropriate exclusions, so your hard work doesn't get quarantined! Later on, we can test on a separate machine with defensi like A.

> ℹ Note: Oftentimes, package managers such as apt or software management tools such as Chocolatey or Winget (now built-in!) can be used to automate the installation and management of dependencies in a con and repeatable way. Be conscious however that in package managers may be a couple behind on the real thing! Below is an example command to install the mentioned tooling all at once.
>
>

Compiling programs

The languages that we will discuss during this workshop are *compiled* languages, meaning that a compiler is used to translate your source code into binary executables of your chosen format. The process of compilation differs per language.

C#

C# code (.cs files) can either be compiled directly (with the csc utility) or Studio itself. Most source code in this repo (except the solution to bonus exercise 3) can be compiled as follows.

> ℹ Note: Make sure you run the below command in a " Studio De Command Prompt" so it knows where to find csc, it is recommended to use the "x64 Nati Command Prompt" for your of Studio. The /unsafe flag will be required for most scripts where we access low-le directly.

You can enable compile-time optimizations with the /optimize flag. You can hide the console window by adding /target:winexe as well, or compile as DLL with /target:library (but make sure your code structure is suitable for this).

Nim

Nim code (.nim files) is compiled with the nim c command. The source code in this repo can be compiled as follows.

If you want to optimize your build for size and strip debug information (much better for opsec!), you can add the following flags.

Optionally you can hide the console window by adding --app:gui as well.

Golang

Golang code (.go files) is compiled with the go build command. The source code in this repo can be compiled as follows.

If you want to optimize your build for size and strip debug information (much better for opsec!), you can add the following flags.

Rust

Rust code (.rs files) is compiled via the the cargo command. Cargo can be used to manage your dependencies and build your project. The source code in this repo can be compiled by na to the project folder and running the following command.

If you want to optimize your build for size and strip debug information, you can add the following flags. Refer also to the [profile.release] section in each Cargo.toml file for some compile-time opsec options.

Dependencies

C#

Most solutions can be compiled without dependencies. In case dependencies are required, a Studio project is provided that links to the appropriate NuGet packages.

Nim

Most Nim programs depend on a library called "Winim" to interface with the Windows API. You can install the library with the Nimble package manager as follows (after installing Nim):

Golang

Some dependencies are used in the source code of this repo. You can install them as follows (after installing Go):

Rust

Some examples depend on the windows-sys crate to call the Windows API. Since we are using Cargo, packages will be automatically managed when you compile a test or release build.

Resources

The workshop slides reference some resources that you can use to get started. Additional resources, such as relevant blogs or code snippets, are listed in the README.md files for each exercise!

项目信息

开发语言：Nim

Star 数：1826

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A workshop about Malware Development展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。