恶意广告与浏览器漏洞利用链取证深度分析

# 创建隔离分析环境 - 在专用虚拟机中运行
# 安装 mitmproxy 作为中间人代理
pip install mitmproxy

# 启动 mitmproxy 捕获浏览器流量
mitmproxy --listen-port 8080 --set stream_large_bodies=0

# 安装 tshark 用于流量捕获
sudo apt install tshark

# 捕获浏览器相关流量（过滤HTTP/HTTPS）
tshark -i eth0 -f "tcp port 80 or tcp port 443 or tcp port 8080" \
  -w /tmp/browser_capture.pcap

# 安装 Volatility3 用于内存取证
pip install volatility3
volatility3 -h

# mitmproxy 脚本 - 恶意广告重定向链捕获
from mitmproxy import http
import json
from datetime import datetime

redirect_chains = {}

class MalvertisingRedirectTracker:
    def __init__(self):
        self.chains = {}
        self.suspicious_patterns = [
            "click?", "redirect?", "out.php", "track?",
            "match?", "go?", "land?", "r.php", "redir"
        ]

    def request(self, flow: http.HTTPFlow):
        url = flow.request.pretty_url
        client_ip = flow.client_conn.peername[0] if flow.client_conn.peername else "unknown"
        
        if flow.request.headers.get("Referer"):
            referer = flow.request.headers["Referer"]
            if any(p in url.lower() for p in self.suspicious_patterns):
                chain_id = flow.request.headers.get(
                    "X-Request-ID", client_ip + str(flow.request.timestamp_start)
                )
                if chain_id not in self.chains:
                    self.chains[chain_id] = []
                self.chains[chain_id].append({
                    "timestamp": datetime.fromtimestamp(
                        flow.request.timestamp_start
                    ).isoformat(),
                    "url": url,
                    "referer": referer,
                    "method": flow.request.method,
                    "status": "request"
                })

    def response(self, flow: http.HTTPFlow):
        status_code = flow.response.status_code
        location = flow.response.headers.get("Location", "")
        if status_code in (301, 302, 303, 307, 308) and location:
            print(f"[REDIRECT] {status_code} -> {location}")
            print(f"  From: {flow.request.pretty_url}")

addons = [MalvertisingRedirectTracker()]

# 使用 tshark 提取HTTP重定向链
tshark -r /tmp/malvertising_capture.pcap \
  -Y "http.response.status in {301 302 303 307 308}" \
  -T fields \
  -e frame.time \
  -e http.response.status_code \
  -e http.location \
  -e http.request.uri \
  -e ip.src \
  -e ip.dst

# 提取所有涉及的域名
tshark -r /tmp/malvertising_capture.pcap \
  -Y "http" \
  -T fields -e http.host \
  | sort | uniq -c | sort -rn

import math
from collections import Counter

def calculate_entropy(domain):
    counter = Counter(domain)
    length = len(domain)
    entropy = -sum(
        (count/length) * math.log2(count/length) 
        for count in counter.values()
    )
    return entropy

def detect_dga_domains(domains, entropy_threshold=3.5, min_length=12):
    suspicious = []
    for domain in domains:
        apex = domain.split('.')[0]
        entropy = calculate_entropy(apex)
        avg_consonant_run = max_consecutive_consonants(apex)
        
        if (entropy > entropy_threshold and 
            len(apex) >= min_length and 
            avg_consonant_run > 3):
            suspicious.append({
                "domain": domain,
                "entropy": round(entropy, 3),
                "consonant_run": avg_consonant_run,
                "confidence": min(0.95, entropy / 5.0)
            })
    
    return sorted(suspicious, key=lambda x: x["entropy"], reverse=True)

def max_consecutive_consonants(s):
    consonants = set('bcdfghjklmnpqrstvwxyz')
    max_run = 0
    current_run = 0
    for c in s.lower():
        if c in consonants:
            current_run += 1
            max_run = max(max_run, current_run)
        else:
            current_run = 0
    return max_run

用户终端 → 恶意广告创意(JS) → Gate域名(跳板) → EK前端(VPS) → EK后端(多层) → Payload分发(CDN) → C2服务器(DGA)

# 提取广告创意中嵌入的可疑域名
grep -oP '(https?://[a-zA-Z0-9._/-]+)' malicious_ad.js | \
  sort -u | tee extracted_urls.txt

# 对提取的域名进行WHOIS查询
while read -r domain; do
    echo "=== $domain ===" >> whois_report.txt
    whois "$domain" 2>/dev/null | \
      grep -E 'Registrar|Created|Updated|Expires|Name Server' >> whois_report.txt
    echo "" >> whois_report.txt
done